- Kernel - mailweb.openeuler.org

[PATCH v2 openEuler-22.03-LTS-SP1 6/7] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 5/7] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 4/7] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 3/7] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 2/7] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 20 Mar '24

20 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 1/7] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 0/7] mpt3sas bugfix
by Baogen Shang 20 Mar '24

20 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. v2: add a patch to fix the check depend fail Ranjan Kumar (2): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 scsi: mpt3sas: Fix loop logic Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 7/7] scsi: mpt3sas: Fix loop logic
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.202 commit 697bc325b9775d355942f1c6687f99dafd597566 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3c978492c333f0c08248a8d51cecbe5eb5f617c9 upstream. The retry loop continues to iterate until the count reaches 30, even after receiving the correct value. Exit loop when a non-zero value is read. Fixes: 4ca10f3e3174 ("scsi: mpt3sas: Perform additional retries if doorbell read returns 0") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20231020105849.6350-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 1b9b266b2b54..4bf1ea39d21a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -216,8 +216,8 @@ _base_readl_ext_retry(const volatile void __iomem *addr) for (i = 0 ; i < 30 ; i++) { ret_val = readl(addr); - if (ret_val == 0) - continue; + if (ret_val != 0) + break; } return ret_val; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 6/7] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 5/7] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 4/7] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 3/7] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 2/7] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 20 Mar '24

20 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 1/7] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 0/7] mpt3sas bugfix
by Baogen Shang 20 Mar '24

20 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. v2: add a patch to fix the check depend fail Ranjan Kumar (2): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 scsi: mpt3sas: Fix loop logic Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 7/7] scsi: mpt3sas: Fix loop logic
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.202 commit 697bc325b9775d355942f1c6687f99dafd597566 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3c978492c333f0c08248a8d51cecbe5eb5f617c9 upstream. The retry loop continues to iterate until the count reaches 30, even after receiving the correct value. Exit loop when a non-zero value is read. Fixes: 4ca10f3e3174 ("scsi: mpt3sas: Perform additional retries if doorbell read returns 0") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20231020105849.6350-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 1b9b266b2b54..4bf1ea39d21a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -216,8 +216,8 @@ _base_readl_ext_retry(const volatile void __iomem *addr) for (i = 0 ; i < 30 ; i++) { ret_val = readl(addr); - if (ret_val == 0) - continue; + if (ret_val != 0) + break; } return ret_val; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 6/7] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 5/7] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 4/7] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 3/7] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 2/7] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 20 Mar '24

20 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 1/7] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH v2 openEuler-22.03-LTS-SP1 0/7] mpt3sas bugfix
by Baogen Shang 20 Mar '24

20 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. v2: add a patch to fix the check depend fail Ranjan Kumar (2): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 scsi: mpt3sas: Fix loop logic Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH OLK-5.10 v2 0/6] ksmbd: fix cve issues
by Long Li 20 Mar '24

20 Mar '24

This patch set fix 4 ksmbd cve issues. Dawei Li (1): ksmbd: Remove duplicated codes Namjae Jeon (3): ksmbd: validate mech token in session setup ksmbd: validate session id and tree id in compound request ksmbd: fix UAF issue in ksmbd_tcp_new_connection() Yang Yingliang (1): ksmbd: switch to use kmemdup_nul() helper luosili (1): ksmbd: fix uaf in smb20_oplock_break_ack fs/ksmbd/asn1.c | 32 +++++++++++++++++--------------- fs/ksmbd/connection.c | 6 ------ fs/ksmbd/connection.h | 2 +- fs/ksmbd/smb2pdu.c | 38 +++++++++++++++++++++++++------------- fs/ksmbd/transport_rdma.c | 11 ++++++----- fs/ksmbd/transport_tcp.c | 13 +++++++------ 6 files changed, 56 insertions(+), 46 deletions(-) -- 2.31.1

2 7

[PATCH OLK-5.10 0/6] ksmbd: fix cve issues
by Long Li 20 Mar '24

20 Mar '24

This patch set fix three ksmbd cve issue. Dawei Li (1): ksmbd: Remove duplicated codes Namjae Jeon (3): ksmbd: validate mech token in session setup ksmbd: validate session id and tree id in compound request ksmbd: fix UAF issue in ksmbd_tcp_new_connection() Yang Yingliang (1): ksmbd: switch to use kmemdup_nul() helper luosili (1): ksmbd: fix uaf in smb20_oplock_break_ack fs/ksmbd/asn1.c | 32 +++++++++++++++++--------------- fs/ksmbd/connection.c | 6 ------ fs/ksmbd/connection.h | 2 +- fs/ksmbd/smb2pdu.c | 38 +++++++++++++++++++++++++------------- fs/ksmbd/transport_rdma.c | 11 ++++++----- fs/ksmbd/transport_tcp.c | 13 +++++++------ 6 files changed, 56 insertions(+), 46 deletions(-) -- 2.31.1

2 7

[PATCH openEuler-22.03-LTS-SP1 6/6] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 20 Mar '24

20 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 20 Mar '24

20 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 20 Mar '24

20 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 20 Mar '24

20 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] mpt3sas bugfix
by Baogen Shang 20 Mar '24

20 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH OLK-6.6] Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
by Zhengchao Shao 20 Mar '24

20 Mar '24

From: Yuxuan Hu <20373622(a)buaa.edu.cn> mainline inclusion from mainline-v6.8-rc7 commit 2535b848fa0f42ddff3e5255cf5e742c9b77bb26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YV3O CVE: CVE-2024-22099 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a normal connection and disconnection process with the testcase that triggered a KASAN report. We analyzed the cause of this bug as follows: 1. In the packets captured during a normal connection, the host sends a `Read Encryption Key Size` type of `HCI_CMD` packet (Command Opcode: 0x1408) to the controller to inquire the length of encryption key.After receiving this packet, the controller immediately replies with a Command Completepacket (Event Code: 0x0e) to return the Encryption Key Size. 2. In our fuzz test case, the timing of the controller's response to this packet was delayed to an unexpected point: after the RFCOMM and L2CAP layers had disconnected but before the HCI layer had disconnected. 3. After receiving the Encryption Key Size Response at the time described in point 2, the host still called the rfcomm_check_security function. However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` had already been released, and when the function executed `return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling rfcomm_recv_frame in rfcomm_process_rx. Signed-off-by: Yuxuan Hu <20373622(a)buaa.edu.cn> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bluetooth/rfcomm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 053ef8f25fae..1d34d8497033 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1941,7 +1941,7 @@ static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) /* Get data directly from socket receive queue without copying it. */ while ((skb = skb_dequeue(&sk->sk_receive_queue))) { skb_orphan(skb); - if (!skb_linearize(skb)) { + if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { s = rfcomm_recv_frame(s, skb); if (!s) break; -- 2.34.1

2 1

[PATCH v2 OLK-5.10 0/7] enable arm64_pbha by default
by Wupeng Ma 20 Mar '24

20 Mar '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Enhanced maintenance and test capability for pbha. Enable ARM64_PBHA by default. Changelog since v1: - let {pte,pmd}_pbha return false if pbha is not enabled Ma Wupeng (7): proc: introduce proc_hide_ents to hide proc files arm64: mm: Cleanup in pbha_bit0_pte_range mm: cpufeature: Make update_pbha_perf_only_bit static arm64: mm: Do not show info during startup if pbha is not enabled arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled arm64: mm: pagemap: Export pbha bit0 info config: Enable ARM64_PBHA by default Documentation/admin-guide/mm/pagemap.rst | 4 +++- arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/kernel/cpufeature.c | 2 +- drivers/soc/hisilicon/pbha.c | 11 +++++------ fs/proc/base.c | 25 ++++++++++++++++++++++-- fs/proc/task_mmu.c | 15 ++++++++++++++ include/linux/pbha.h | 24 +++++++++++++++++++++++ 7 files changed, 72 insertions(+), 11 deletions(-) -- 2.25.1

2 8

[PATCH openEuler-1.0-LTS] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Yi Yang 20 Mar '24

20 Mar '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v4.19.307 commit eafd83b92f6c044007a3591cbd476bcf90455990 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JR3 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 0ef7cb0448e8..e33b71659215 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -23,10 +23,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -58,7 +61,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -201,6 +204,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -228,34 +232,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -266,6 +273,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.25.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 119aafedbb74fab084751ff82e016ce59ba3a203
by kernel test robot 20 Mar '24

20 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 119aafedbb74fab084751ff82e016ce59ba3a203 !5340 CVE-2023-52593 Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240319 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- arm64-randconfig-004-20240319 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-001-20240319 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-001-20240320 | `-- (.text):undefined-reference-to-lockdep_is_cpus_held `-- x86_64-buildonly-randconfig-005-20240320 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-002-20240319 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-003-20240319 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-002-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-003-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-004-20240320 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-006-20240320 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead elapsed time: 724m configs tested: 40 configs skipped: 142 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240319 gcc arm64 randconfig-002-20240319 clang arm64 randconfig-003-20240319 clang arm64 randconfig-004-20240319 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240319 gcc loongarch randconfig-002-20240319 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240320 gcc x86_64 buildonly-randconfig-002-20240320 clang x86_64 buildonly-randconfig-003-20240320 clang x86_64 buildonly-randconfig-004-20240320 clang x86_64 buildonly-randconfig-005-20240320 gcc x86_64 buildonly-randconfig-006-20240320 clang x86_64 defconfig gcc x86_64 randconfig-001-20240320 clang x86_64 randconfig-002-20240320 clang x86_64 randconfig-003-20240320 gcc x86_64 randconfig-004-20240320 clang x86_64 randconfig-005-20240320 clang x86_64 randconfig-006-20240320 clang x86_64 randconfig-011-20240320 gcc x86_64 randconfig-012-20240320 gcc x86_64 randconfig-013-20240320 gcc x86_64 randconfig-014-20240320 gcc x86_64 randconfig-015-20240320 clang x86_64 randconfig-016-20240320 gcc x86_64 randconfig-071-20240320 clang x86_64 randconfig-072-20240320 gcc x86_64 randconfig-073-20240320 clang x86_64 randconfig-074-20240320 gcc x86_64 randconfig-075-20240320 gcc x86_64 randconfig-076-20240320 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS-o] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Yi Yang 20 Mar '24

20 Mar '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v4.19.307 commit eafd83b92f6c044007a3591cbd476bcf90455990 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JR3 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 0ef7cb0448e8..e33b71659215 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -23,10 +23,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -58,7 +61,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -201,6 +204,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -228,34 +232,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -266,6 +273,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.25.1

1 0

[PATCH OLK-5.10 0/7] enable arm64_pbha by default
by Wupeng Ma 20 Mar '24

20 Mar '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Enhanced maintenance and test capability for pbha. Enable ARM64_PBHA by default. Ma Wupeng (7): proc: introduce proc_hide_ents to hide proc files arm64: mm: Cleanup in pbha_bit0_pte_range mm: cpufeature: Make update_pbha_perf_only_bit static arm64: mm: Do not show info during startup if pbha is not enabled arm64: mm: Hide pbha_bit0 in procfs if pbha is not enabled arm64: mm: pagemap: Export pbha bit0 info config: Enable ARM64_PBHA by default Documentation/admin-guide/mm/pagemap.rst | 4 +++- arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/kernel/cpufeature.c | 2 +- drivers/soc/hisilicon/pbha.c | 11 +++++------ fs/proc/base.c | 25 ++++++++++++++++++++++-- fs/proc/task_mmu.c | 15 ++++++++++++++ include/linux/pbha.h | 18 +++++++++++++++++ 7 files changed, 66 insertions(+), 11 deletions(-) -- 2.25.1

2 8

[PATCH] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Yi Yang 20 Mar '24

20 Mar '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v4.19.307 commit eafd83b92f6c044007a3591cbd476bcf90455990 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JR3 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 0ef7cb0448e8..e33b71659215 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -23,10 +23,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -58,7 +61,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -201,6 +204,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -228,34 +232,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -266,6 +273,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.25.1

1 0

[openeuler:OLK-5.10 28734/30000] drivers/infiniband/hw/xsc/mem.c:21:5: warning: no previous prototype for 'xsc_find_chunk_cont_0'
by kernel test robot 20 Mar '24

20 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: efcbd7d2c09d823eef22dff4bce44d8712ca50c4 commit: 23b8024ef459f8b615c223df6175ea17c6b50c48 [28734/30000] drivers: update yunsilicon drivers to version 1.1.0.375 config: x86_64-openeuler_defconfig-OLK-5.10-func (https://download.01.org/0day-ci/archive/20240320/202403200656.0AcS5LRj-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240320/202403200656.0AcS5LRj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403200656.0AcS5LRj-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/infiniband/hw/xsc/mem.c:21:5: warning: no previous prototype for 'xsc_find_chunk_cont_0' [-Wmissing-prototypes] 21 | int xsc_find_chunk_cont_0(struct xsc_pa_chunk *chunk, | ^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/mem.c: In function 'xsc_find_chunk_cont_0': >> drivers/infiniband/hw/xsc/mem.c:25:9: warning: 'static' is not at beginning of declaration [-Wold-style-declaration] 25 | const static int max_count = sizeof(int) << 3; | ^~~~~ drivers/infiniband/hw/xsc/mem.c: At top level: drivers/infiniband/hw/xsc/mem.c:193:6: warning: no previous prototype for '__xsc_ib_cont_pages' [-Wmissing-prototypes] 193 | void __xsc_ib_cont_pages(struct ib_umem *umem, u64 addr, | ^~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/mem.c:259:6: warning: no previous prototype for '__xsc_ib_populate_pas' [-Wmissing-prototypes] 259 | void __xsc_ib_populate_pas(struct xsc_ib_dev *dev, struct ib_umem *umem, | ^~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/yunsilicon/xsc/net/main.c:166:5: warning: no previous prototype for 'xsc_rx_alloc_page_cache' [-Wmissing-prototypes] 166 | int xsc_rx_alloc_page_cache(struct xsc_rq *rq, int node, u8 log_init_sz) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:179:6: warning: no previous prototype for 'xsc_rx_free_page_cache' [-Wmissing-prototypes] 179 | void xsc_rx_free_page_cache(struct xsc_rq *rq) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:197:6: warning: no previous prototype for 'xsc_eth_cq_error_event' [-Wmissing-prototypes] 197 | void xsc_eth_cq_error_event(struct xsc_core_cq *xcq, enum xsc_event event) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:211:6: warning: no previous prototype for 'xsc_eth_completion_event' [-Wmissing-prototypes] 211 | void xsc_eth_completion_event(struct xsc_core_cq *xcq) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:260:5: warning: no previous prototype for 'xsc_eth_create_cq' [-Wmissing-prototypes] 260 | int xsc_eth_create_cq(struct xsc_core_device *xdev, struct xsc_core_cq *xcq, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:295:5: warning: no previous prototype for 'xsc_eth_destroy_cq' [-Wmissing-prototypes] 295 | int xsc_eth_destroy_cq(struct xsc_core_device *xdev, struct xsc_cq *cq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:333:6: warning: no previous prototype for 'xsc_eth_free_cq' [-Wmissing-prototypes] 333 | void xsc_eth_free_cq(struct xsc_cq *cq) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:338:5: warning: no previous prototype for 'xsc_eth_create_rss_qp_rqs' [-Wmissing-prototypes] 338 | int xsc_eth_create_rss_qp_rqs(struct xsc_core_device *xdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:359:6: warning: no previous prototype for 'xsc_eth_qp_event' [-Wmissing-prototypes] 359 | void xsc_eth_qp_event(struct xsc_core_qp *qp, int type) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:389:5: warning: no previous prototype for 'xsc_eth_create_qp_rq' [-Wmissing-prototypes] 389 | int xsc_eth_create_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:416:5: warning: no previous prototype for 'xsc_eth_destroy_qp_rq' [-Wmissing-prototypes] 416 | int xsc_eth_destroy_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:469:5: warning: no previous prototype for 'xsc_eth_create_qp_sq' [-Wmissing-prototypes] 469 | int xsc_eth_create_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:488:5: warning: no previous prototype for 'xsc_eth_modify_qp_sq' [-Wmissing-prototypes] 488 | int xsc_eth_modify_qp_sq(struct xsc_core_device *xdev, struct xsc_modify_raw_qp_mbox_in *in) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:506:5: warning: no previous prototype for 'xsc_eth_destroy_qp_sq' [-Wmissing-prototypes] 506 | int xsc_eth_destroy_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:750:5: warning: no previous prototype for 'xsc_eth_set_hw_mtu' [-Wmissing-prototypes] 750 | int xsc_eth_set_hw_mtu(struct xsc_core_device *dev, u16 mtu, u16 rx_buf_sz) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:775:5: warning: no previous prototype for 'xsc_eth_get_mac' [-Wmissing-prototypes] 775 | int xsc_eth_get_mac(struct xsc_core_device *dev, char *mac) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:806:5: warning: no previous prototype for 'xsc_eth_modify_qps_channel' [-Wmissing-prototypes] 806 | int xsc_eth_modify_qps_channel(struct xsc_adapter *adapter, struct xsc_channel *c) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:828:5: warning: no previous prototype for 'xsc_eth_modify_qps' [-Wmissing-prototypes] 828 | int xsc_eth_modify_qps(struct xsc_adapter *adapter, | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:845:5: warning: no previous prototype for 'xsc_rx_get_linear_frag_sz' [-Wmissing-prototypes] 845 | u32 xsc_rx_get_linear_frag_sz(u32 mtu) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:852:6: warning: no previous prototype for 'xsc_rx_is_linear_skb' [-Wmissing-prototypes] 852 | bool xsc_rx_is_linear_skb(u32 mtu) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1316:5: warning: no previous prototype for 'xsc_eth_open_channel' [-Wmissing-prototypes] 1316 | int xsc_eth_open_channel(struct xsc_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1527:5: warning: no previous prototype for 'xsc_eth_open_channels' [-Wmissing-prototypes] 1527 | int xsc_eth_open_channels(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1639:6: warning: no previous prototype for 'xsc_eth_activate_channel' [-Wmissing-prototypes] 1639 | void xsc_eth_activate_channel(struct xsc_channel *c) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1645:6: warning: no previous prototype for 'xsc_eth_deactivate_channel' [-Wmissing-prototypes] 1645 | void xsc_eth_deactivate_channel(struct xsc_channel *c) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1691:6: warning: no previous prototype for 'xsc_eth_activate_priv_channels' [-Wmissing-prototypes] 1691 | void xsc_eth_activate_priv_channels(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1706:6: warning: no previous prototype for 'xsc_eth_deactivate_priv_channels' [-Wmissing-prototypes] 1706 | void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:1849:5: warning: no previous prototype for 'xsc_eth_change_link_status' [-Wmissing-prototypes] 1849 | int xsc_eth_change_link_status(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1906:6: warning: no previous prototype for 'xsc_eth_event_handler' [-Wmissing-prototypes] 1906 | void xsc_eth_event_handler(void *arg) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1914:5: warning: no previous prototype for 'xsc_eth_enable_nic_hca' [-Wmissing-prototypes] 1914 | int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1976:5: warning: no previous prototype for 'xsc_eth_disable_nic_hca' [-Wmissing-prototypes] 1976 | int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2009:6: warning: no previous prototype for 'xsc_eth_rss_params_change' [-Wmissing-prototypes] 2009 | void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2319:6: warning: no previous prototype for 'xsc_build_default_indir_rqt' [-Wmissing-prototypes] 2319 | void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2417:5: warning: no previous prototype for 'xsc_eth_nic_mtu_changed' [-Wmissing-prototypes] 2417 | int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2480:5: warning: no previous prototype for 'xsc_set_vf_mac' [-Wmissing-prototypes] 2480 | int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2497:5: warning: no previous prototype for 'xsc_get_vf_config' [-Wmissing-prototypes] 2497 | int xsc_get_vf_config(struct net_device *dev, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2513:5: warning: no previous prototype for 'set_feature_rxcsum' [-Wmissing-prototypes] 2513 | int set_feature_rxcsum(struct net_device *netdev, bool enable) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2565:5: warning: no previous prototype for 'xsc_eth_set_features' [-Wmissing-prototypes] 2565 | int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2582:5: warning: no previous prototype for 'xsc_select_queue' [-Wmissing-prototypes] 2582 | u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2771:24: warning: no previous prototype for 'xsc_tirc_get_default_config' [-Wmissing-prototypes] 2771 | struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2776:6: warning: no previous prototype for 'xsc_build_rss_params' [-Wmissing-prototypes] 2776 | void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2794:6: warning: no previous prototype for 'xsc_eth_build_nic_params' [-Wmissing-prototypes] 2794 | void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2816:6: warning: no previous prototype for 'xsc_eth_build_nic_netdev' [-Wmissing-prototypes] 2816 | void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2887:5: warning: no previous prototype for 'xsc_eth_create_xdev_resources' [-Wmissing-prototypes] 2887 | int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2908:5: warning: no previous prototype for 'xsc_eth_init_nic_rx' [-Wmissing-prototypes] 2908 | int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/yunsilicon/xsc/net/xsc_dcbnl.c: In function 'xsc_dcbnl_setbuffer': drivers/net/ethernet/yunsilicon/xsc/net/xsc_dcbnl.c:968:13: warning: variable 'prio2buffer' set but not used [-Wunused-but-set-variable] 968 | u8 *prio2buffer = NULL; | ^~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/xsc_dcbnl.c:967:14: warning: variable 'buffer_size' set but not used [-Wunused-but-set-variable] 967 | u32 *buffer_size = NULL; | ^~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/xsc_dcbnl.c: In function 'xsc_dcbnl_ieee_setpfc': >> drivers/net/ethernet/yunsilicon/xsc/net/xsc_dcbnl.c:350:29: warning: 'curr_pfc_en' is used uninitialized [-Wuninitialized] 350 | curr_pfc_en |= cee_cfg->pfc_setting[i] << i; | ^~ drivers/net/ethernet/yunsilicon/xsc/net/xsc_dcbnl.c:327:12: note: 'curr_pfc_en' was declared here 327 | u8 curr_pfc_en; | ^~~~~~~~~~~ -- >> drivers/net/ethernet/yunsilicon/xsc/pci/main.c:136:4: warning: no previous prototype for 'xsc_devid_to_pcie_no' [-Wmissing-prototypes] 136 | u8 xsc_devid_to_pcie_no(int dev_id) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:288:5: warning: no previous prototype for 'xsc_priv_init' [-Wmissing-prototypes] 288 | int xsc_priv_init(struct xsc_core_device *dev) | ^~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:302:5: warning: no previous prototype for 'xsc_dev_res_init' [-Wmissing-prototypes] 302 | int xsc_dev_res_init(struct xsc_core_device *dev) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:321:6: warning: no previous prototype for 'xsc_dev_res_cleanup' [-Wmissing-prototypes] 321 | void xsc_dev_res_cleanup(struct xsc_core_device *dev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:327:6: warning: no previous prototype for 'xsc_init_reg_addr' [-Wmissing-prototypes] 327 | void xsc_init_reg_addr(struct xsc_core_device *dev) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:519:5: warning: no previous prototype for 'xsc_reset_function_resource' [-Wmissing-prototypes] 519 | int xsc_reset_function_resource(struct xsc_core_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:719:5: warning: no previous prototype for 'xsc_load_one' [-Wmissing-prototypes] 719 | int xsc_load_one(struct xsc_core_device *dev, bool boot) | ^~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/main.c:801:5: warning: no previous prototype for 'xsc_unload_one' [-Wmissing-prototypes] 801 | int xsc_unload_one(struct xsc_core_device *dev, bool cleanup) | ^~~~~~~~~~~~~~ -- >> drivers/net/ethernet/yunsilicon/xsc/pci/xsc_pci_ctrl.c:255:5: warning: no previous prototype for 'noop_pre' [-Wmissing-prototypes] 255 | int noop_pre(struct kprobe *p, struct pt_regs *regs) { return 0; } | ^~~~~~~~ >> drivers/net/ethernet/yunsilicon/xsc/pci/xsc_pci_ctrl.c:264:5: warning: no previous prototype for 'find_kallsyms_lookup_name' [-Wmissing-prototypes] 264 | int find_kallsyms_lookup_name(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/pci/xsc_pci_ctrl.c:310:5: warning: no previous prototype for 'xsc_pci_ctrl_exec_ioctl' [-Wmissing-prototypes] 310 | int xsc_pci_ctrl_exec_ioctl(struct xsc_core_device *xdev, void *in, int in_size, void *out, | ^~~~~~~~~~~~~~~~~~~~~~~ vim +/xsc_find_chunk_cont_0 +21 drivers/infiniband/hw/xsc/mem.c 20 > 21 int xsc_find_chunk_cont_0(struct xsc_pa_chunk *chunk, 22 int is_first, 23 int is_last) 24 { > 25 const static int max_count = sizeof(int) << 3; 26 dma_addr_t pa, end_pa; 27 u64 va, end_va; 28 size_t length; 29 int start_count, end_count; 30 int va_start_count, va_end_count; 31 32 pa = chunk->pa; 33 va = chunk->va; 34 length = chunk->length; 35 end_pa = pa + length; 36 end_va = va + length; 37 start_count = max_count; 38 end_count = max_count; 39 40 if (!is_first) { 41 start_count = xsc_count_trailing_zeros((unsigned long)pa); 42 va_start_count = xsc_count_trailing_zeros(va); 43 start_count = min_t(int, start_count, va_start_count); 44 } 45 46 if (!is_last) { 47 end_count = xsc_count_trailing_zeros((unsigned long)end_pa); 48 va_end_count = xsc_count_trailing_zeros(end_va); 49 end_count = min_t(int, end_count, va_end_count); 50 } 51 52 return start_count > end_count ? end_count : start_count; 53 } 54 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 353422df931f2987d3888e844ceea10d6e4d14d6
by kernel test robot 20 Mar '24

20 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 353422df931f2987d3888e844ceea10d6e4d14d6 !5309 drm/msm/dpu: Add mutex lock in control vblank irq Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- arm64-randconfig-001-20240319 |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized clang_recent_errors `-- x86_64-buildonly-randconfig-002-20240319 `-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dce110-dce110_opp_csc_v.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 734m configs tested: 35 configs skipped: 147 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240319 gcc arm64 randconfig-002-20240319 gcc arm64 randconfig-003-20240319 gcc arm64 randconfig-004-20240319 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240319 clang x86_64 buildonly-randconfig-002-20240319 clang x86_64 buildonly-randconfig-003-20240319 clang x86_64 buildonly-randconfig-004-20240319 clang x86_64 buildonly-randconfig-005-20240319 clang x86_64 buildonly-randconfig-006-20240319 clang x86_64 defconfig gcc x86_64 randconfig-001-20240319 clang x86_64 randconfig-002-20240319 clang x86_64 randconfig-003-20240319 clang x86_64 randconfig-004-20240319 gcc x86_64 randconfig-005-20240319 gcc x86_64 randconfig-006-20240319 gcc x86_64 randconfig-011-20240319 clang x86_64 randconfig-012-20240319 clang x86_64 randconfig-013-20240319 gcc x86_64 randconfig-014-20240319 gcc x86_64 randconfig-015-20240319 clang x86_64 randconfig-016-20240319 clang x86_64 randconfig-071-20240319 gcc x86_64 randconfig-072-20240319 clang x86_64 randconfig-073-20240319 gcc x86_64 randconfig-074-20240319 clang x86_64 randconfig-075-20240319 clang x86_64 randconfig-076-20240319 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION efcbd7d2c09d823eef22dff4bce44d8712ca50c4
by kernel test robot 19 Mar '24

19 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: efcbd7d2c09d823eef22dff4bce44d8712ca50c4 !4632 [OLK-5.10] drivers: update yunsilicon drivers to version 1.1.0.375 Error/Warning: (recently discovered and may have been fixed) mm/share_pool.c:4227:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 `-- mm-share_pool.c:error:HUGETLB_ALLOC_BUDDY-undeclared-(first-use-in-this-function) clang_recent_errors `-- x86_64-allyesconfig |-- drivers-infiniband-hw-xsc-mem.c:warning:no-previous-prototype-for-function-xsc_find_chunk_cont_0 |-- drivers-infiniband-hw-xsc-mr.c:warning:variable-using_peer_mem-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-eecd-description-in-rnpm_lower_eeprom_clk |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hash_value-description-in-rnpm_set_mta |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hw-description-in-rnpm_mta_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-pf-description-in-rnpm_set_vlan_anti_spoofing |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-count-not-described-in-rnpm_shift_in_eeprom_bits |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-eec-not-described-in-rnpm_lower_eeprom_clk |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mc_addr-not-described-in-rnpm_set_mta |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mode-not-described-in-rnpm_mta_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-vf-not-described-in-rnpm_set_vlan_anti_spoofing |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnpm_dbg_adapter_exit |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_dbg_adapter_exit |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_get_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ee-description-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-flags-description-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_set_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_info |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_rxnfc |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-pf-description-in-rnpm_get_rss_hash_opts |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_get_rss_hash_opts |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_info |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_rxnfc |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-eeprom-not-described-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_set_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_get_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-priv_flags-not-described-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-autoneg_changed-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-dma_ch-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-duplex_changed-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-v_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_layer2_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping_tcam |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-ent-description-in-rnpm_probe |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-hw-description-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-link_speed-description-in-rnpm_watchdog_update_link |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-maxrate-description-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_setup_tc |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-pb-description-in-rnpm_lpbthresh |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-queue-description-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-skb-description-in-rnpm_is_non_eop |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_rx_resources |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_tx_resources |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_setup_tc |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-id-not-described-in-rnpm_probe |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-is_rxframe-not-described-in-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnpm_clean_tx_irq |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_msix_vector-not-described-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_queue-not-described-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnpm_tx_timeout |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-clean_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-control_mac_rx |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_can_rpu_start |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_check_mc_addr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_clear_udp_tunnel_port |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_fix_queue_number |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_event_schedule |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_task |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_vlan_stags_flag |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring_temp |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-update_pf_vlan |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-wait_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-packets-is-used-uninitialized-whenever-if-condition-is-false |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-xdp_xmit-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_ack_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_msg_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_read_mbx_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_ack_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_msg_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_read_mbx_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-mbx_cookie_zalloc |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_get_capablity |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_reg_read |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_send_cmd_wait |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_get_port_stats2 |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_link_stat_mark_disable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_fw_post_req |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_pluginout_evt_en |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_write_posted_locked |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-is-uninitialized-when-used-here |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-value-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-atr_input-description-in-rnpm_atr_compute_perfect_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-stream-description-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-common-not-described-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_perfect_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-function-rnpm_reset_pipeline_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:variable-status-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-eeprom_data-description-in-rnpm_read_i2c_sff8472_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_i2c_data |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_phy_type_from_id |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-autoneg_wait_to_complete-not-described-in-rnpm_setup_phy_link_speed_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_read_i2c_byte_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_write_i2c_byte_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-device_type-not-described-in-rnpm_read_phy_reg_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-link_up-not-described-in-rnpm_check_phy_link_tnx |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-phy_id-not-described-in-rnpm_get_phy_type_from_id |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-sff8472_data-not-described-in-rnpm_read_i2c_sff8472_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-speed-not-described-in-rnpm_check_phy_link_tnx |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-function-rnpm_ptp_setup_ptp |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:variable-target-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-function-rnpm_mbx_get_pn_sn |-- drivers-net-ethernet-yunsilicon-xsc-common-xsc_core.h:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_eth_change_link_status |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_get_vf_config |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_get_linear_frag_sz |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_rx_is_linear_skb |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_select_queue |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:variable-txq_ix-is-uninitialized-when-used-here |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-buffer_size-set-but-not-used |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-curr_pfc_en-is-uninitialized-when-used-here |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_dcbnl.c:warning:variable-prio2buffer-set-but-not-used |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_devid_to_pcie_no |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-find_kallsyms_lookup_name |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_pci_ctrl.c:warning:no-previous-prototype-for-function-noop_pre |-- drivers-net-ethernet-yusur-k2-..-platform-ys_intr.c:warning:overlapping-comparisons-always-evaluate-to-false |-- drivers-net-ethernet-yusur-k2-ys_k2_tx.c:warning:variable-clean_tail_ptr-set-but-not-used |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 734m configs tested: 31 configs skipped: 148 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240319 gcc arm64 randconfig-002-20240319 clang arm64 randconfig-003-20240319 clang arm64 randconfig-004-20240319 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240319 clang x86_64 buildonly-randconfig-002-20240319 clang x86_64 buildonly-randconfig-003-20240319 clang x86_64 buildonly-randconfig-004-20240319 clang x86_64 buildonly-randconfig-005-20240319 clang x86_64 buildonly-randconfig-006-20240319 clang x86_64 defconfig gcc x86_64 randconfig-001-20240319 clang x86_64 randconfig-002-20240319 clang x86_64 randconfig-003-20240319 clang x86_64 randconfig-004-20240319 gcc x86_64 randconfig-005-20240319 gcc x86_64 randconfig-006-20240319 gcc x86_64 randconfig-011-20240319 clang x86_64 randconfig-012-20240319 clang x86_64 randconfig-013-20240319 gcc x86_64 randconfig-014-20240319 gcc x86_64 randconfig-015-20240319 clang x86_64 randconfig-016-20240319 clang x86_64 randconfig-071-20240319 gcc x86_64 randconfig-072-20240319 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 28734/30000] drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true
by kernel test robot 19 Mar '24

19 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: efcbd7d2c09d823eef22dff4bce44d8712ca50c4 commit: 23b8024ef459f8b615c223df6175ea17c6b50c48 [28734/30000] drivers: update yunsilicon drivers to version 1.1.0.375 config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240319/202403192226.xeD34VaP-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240319/202403192226.xeD34VaP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403192226.xeD34VaP-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/infiniband/hw/xsc/main.c:15: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/main.c:41:6: warning: no previous prototype for function 'xsc_get_sys_image_guid' [-Wmissing-prototypes] 41 | void xsc_get_sys_image_guid(u8 *dev_addr, u8 *guid) | ^ drivers/infiniband/hw/xsc/main.c:41:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 41 | void xsc_get_sys_image_guid(u8 *dev_addr, u8 *guid) | ^ | static drivers/infiniband/hw/xsc/main.c:68:6: warning: variable 'max_sq_sg' set but not used [-Wunused-but-set-variable] 68 | int max_sq_sg; | ^ drivers/infiniband/hw/xsc/main.c:307:5: warning: no previous prototype for function 'xsc_ib_add_gid' [-Wmissing-prototypes] 307 | int xsc_ib_add_gid(const struct ib_gid_attr *attr, void **context) | ^ drivers/infiniband/hw/xsc/main.c:307:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 307 | int xsc_ib_add_gid(const struct ib_gid_attr *attr, void **context) | ^ | static drivers/infiniband/hw/xsc/main.c:573:6: warning: no previous prototype for function 'xsc_get_guid' [-Wmissing-prototypes] 573 | void xsc_get_guid(u8 *dev_addr, u8 *guid) | ^ drivers/infiniband/hw/xsc/main.c:573:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 573 | void xsc_get_guid(u8 *dev_addr, u8 *guid) | ^ | static drivers/infiniband/hw/xsc/main.c:602:6: warning: no previous prototype for function 'xsc_core_event' [-Wmissing-prototypes] 602 | void xsc_core_event(struct xsc_core_device *xdev, enum xsc_dev_event event, | ^ drivers/infiniband/hw/xsc/main.c:602:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 602 | void xsc_core_event(struct xsc_core_device *xdev, enum xsc_dev_event event, | ^ | static drivers/infiniband/hw/xsc/main.c:773:30: warning: implicit conversion from enumeration type 'enum xsc_rdma_driver_id' to different enumeration type 'enum rdma_driver_id' [-Wenum-conversion] 773 | dev->ib_dev.ops.driver_id = RDMA_DRIVER_XSC5; | ~ ^~~~~~~~~~~~~~~~ 7 warnings generated. -- In file included from drivers/infiniband/hw/xsc/xsc_rdma_ctrl.c:11: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/xsc_rdma_ctrl.c:408:5: warning: no previous prototype for function '_rdma_ctrl_exec_ioctl' [-Wmissing-prototypes] 408 | int _rdma_ctrl_exec_ioctl(struct xsc_core_device *xdev, void *in, int in_size, void *out, | ^ drivers/infiniband/hw/xsc/xsc_rdma_ctrl.c:408:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 408 | int _rdma_ctrl_exec_ioctl(struct xsc_core_device *xdev, void *in, int in_size, void *out, | ^ | static drivers/infiniband/hw/xsc/xsc_rdma_ctrl.c:672:6: warning: no previous prototype for function 'xsc_rdma_ctrl_fini' [-Wmissing-prototypes] 672 | void xsc_rdma_ctrl_fini(void) | ^ drivers/infiniband/hw/xsc/xsc_rdma_ctrl.c:672:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 672 | void xsc_rdma_ctrl_fini(void) | ^ | static drivers/infiniband/hw/xsc/xsc_rdma_ctrl.c:677:5: warning: no previous prototype for function 'xsc_rdma_ctrl_init' [-Wmissing-prototypes] 677 | int xsc_rdma_ctrl_init(void) | ^ drivers/infiniband/hw/xsc/xsc_rdma_ctrl.c:677:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 677 | int xsc_rdma_ctrl_init(void) | ^ | static 4 warnings generated. -- In file included from drivers/infiniband/hw/xsc/cq.c:9: In file included from drivers/infiniband/hw/xsc/xsc_ib.h:15: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/cq.c:361:5: warning: no previous prototype for function 'xsc_cqe_is_empty' [-Wmissing-prototypes] 361 | int xsc_cqe_is_empty(struct xsc_ib_cq *cq) | ^ drivers/infiniband/hw/xsc/cq.c:361:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 361 | int xsc_cqe_is_empty(struct xsc_ib_cq *cq) | ^ | static 2 warnings generated. -- In file included from drivers/infiniband/hw/xsc/qp.c:9: In file included from drivers/infiniband/hw/xsc/xsc_ib.h:15: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/qp.c:264:26: warning: variable 'context' set but not used [-Wunused-but-set-variable] 264 | struct xsc_ib_ucontext *context; | ^ drivers/infiniband/hw/xsc/qp.c:346:26: warning: variable 'context' set but not used [-Wunused-but-set-variable] 346 | struct xsc_ib_ucontext *context; | ^ drivers/infiniband/hw/xsc/qp.c:1208:5: warning: no previous prototype for function 'xsc_icrc_hdr' [-Wmissing-prototypes] 1208 | u32 xsc_icrc_hdr(struct xsc_ib_dev *dev, void *pkt, u32 size, u32 *icrc) | ^ drivers/infiniband/hw/xsc/qp.c:1208:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1208 | u32 xsc_icrc_hdr(struct xsc_ib_dev *dev, void *pkt, u32 size, u32 *icrc) | ^ | static drivers/infiniband/hw/xsc/qp.c:1298:5: warning: no previous prototype for function 'build_qp1_send_v2' [-Wmissing-prototypes] 1298 | int build_qp1_send_v2(struct xsc_ib_dev *dev, | ^ drivers/infiniband/hw/xsc/qp.c:1298:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1298 | int build_qp1_send_v2(struct xsc_ib_dev *dev, | ^ | static drivers/infiniband/hw/xsc/qp.c:1786:33: warning: unused function 'to_ib_mig_state' [-Wunused-function] 1786 | static inline enum ib_mig_state to_ib_mig_state(int xsc_mig_state) | ^~~~~~~~~~~~~~~ 6 warnings generated. -- In file included from drivers/infiniband/hw/xsc/mem.c:9: In file included from drivers/infiniband/hw/xsc/xsc_ib.h:15: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ >> drivers/infiniband/hw/xsc/mem.c:21:5: warning: no previous prototype for function 'xsc_find_chunk_cont_0' [-Wmissing-prototypes] 21 | int xsc_find_chunk_cont_0(struct xsc_pa_chunk *chunk, | ^ drivers/infiniband/hw/xsc/mem.c:21:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 21 | int xsc_find_chunk_cont_0(struct xsc_pa_chunk *chunk, | ^ | static drivers/infiniband/hw/xsc/mem.c:193:6: warning: no previous prototype for function '__xsc_ib_cont_pages' [-Wmissing-prototypes] 193 | void __xsc_ib_cont_pages(struct ib_umem *umem, u64 addr, | ^ drivers/infiniband/hw/xsc/mem.c:193:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 193 | void __xsc_ib_cont_pages(struct ib_umem *umem, u64 addr, | ^ | static drivers/infiniband/hw/xsc/mem.c:259:6: warning: no previous prototype for function '__xsc_ib_populate_pas' [-Wmissing-prototypes] 259 | void __xsc_ib_populate_pas(struct xsc_ib_dev *dev, struct ib_umem *umem, | ^ drivers/infiniband/hw/xsc/mem.c:259:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 259 | void __xsc_ib_populate_pas(struct xsc_ib_dev *dev, struct ib_umem *umem, | ^ | static 4 warnings generated. -- In file included from drivers/infiniband/hw/xsc/mr.c:15: In file included from drivers/infiniband/hw/xsc/xsc_ib.h:15: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/mr.c:75:6: warning: no previous prototype for function 'xsc_fill_pas' [-Wmissing-prototypes] 75 | void xsc_fill_pas(int npages, u64 *pas, __be64 *req_pas) | ^ drivers/infiniband/hw/xsc/mr.c:75:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 75 | void xsc_fill_pas(int npages, u64 *pas, __be64 *req_pas) | ^ | static >> drivers/infiniband/hw/xsc/mr.c:160:6: warning: variable 'using_peer_mem' set but not used [-Wunused-but-set-variable] 160 | int using_peer_mem = 0; | ^ 3 warnings generated. -- In file included from drivers/infiniband/hw/xsc/ah.c:12: In file included from drivers/infiniband/hw/xsc/xsc_ib.h:15: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ 1 warning generated. -- In file included from drivers/infiniband/hw/xsc/devx.c:11: In file included from drivers/net/ethernet/yunsilicon/xsc/common/driver.h:18: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/devx.c:75:1: warning: unused variable 'xsc_ib_object_XSC_IB_OBJECT_DEVX' [-Wunused-const-variable] 75 | DECLARE_UVERBS_GLOBAL_METHODS(XSC_IB_OBJECT_DEVX, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 76 | &UVERBS_METHOD(XSC_IB_METHOD_DEVX_OTHER)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/rdma/uverbs_named_ioctl.h:67:40: note: expanded from macro 'DECLARE_UVERBS_GLOBAL_METHODS' 67 | static const struct uverbs_object_def UVERBS_OBJECT(_object_id) = { \ | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/rdma/uverbs_named_ioctl.h:19:27: note: expanded from macro 'UVERBS_OBJECT' 19 | #define UVERBS_OBJECT(id) _UVERBS_NAME(UVERBS_MODULE_NAME, _object_##id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/rdma/uverbs_named_ioctl.h:16:28: note: expanded from macro '_UVERBS_NAME' 16 | #define _UVERBS_NAME(x, y) _UVERBS_PASTE(x, y) | ^~~~~~~~~~~~~~~~~~~ include/rdma/uverbs_named_ioctl.h:15:29: note: expanded from macro '_UVERBS_PASTE' 15 | #define _UVERBS_PASTE(x, y) x ## y | ^~~~~~ <scratch space>:118:1: note: expanded from here 118 | xsc_ib_object_XSC_IB_OBJECT_DEVX | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. -- In file included from drivers/infiniband/hw/xsc/private_dev.c:11: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/private_dev.c:429:5: warning: no previous prototype for function 'xsc_priv_dev_exec_ioctl' [-Wmissing-prototypes] 429 | int xsc_priv_dev_exec_ioctl(struct xsc_core_device *xdev, void *in, int in_size, void *out, | ^ drivers/infiniband/hw/xsc/private_dev.c:429:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 429 | int xsc_priv_dev_exec_ioctl(struct xsc_core_device *xdev, void *in, int in_size, void *out, | ^ | static 2 warnings generated. -- In file included from drivers/net/ethernet/yunsilicon/xsc/net/main.c:21: >> drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h:1752:32: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 1752 | if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) | ~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/yunsilicon/xsc/net/main.c:29: In file included from drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_txrx.h:11: drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_debug.h:68:7: warning: variable 'pos' set but not used [-Wunused-but-set-variable] 68 | int pos; | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:166:5: warning: no previous prototype for function 'xsc_rx_alloc_page_cache' [-Wmissing-prototypes] 166 | int xsc_rx_alloc_page_cache(struct xsc_rq *rq, int node, u8 log_init_sz) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:166:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 166 | int xsc_rx_alloc_page_cache(struct xsc_rq *rq, int node, u8 log_init_sz) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:179:6: warning: no previous prototype for function 'xsc_rx_free_page_cache' [-Wmissing-prototypes] 179 | void xsc_rx_free_page_cache(struct xsc_rq *rq) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:179:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 179 | void xsc_rx_free_page_cache(struct xsc_rq *rq) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:197:6: warning: no previous prototype for function 'xsc_eth_cq_error_event' [-Wmissing-prototypes] 197 | void xsc_eth_cq_error_event(struct xsc_core_cq *xcq, enum xsc_event event) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:197:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 197 | void xsc_eth_cq_error_event(struct xsc_core_cq *xcq, enum xsc_event event) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:211:6: warning: no previous prototype for function 'xsc_eth_completion_event' [-Wmissing-prototypes] 211 | void xsc_eth_completion_event(struct xsc_core_cq *xcq) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:211:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 211 | void xsc_eth_completion_event(struct xsc_core_cq *xcq) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:260:5: warning: no previous prototype for function 'xsc_eth_create_cq' [-Wmissing-prototypes] 260 | int xsc_eth_create_cq(struct xsc_core_device *xdev, struct xsc_core_cq *xcq, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:260:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 260 | int xsc_eth_create_cq(struct xsc_core_device *xdev, struct xsc_core_cq *xcq, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:295:5: warning: no previous prototype for function 'xsc_eth_destroy_cq' [-Wmissing-prototypes] 295 | int xsc_eth_destroy_cq(struct xsc_core_device *xdev, struct xsc_cq *cq) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:295:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 295 | int xsc_eth_destroy_cq(struct xsc_core_device *xdev, struct xsc_cq *cq) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:333:6: warning: no previous prototype for function 'xsc_eth_free_cq' [-Wmissing-prototypes] 333 | void xsc_eth_free_cq(struct xsc_cq *cq) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:333:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 333 | void xsc_eth_free_cq(struct xsc_cq *cq) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:338:5: warning: no previous prototype for function 'xsc_eth_create_rss_qp_rqs' [-Wmissing-prototypes] 338 | int xsc_eth_create_rss_qp_rqs(struct xsc_core_device *xdev, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:338:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 338 | int xsc_eth_create_rss_qp_rqs(struct xsc_core_device *xdev, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:359:6: warning: no previous prototype for function 'xsc_eth_qp_event' [-Wmissing-prototypes] 359 | void xsc_eth_qp_event(struct xsc_core_qp *qp, int type) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:359:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 359 | void xsc_eth_qp_event(struct xsc_core_qp *qp, int type) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:389:5: warning: no previous prototype for function 'xsc_eth_create_qp_rq' [-Wmissing-prototypes] 389 | int xsc_eth_create_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:389:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 389 | int xsc_eth_create_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:416:5: warning: no previous prototype for function 'xsc_eth_destroy_qp_rq' [-Wmissing-prototypes] 416 | int xsc_eth_destroy_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:416:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 416 | int xsc_eth_destroy_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:469:5: warning: no previous prototype for function 'xsc_eth_create_qp_sq' [-Wmissing-prototypes] 469 | int xsc_eth_create_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:469:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 469 | int xsc_eth_create_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:488:5: warning: no previous prototype for function 'xsc_eth_modify_qp_sq' [-Wmissing-prototypes] 488 | int xsc_eth_modify_qp_sq(struct xsc_core_device *xdev, struct xsc_modify_raw_qp_mbox_in *in) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:488:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 488 | int xsc_eth_modify_qp_sq(struct xsc_core_device *xdev, struct xsc_modify_raw_qp_mbox_in *in) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:506:5: warning: no previous prototype for function 'xsc_eth_destroy_qp_sq' [-Wmissing-prototypes] 506 | int xsc_eth_destroy_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:506:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 506 | int xsc_eth_destroy_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:750:5: warning: no previous prototype for function 'xsc_eth_set_hw_mtu' [-Wmissing-prototypes] 750 | int xsc_eth_set_hw_mtu(struct xsc_core_device *dev, u16 mtu, u16 rx_buf_sz) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:750:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 750 | int xsc_eth_set_hw_mtu(struct xsc_core_device *dev, u16 mtu, u16 rx_buf_sz) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:775:5: warning: no previous prototype for function 'xsc_eth_get_mac' [-Wmissing-prototypes] 775 | int xsc_eth_get_mac(struct xsc_core_device *dev, char *mac) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | int xsc_eth_get_mac(struct xsc_core_device *dev, char *mac) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:806:5: warning: no previous prototype for function 'xsc_eth_modify_qps_channel' [-Wmissing-prototypes] 806 | int xsc_eth_modify_qps_channel(struct xsc_adapter *adapter, struct xsc_channel *c) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | int xsc_eth_modify_qps_channel(struct xsc_adapter *adapter, struct xsc_channel *c) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:828:5: warning: no previous prototype for function 'xsc_eth_modify_qps' [-Wmissing-prototypes] 828 | int xsc_eth_modify_qps(struct xsc_adapter *adapter, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:828:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 828 | int xsc_eth_modify_qps(struct xsc_adapter *adapter, | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:845:5: warning: no previous prototype for function 'xsc_rx_get_linear_frag_sz' [-Wmissing-prototypes] 845 | u32 xsc_rx_get_linear_frag_sz(u32 mtu) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:845:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 845 | u32 xsc_rx_get_linear_frag_sz(u32 mtu) | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:852:6: warning: no previous prototype for function 'xsc_rx_is_linear_skb' [-Wmissing-prototypes] 852 | bool xsc_rx_is_linear_skb(u32 mtu) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:852:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 852 | bool xsc_rx_is_linear_skb(u32 mtu) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1316:5: warning: no previous prototype for function 'xsc_eth_open_channel' [-Wmissing-prototypes] 1316 | int xsc_eth_open_channel(struct xsc_adapter *adapter, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1316:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1316 | int xsc_eth_open_channel(struct xsc_adapter *adapter, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1527:5: warning: no previous prototype for function 'xsc_eth_open_channels' [-Wmissing-prototypes] 1527 | int xsc_eth_open_channels(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1527:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1527 | int xsc_eth_open_channels(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1639:6: warning: no previous prototype for function 'xsc_eth_activate_channel' [-Wmissing-prototypes] 1639 | void xsc_eth_activate_channel(struct xsc_channel *c) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1639:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1639 | void xsc_eth_activate_channel(struct xsc_channel *c) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1645:6: warning: no previous prototype for function 'xsc_eth_deactivate_channel' [-Wmissing-prototypes] 1645 | void xsc_eth_deactivate_channel(struct xsc_channel *c) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1645:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1645 | void xsc_eth_deactivate_channel(struct xsc_channel *c) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1691:6: warning: no previous prototype for function 'xsc_eth_activate_priv_channels' [-Wmissing-prototypes] 1691 | void xsc_eth_activate_priv_channels(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1691:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1691 | void xsc_eth_activate_priv_channels(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1706:6: warning: no previous prototype for function 'xsc_eth_deactivate_priv_channels' [-Wmissing-prototypes] 1706 | void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1706:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1706 | void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:1849:5: warning: no previous prototype for function 'xsc_eth_change_link_status' [-Wmissing-prototypes] 1849 | int xsc_eth_change_link_status(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1849:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1849 | int xsc_eth_change_link_status(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1906:6: warning: no previous prototype for function 'xsc_eth_event_handler' [-Wmissing-prototypes] 1906 | void xsc_eth_event_handler(void *arg) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1906:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1906 | void xsc_eth_event_handler(void *arg) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1914:5: warning: no previous prototype for function 'xsc_eth_enable_nic_hca' [-Wmissing-prototypes] 1914 | int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1914:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1914 | int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1976:5: warning: no previous prototype for function 'xsc_eth_disable_nic_hca' [-Wmissing-prototypes] 1976 | int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1976:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1976 | int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2009:6: warning: no previous prototype for function 'xsc_eth_rss_params_change' [-Wmissing-prototypes] 2009 | void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2009:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2009 | void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2319:6: warning: no previous prototype for function 'xsc_build_default_indir_rqt' [-Wmissing-prototypes] 2319 | void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2319:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2319 | void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2417:5: warning: no previous prototype for function 'xsc_eth_nic_mtu_changed' [-Wmissing-prototypes] 2417 | int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2417:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2417 | int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2480:5: warning: no previous prototype for function 'xsc_set_vf_mac' [-Wmissing-prototypes] 2480 | int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2480:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2480 | int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2497:5: warning: no previous prototype for function 'xsc_get_vf_config' [-Wmissing-prototypes] 2497 | int xsc_get_vf_config(struct net_device *dev, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2497:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2497 | int xsc_get_vf_config(struct net_device *dev, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2513:5: warning: no previous prototype for function 'set_feature_rxcsum' [-Wmissing-prototypes] 2513 | int set_feature_rxcsum(struct net_device *netdev, bool enable) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2513:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2513 | int set_feature_rxcsum(struct net_device *netdev, bool enable) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2565:5: warning: no previous prototype for function 'xsc_eth_set_features' [-Wmissing-prototypes] 2565 | int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2565:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2565 | int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2582:5: warning: no previous prototype for function 'xsc_select_queue' [-Wmissing-prototypes] 2582 | u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2582:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2582 | u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2591:10: warning: variable 'txq_ix' is uninitialized when used here [-Wuninitialized] 2591 | return txq_ix; | ^~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2585:12: note: initialize the variable 'txq_ix' to silence this warning 2585 | int txq_ix, up = 0; | ^ | = 0 drivers/net/ethernet/yunsilicon/xsc/net/main.c:2771:24: warning: no previous prototype for function 'xsc_tirc_get_default_config' [-Wmissing-prototypes] 2771 | struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2771:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2771 | struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2776:6: warning: no previous prototype for function 'xsc_build_rss_params' [-Wmissing-prototypes] 2776 | void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2776:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2776 | void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2794:6: warning: no previous prototype for function 'xsc_eth_build_nic_params' [-Wmissing-prototypes] 2794 | void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2794:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2794 | void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2816:6: warning: no previous prototype for function 'xsc_eth_build_nic_netdev' [-Wmissing-prototypes] 2816 | void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2816:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2816 | void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2887:5: warning: no previous prototype for function 'xsc_eth_create_xdev_resources' [-Wmissing-prototypes] 2887 | int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2887:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2887 | int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2908:5: warning: no previous prototype for function 'xsc_eth_init_nic_rx' [-Wmissing-prototypes] 2908 | int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2908:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2908 | int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) | ^ | static 47 warnings generated. .. vim +1752 drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h 1745 1746 static inline bool 1747 is_support_rdma(struct xsc_core_device *dev) 1748 { 1749 if (!dev) 1750 return false; 1751 > 1752 if (dev->caps.hw_feature_flag | XSC_HW_RDMA_SUPPORT) 1753 return true; 1754 1755 return false; 1756 } 1757 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] media: pvrusb2: fix use after free on context disconnection
by Guan Jing 19 Mar '24

19 Mar '24

From: "Ricardo B. Marliere" <ricardo(a)marliere.net> stable inclusion from stable-v5.10.209 commit 3233d8bf7893550045682192cb227af7fa3defeb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VV CVE: CVE-2023-52445 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ] Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack. Reported-and-tested-by: syzbot+621409285c4156a009b3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/ Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Ricardo B. Marliere <ricardo(a)marliere.net> Acked-by: Mike Isely <isely(a)pobox.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c index 14170a5d72b3..1764674de98b 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-context.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c @@ -268,7 +268,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp) { pvr2_hdw_disconnect(mp->hdw); mp->disconnect_flag = !0; - pvr2_context_notify(mp); + if (!pvr2_context_shutok()) + pvr2_context_notify(mp); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 v2 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 302 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 313 insertions(+), 308 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS-SP1 v2 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 300 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 307 insertions(+), 306 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS v2 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 300 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 10 files changed, 307 insertions(+), 302 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10 v2 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 302 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 313 insertions(+), 308 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS] btrfs: abort in rename_exchange if we fail to insert the second ref
by Long Li 19 Mar '24

19 Mar '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.42 commit 0df50d47d17401f9f140dfbe752a65e5d72f9932 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9909R CVE: CVE-2021-47113 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit dc09ef3562726cd520c8338c1640872a60187af5 upstream. Error injection stress uncovered a problem where we'd leave a dangling inode ref if we failed during a rename_exchange. This happens because we insert the inode ref for one side of the rename, and then for the other side. If this second inode ref insert fails we'll leave the first one dangling and leave a corrupt file system behind. Fix this by aborting if we did the insert for the first inode ref. CC: stable(a)vger.kernel.org # 4.9+ Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 52da573741ed..51a119ac91cd 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -9527,6 +9527,7 @@ static int btrfs_rename_exchange(struct inode *old_dir, int ret; bool root_log_pinned = false; bool dest_log_pinned = false; + bool need_abort = false; struct btrfs_log_ctx ctx_root; struct btrfs_log_ctx ctx_dest; bool sync_log_root = false; @@ -9591,6 +9592,7 @@ static int btrfs_rename_exchange(struct inode *old_dir, old_idx); if (ret) goto out_fail; + need_abort = true; } /* And now for the dest. */ @@ -9606,8 +9608,11 @@ static int btrfs_rename_exchange(struct inode *old_dir, new_ino, btrfs_ino(BTRFS_I(old_dir)), new_idx); - if (ret) + if (ret) { + if (need_abort) + btrfs_abort_transaction(trans, ret); goto out_fail; + } } /* Update inode version and ctime/mtime. */ -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] iommu/arm-smmu-v3: Disable ECMDQ before reset
by Wang Wensheng 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97CSY -------------------------------- In kdump kernel, the ECMDQ is enabled before and cannot be reset before it is disabled. This leads to "CMD_SYNC timeout" problem. Disable the ECMDQ before reset the ECMDQ to fix. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 3f6d25bf0587..fc49bf33b596 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -4606,6 +4606,19 @@ static int arm_smmu_device_reset(struct arm_smmu_device *smmu, bool resume) ecmdq = *per_cpu_ptr(smmu->ecmdq, i); q = &ecmdq->cmdq.q; + reg = readl(q->prod_reg); + if (reg & ECMDQ_PROD_EN) { + /* disable ecmdq */ + writel(reg & ~ECMDQ_PROD_EN, q->prod_reg); + ret = readl_relaxed_poll_timeout(q->cons_reg, reg, + !(reg & ECMDQ_CONS_ENACK), 1, ARM_SMMU_POLL_TIMEOUT_US); + if (ret) { + dev_warn(smmu->dev, "ecmdq[%d] disable failed\n", i); + smmu->ecmdq_enabled = 0; + break; + } + } + if (WARN_ON(q->llq.prod != q->llq.cons)) { q->llq.prod = 0; q->llq.cons = 0; -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/4] CVE-2021-47121 and CVE-2021-47122
by Liu Jian 19 Mar '24

19 Mar '24

CVE-2021-47121 and CVE-2021-47122 Pavel Skripkin (4): net: caif: added cfserl_release function net: caif: add proper error handling net: caif: fix memory leak in cfusbl_device_notify net: caif: fix memory leak in caif_device_notify include/net/caif/caif_dev.h | 2 +- include/net/caif/cfcnfg.h | 2 +- include/net/caif/cfserl.h | 1 + net/caif/caif_dev.c | 13 +++++++++---- net/caif/caif_usb.c | 14 +++++++++++++- net/caif/cfcnfg.c | 16 +++++++++++----- net/caif/cfserl.c | 5 +++++ 7 files changed, 41 insertions(+), 12 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS v5 0/6] CVE-2023-52595
by Pu Lehui 19 Mar '24

19 Mar '24

Pu Lehui (1): rt2x00: Fix kabi breakage in struct rt2x00lib_ops Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800soc.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800usb.c | 5 ++ drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 30 ++++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 94 insertions(+), 17 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-1.0-LTS] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Yi Yang 19 Mar '24

19 Mar '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v4.19.307 commit eafd83b92f6c044007a3591cbd476bcf90455990 category: bugfix bugzilla: 189694 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 0ef7cb0448e8..e33b71659215 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -23,10 +23,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -58,7 +61,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -201,6 +204,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -228,34 +232,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -266,6 +273,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.25.1

2 1

[PATCH OLK-6.6 000/470] Backport 6.6.9~6.6.13 LTS patches
by Peng Zhang 19 Mar '24

19 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport linux-6.6.9 linux-6.6.13 LTS patches from upstream. git cherry-pick v6.6.8..v6.6.9~1 -s git cherry-pick v6.6.9..v6.6.10~1 -s git cherry-pick v6.6.10..v6.6.11~1 -s git cherry-pick v6.6.11..v6.6.12~1 -s git cherry-pick v6.6.12..v6.6.13~1 -s There are only 1 simple context conflicts: block: warn once for each partition in bio_check_ro() Build and boot test passed for arm64 & x86. Aabish Malik (1): ALSA: hda/realtek: enable SND_PCI_QUIRK for hp pavilion 14-ec1xxx series Adrian Cinal (1): net: bcmgenet: Fix FCS generation for fragmented skbuffs Alex Bee (1): clk: rockchip: rk3128: Fix SCLK_SDMMC's clock name Alex Deucher (3): drm/amd/display: Increase frame warning limit with KASAN or KCSAN in dml drm/amdgpu: skip gpu_info fw loading on navi12 drm/amd/display: add nv12 bounding box Alex Lu (1): Bluetooth: Add more enc key size check Alex Williamson (1): vfio/mtty: Overhaul mtty interrupt handling Alexander Atanasov (1): scsi: core: Always send batch on reset or error handling command Alexis Lothoré (1): pinctrl: at91-pio4: use dedicated lock class for IRQ Alison Schofield (3): cxl/core: Always hold region_rwsem while reading poison lists kernel/resource: Increment by align value in get_free_mem_region() cxl/memdev: Hold region_rwsem during inject and clear poison ops Alper Ak (1): USB: serial: option: add Quectel EG912Y module support Alvin Lee (1): drm/amd/display: Increase num voltage states to 40 Andrew Davis (2): ARM: dts: dra7: Fix DRA7 L3 NoC node register size phy: ti: gmii-sel: Fix register offset when parent is not a syscon node Andrii Staikov (1): i40e: Restore VF MSI-X state during PCI reset Andy Chi (1): ALSA: hda/realtek: fix mute/micmute LEDs for a HP ZBook Andy Gospodarek (1): bnxt_en: do not map packet buffers twice Armin Wolf (1): hwmon: (corsair-psu) Fix probe when built-in Arnd Bergmann (4): Bluetooth: hci_event: shut up a false-positive warning x86/xen: add CPU dependencies for 32-bit build kexec: fix KEXEC_FILE dependencies kexec: select CRYPTO from KEXEC_FILE instead of depending on it Avraham Stern (1): wifi: iwlwifi: pcie: avoid a NULL pointer dereference Baokun Li (1): mm/filemap: avoid buffered read/write race to read inconsistent data Ben Greear (1): wifi: mac80211: handle 320 MHz in ieee80211_ht_cap_ie_to_sta_ht_cap Benjamin Bara (1): i2c: core: Fix atomic xfer check for non-preempt config Benjamin Bigler (1): spi: spi-imx: correctly configure burst length when using dma Bitao Hu (1): nvme: fix deadlock between reset and scan Bjorn Helgaas (1): Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()" Boris Burkov (1): btrfs: free qgroup pertrans reserve on transaction abort Brad Cowie (1): netfilter: nf_nat: fix action not being set for all ct states Bryan O'Donoghue (3): media: qcom: camss: Fix V4L2 async notifier error path media: qcom: camss: Fix genpd cleanup media: qcom: camss: Comment CSID dt_id field Cameron Williams (2): parport: parport_serial: Add Brainboxes BAR details parport: parport_serial: Add Brainboxes device IDs and geometry Can Guo (1): scsi: ufs: core: Let the sq_lock protect sq_tail_slot access Carlos Llamas (5): binder: use EPOLLERR from eventpoll.h binder: fix use-after-free in shinker's callback binder: fix trivial typo of binder_free_buf_locked() binder: fix comment on binder_alloc_new_buf() return value scripts/decode_stacktrace.sh: optionally use LLVM utilities Carolina Jubran (1): net/mlx5e: XDP, Drop fragmented packets larger than MTU size ChanWoo Lee (1): scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() Chancel Liu (1): ASoC: fsl_rpmsg: Fix error handler with pm_runtime_enable Chao Song (1): soundwire: intel_ace2x: fix AC timing setting for ACE2.x Charan Teja Kalla (1): mm: migrate high-order folios in swap cache correctly Charlene Liu (1): drm/amd/display: get dprefclk ss info from integration info table Charles Keepax (2): pinctrl: lochnagar: Don't build on MIPS ASoC: wm8974: Correct boost mixer inputs Chen Ni (1): asix: Add check for usbnet_get_endpoints Chen-Yu Tsai (1): wifi: cfg80211: Add my certificate Cheng-Han Wu (1): ksmbd: Remove unused field in ksmbd_user struct Chester Lin (1): pinctrl: s32cc: Avoid possible string truncation Chris Mi (1): net/mlx5e: Decrease num_block_tc when unblock tc offload Chris Morgan (1): clk: rockchip: rk3568: Add PLL rate for 292.5MHz Christoffer Sandberg (1): Input: soc_button_array - add mapping for airplane mode button Christoph Hellwig (1): block: renumber QUEUE_FLAG_HW_WC Chuck Lever (1): SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 Chukun Pan (1): arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 Claudio Imbrenda (1): KVM: s390: vsie: fix wrong VIR 37 when MSO is used Claudiu Beznea (1): net: ravb: Wait for operating mode to be applied Clément Villeret (1): ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA Dan Carpenter (4): net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() net/mlx5e: Fix error codes in alloc_branch_attr() usb: fotg210-hcd: delete an incorrect bounds test ACPI: thermal: Fix acpi_thermal_unregister_thermal_zone() cleanup Dan Williams (1): driver core: Add a guard() definition for the device_lock() Daniel Golle (1): net: phy: skip LED triggers on PHYs on SFP modules Dave Airlie (1): nouveau/tu102: flush all pdbs on vmm flush Dave Ertman (1): ice: alter feature support check for SRIOV and LAG Dave Jiang (3): cxl: Add cxl_decoders_committed() helper cxl: Add cxl_num_decoders_committed() usage to cxl_test cxl/hdm: Fix a benign lockdep splat David Ahern (1): net/ipv6: Revert remove expired routes with a separated list of routes David E. Box (3): platform/x86/intel/pmc: Add suspend callback platform/x86/intel/pmc: Allow reenabling LTRs platform/x86/intel/pmc: Move GBE LTR ignore to suspend callback David Howells (5): afs: Fix the dynamic root's d_delete to always delete unused dentries afs: Fix dynamic root lookup DNS check keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry afs: Fix overwriting of result of DNS query afs: Fix use-after-free due to get/remove race in volume tree David Lechner (1): iio: triggered-buffer: prevent possible freeing of wrong buffer David Lin (1): ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 David Rau (1): ASoC: da7219: Support low DC impedance headset David Thompson (1): mlxbf_gige: fix receive packet race condition Denys Zagorui (1): bpftool: Fix -Wcast-qual warning Dinghao Liu (2): net/mlx5e: fix a potential double-free in fs_udp_create_groups net/qla3xxx: fix potential memleak in ql_alloc_buffer_queues Dmitry Antipov (1): smb: client, common: fix fortify warnings Dmytro Laktyushkin (1): drm/amd/display: update dcn315 lpddr pstate latency Douglas Anderson (3): drm/bridge: parade-ps8640: Never store more than msg->size bytes in AUX xfer drm/bridge: ti-sn65dsi86: Never store more than msg->size bytes in AUX xfer drm/bridge: ps8640: Fix size mismatch warning w/ len Edward Adam Davis (3): wifi: mac80211: check if the existing link config remains unchanged keys, dns: Fix missing size check of V1 server-list header mptcp: fix uninit-value in mptcp_incoming_options Eric Biggers (1): crypto: xts - use 'spawn' for underlying single-block cipher Eric Dumazet (7): net: sched: ife: fix potential use-after-free net/rose: fix races in rose_kill_by_device() net: check dev->gso_max_size in gso_features_check() virtio_net: avoid data-races on dev->stats fields tcp: derive delack_max from rto_min net: prevent mss overflow in skb_segment() net: constify sk_dst_get() and __sk_dst_get() argument Esther Shimanovich (1): Input: i8042 - add nomux quirk for Acer P459-G2-M Eugen Hristev (1): ASoC: mediatek: mt8186: fix AUD_PAD_TOP register and offset Fabio Estevam (1): dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Fedor Pchelkin (2): net: 9p: avoid freeing uninit memory in p9pdu_vreadf ksmbd: free ppace array on error in parse_dacl Felix Fietkau (1): wifi: mt76: fix crash with WED rx support enabled Finley Xiao (1): clk: rockchip: rk3128: Fix aclk_peri_src's parent Florian Eckert (1): leds: ledtrig-tty: Free allocated ttyname buffer on deactivate Frederic Weisbecker (3): rcu: Introduce rcu_cpu_online() rcu/tasks: Handle new PF_IDLE semantics rcu/tasks-trace: Handle new PF_IDLE semantics Frédéric Danis (1): Bluetooth: L2CAP: Send reject on command corrupted request Geert Uytterhoeven (2): reset: Fix crash when freeing non-existent optional resets mmc: core: Cancel delayed work before releasing host Geliang Tang (1): selftests: mptcp: join: fix subflow_send_ack lookup George Stark (1): iio: adc: meson: add separate config for axg SoC family Gergo Koteles (5): ALSA: hda/tas2781: select program 0, conf 0 by default ASoC: tas2781: check the validity of prm_no/cfg_no ALSA: hda/tas2781: do not use regcache ALSA: hda/tas2781: move set_drv_data outside tasdevice_init ALSA: hda/tas2781: remove sound controls in unbind Ghanshyam Agrawal (1): kselftest: alsa: fixed a print formatting warning Guanghui Feng (1): uio: Fix use-after-free in uio_open Guanjun (1): dmaengine: idxd: Protect int_handle field in hw descriptor Guilherme G. Piccoli (1): HID: nintendo: Prevent divide-by-zero on code Haibo Chen (1): iio: adc: imx93: add four channels for imx93 adc Hamza Mahfooz (1): drm/amd/display: fix hw rotated modes when PSR-SU is enabled Hangbin Liu (1): selftests: bonding: do not set port down when adding to bond Hangyu Hua (1): net: sched: em_text: fix possible memory leak in em_text_destroy() Hans de Goede (5): platform/x86: intel-vbtn: Fix missing tablet-mode-switch events Input: atkbd - skip ATKBD_CMD_GETID in translated mode ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 ASoC: Intel: bytcr_rt5640: Add new swapped-speakers quirk ACPI: resource: Add another DMI match for the TongFang GMxXGxx Haoran Liu (1): Input: ipaq-micro-keys - add error handling for devm_kmemdup Haren Myneni (1): powerpc/pseries/vas: Migration suspend waits for no in-progress open windows Hawking Zhang (1): drm/amdgpu: Do not issue gpu reset from nbio v7_9 bif interrupt Heiko Carstens (1): s390/vx: fix save/restore of fpu kernel context Heiko Stuebner (1): arm64: dts: rockchip: fix rk356x pcie msg interrupt name Helge Deller (2): linux/export: Fix alignment for 64-bit ksymtab entries linux/export: Ensure natural alignment of kcrctab array Hengqi Chen (1): LoongArch: Preserve syscall nr across execve() Herve Codina (1): lib/vsprintf: Fix %pfwf when current node refcount == 0 Hyunwoo Kim (1): Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg Ian Rogers (1): bpftool: Align output skeleton ELF code Imre Deak (1): drm/i915/mtl: Fix HDMI/DP PLL clock selection Inki Dae (1): drm/exynos: fix a wrong error checking Ira Weiny (1): cxl/pmu: Ensure put_device on pmu devices Ivan Lipski (1): drm/amd/display: Add monitor patch for specific eDP Ivan Orlov (1): ALSA: pcmtest: stop timer before buffer is released JP Kobryn (1): 9p: prevent read overrun in protocol dump tracepoint Jacob Keller (1): ice: stop trashing VF VSI aggregator node ID information Jai Luthra (1): dmaengine: ti: k3-psil-am62a: Fix SPI PDMA data James Clark (1): coresight: etm4x: Fix width of CCITMIN field Jani Nikula (2): drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select drm/crtc: fix uninitialized variable use Javier Carrasco (2): iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table iio: tmag5273: fix temperature offset Jeff Layton (3): fs: new accessor methods for atime and mtime client: convert to new timestamp accessors nfsd: drop the nfsd_put helper Jeffrey Hugo (1): accel/qaic: Implement quirk for SOC_HW_VERSION Jens Axboe (1): io_uring: use fget/fput consistently Jensen Huang (1): i2c: rk3x: fix potential spinlock recursion on poll Jeremie Knuesel (1): ALSA: usb-audio: Increase delay in MOTU M quirk Jeremy Soller (1): ASoC: amd: yc: Add DMI entry to support System76 Pangolin 13 Jerome Brunet (1): ASoC: hdmi-codec: fix missing report for jack initial status Jiajun Xie (1): mm: fix unmap_mapping_range high bits shift bug Jianbo Liu (1): net/mlx5e: Fix overrun reported by coverity Jinghao Jia (1): x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect Jinyang He (1): LoongArch: Set unwind stack type to unknown rather than set error flag Jiri Olsa (1): bpf: Fix prog_array_map_poke_run map poke update Jisheng Zhang (1): riscv: don't probe unaligned access speed if already done Jocelyn Falempe (1): drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV, G200SE Johan Hovold (1): usb: typec: ucsi: fix gpio-based orientation detection Johannes Berg (11): wifi: ieee80211: don't require protected vendor action frames wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock wifi: mac80211: don't re-add debugfs during reconfig wifi: mac80211: check defragmentation succeeded wifi: mac80211: mesh: check element parsing succeeded wifi: mac80211: mesh_plink: fix matches_local logic wifi: cfg80211: fix certs build to not depend on file order wifi: cfg80211: fix CQM for non-range use wifi: iwlwifi: pcie: don't synchronize IRQs from IRQ wifi: cfg80211: lock wiphy mutex for rfkill poll debugfs: fix automount d_fsdata usage John Fastabend (1): bpf: syzkaller found null ptr deref in unix_bpf proto add John Johansen (1): apparmor: Fix move_mount mediation by detecting if source is detached Jorge Ramirez-Ortiz (1): mmc: rpmb: fixes pause retune on all RPMB partitions. Jose Ignacio Tornos Martinez (1): net: usb: ax88179_178a: avoid failed operations when device is disconnected Joshua Ashton (1): drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR José Pekkarinen (1): Input: psmouse - enable Synaptics InterTouch for ThinkPad L14 G1 Judy Hsiao (1): neighbour: Don't let neigh_forced_gc() disable preemption for long Jörn-Thorben Hinz (1): net: Implement missing getsockopt(SO_TIMESTAMPING_NEW) Kai-Heng Feng (1): r8169: Fix PCI error on system resume Kamil Duljas (3): ASoC: Intel: Skylake: Fix mem leak in few functions ASoC: SOF: topology: Fix mem leak in sof_dai_load() ASoC: Intel: Skylake: mem leak in skl register function Kangjing Huang (1): ksmbd: fix missing RDMA-capable flag for IPoIB device in ksmbd_rdma_capable_netdev() Karthik Poosa (1): drm/i915/hwmon: Fix static analysis tool reported issues Katarzyna Wieczerzycka (1): ice: Fix link_down_on_close message Ke Xiao (1): i40e: fix use-after-free in i40e_aqc_add_filters() Keith Busch (5): Revert "nvme-fc: fix race between error recovery and creating association" nvme-core: check for too small lba shift nvme: introduce helper function to get ctrl state nvme: ensure reset state check ordering nvme-ioctl: move capable() admin check to the end Kent Gibson (1): gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() Khaled Almahallawy (1): drm/i915/dp: Fix passing the correct DPCD_REV for drm_dp_set_phy_test_pattern Konrad Dybcio (1): interconnect: qcom: sm8250: Enable sync_state Krzysztof Kozlowski (3): stmmac: dwmac-loongson: drop useless check for compatible fallback MIPS: dts: loongson: drop incorrect dwmac fallback compatible reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Kunwu Chan (1): ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init Kurt Kanzenbach (3): igc: Report VLAN EtherType matching back to user igc: Check VLAN TCI mask igc: Check VLAN EtherType mask Lai Peter Jun Ann (1): net: stmmac: fix incorrect flag check in timestamp interrupt Larysa Zaremba (1): ice: Fix PF with enabled XDP going no-carrier after reset LeoLiuoc (1): PCI: Add ACS quirk for more Zhaoxin Root Ports Lewis Huang (1): drm/amd/display: Pass pwrseq inst for backlight and ABM Lijo Lazar (2): drm/amdgpu: Use another offset for GC 9.4.3 remap drm/amdgpu: Add NULL checks for function pointers Lingkai Dong (1): drm: Fix FD ownership check in drm_master_check_perm() Linus Torvalds (2): posix-timers: Get rid of [COMPAT_]SYS_NI() uses x86/csum: clean up `csum_partial' further Liu Jian (1): net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() Lorenzo Bianconi (1): net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() Louis Chauvet (1): spi: atmel: Fix clock issue when using devices with different polarities Lu Yao (1): drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer Luca Weiss (1): Input: xpad - add Razer Wolverine V2 support Luiz Augusto von Dentz (3): Bluetooth: Fix not notifying when connection encryption changes Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Léo Lam (1): wifi: nl80211: fix deadlock in nl80211_set_cqm_rssi (6.6.x) Maciej Strozek (2): ASoC: cs43130: Fix the position of const qualifier ASoC: cs43130: Fix incorrect frame delay configuration Marc Dionne (1): net: Save and restore msg_namelen in sock_sendmsg Marc Zyngier (3): KVM: arm64: vgic: Simplify kvm_vgic_destroy() KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy Marek Vasut (1): clk: si521xx: Increase stack based print buffer size in probe Mario Limonciello (5): pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend platform/x86/amd/pmc: Move platform defines to header platform/x86/amd/pmc: Only run IRQ1 firmware version check on Cezanne platform/x86/amd/pmc: Move keyboard wakeup disablement detection to pmc-quirks platform/x86/amd/pmc: Disable keyboard wakeup on AMD Framework 13 Mark Brown (4): ASoC: meson: g12a-toacodec: Validate written enum values ASoC: meson: g12a-tohdmitx: Validate written enum values ASoC: meson: g12a-toacodec: Fix event generation ASoC: meson: g12a-tohdmitx: Fix event generation for S/PDIF mux Mark Glover (1): USB: serial: ftdi_sio: update Actisense PIDs constant names Martin K. Petersen (1): Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" Mathieu Desnoyers (1): ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() Matthew Wilcox (Oracle) (5): mm/memory-failure: cast index to loff_t before shifting it mm/memory-failure: check the mapcount of the precise page mm: convert DAX lock/unlock page to lock/unlock folio mm/memory-failure: pass the folio and the page to collect_procs() ida: Fix crash in ida_free when the bitmap is empty Matti Vaittinen (1): iio: kx022a: Fix acceleration value scaling Matus Malych (1): ASoC: amd: yc: Add HP 255 G10 into quirk table Maurizio Lombardi (2): nvme-pci: fix sleeping function called from interrupt context nvme-core: fix a memory leak in nvme_ns_info_from_identify() Maxime Ripard (1): kunit: Warn if tests are slow Michael Chan (1): bnxt_en: Remove mis-applied code from bnxt_cfg_ntp_filters() Michael Walle (1): phy: mediatek: mipi: mt8183: fix minimal supported frequency Michael-CY Lee (1): wifi: avoid offset calculation on NULL pointer Michal Schmidt (1): ice: fix theoretical out-of-bounds access in ethtool link modes Michal Wajdeczko (1): kunit: Reset suite counter right before running tests Mike Snitzer (1): dm audit: fix Kconfig so DM_AUDIT depends on BLK_DEV_DM Mike Tipton (1): interconnect: Treat xlate() returning NULL node as an error Mikulas Patocka (1): dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() Ming Lei (1): blk-mq: don't count completed flush data request as inflight in case of quiesce Miquel Raynal (2): spi: atmel: Do not cancel a transfer upon any signal spi: atmel: Prevent spi transfers from being killed Moshe Shemesh (2): net/mlx5: Fix fw tracer first block check RDMA/mlx5: Fix mkey cache WQ flush Muhammad Usama Anjum (1): selftests: secretmem: floor the memory size to the multiple of page_size Mukul Joshi (1): drm/amdkfd: Use common function for IP version check Nam Cao (3): pinctrl: starfive: jh7110: ignore disabled device tree nodes pinctrl: starfive: jh7100: ignore disabled device tree nodes spi: cadence: revert "Add SPI transfer delays" Namjae Jeon (17): ksmbd: reorganize ksmbd_iov_pin_rsp() ksmbd: fix kernel-doc comment of ksmbd_vfs_setxattr() ksmbd: add support for surrogate pair conversion ksmbd: no need to wait for binded connection termination at logoff ksmbd: fix kernel-doc comment of ksmbd_vfs_kern_path_locked() ksmbd: separately allocate ci per dentry ksmbd: move oplock handling after unlock parent dir ksmbd: release interim response after sending status pending response ksmbd: move setting SMB2_FLAGS_ASYNC_COMMAND and AsyncId ksmbd: don't update ->op_state as OPLOCK_STATE_NONE on error ksmbd: set epoch in create context v2 lease ksmbd: set v2 lease capability ksmbd: downgrade RWH lease caching state to RH for directory ksmbd: send v2 lease break notification for directory ksmbd: lazy v2 lease break on smb2_write() ksmbd: avoid duplicate opinfo_put() call on error of smb21_lease_break_ack() ksmbd: don't allow O_TRUNC open on read-only share Naveen Mamindlapalli (2): octeontx2-af: Always configure NIX TX link credits based on max frame size octeontx2-af: Re-enable MAC TX in otx2_stop processing NeilBrown (1): nfsd: call nfsd_last_thread() before final nfsd_put() Ngai-Mint Kwan (1): ice: Shut down VSI with "link-down-on-close" enabled Nitesh Shetty (1): nvme: prevent potential spectre v1 gadget Noah Goldstein (1): x86/csum: Remove unnecessary odd handling Nuno Sa (2): iio: imu: adis16475: add spi_device_id table iio: imu: adis16475: use bit numbers in assign_bit() Pablo Neira Ayuso (3): netfilter: nf_tables: skip set commit for deleted/destroyed sets netfilter: nf_tables: set transport offset from mac header for netdev/egress netfilter: nft_immediate: drop chain reference counter on error Paolo Abeni (4): mptcp: refactor sndbuf auto-tuning mptcp: fix possible NULL pointer dereference on close mptcp: fix inconsistent state on fastopen race mptcp: prevent tcp diag from closing listener subflows Paolo Bonzini (1): KVM: x86/pmu: fix masking logic for MSR_CORE_PERF_GLOBAL_CTRL Patrick Rudolph (3): pinctrl: cy8c95x0: Fix typo pinctrl: cy8c95x0: Fix regression pinctrl: cy8c95x0: Fix get_pincfg Paulo Alcantara (5): smb: client: fix OOB in cifsd when receiving compounded resps smb: client: fix potential OOB in cifs_dump_detail() smb: client: fix OOB in SMB2_query_info_init() smb: client: fix OOB in smbCalcSize() smb: client: fix potential OOB in smb2_dump_detail() Peter Ujfalusi (6): ALSA: hda: intel-nhlt: Ignore vbps when looking for DMIC 32 bps format ASoC: Intel: skl_hda_dsp_generic: Drop HDMI routes when HDMI is not available ASoC: hdac_hda: Conditionally register dais for HDMI and Analog ASoC: SOF: ipc4-topology: Correct data structures for the SRC module ASoC: SOF: ipc4-topology: Correct data structures for the GAIN module ASoC: SOF: Intel: hda-codec: Delay the codec device registration Peter Zijlstra (1): rcu: Break rcu_node_0 --> &rq->__lock order Philip Yang (1): drm/amdkfd: svm range always mapped flag not working on APU Pranjal Ramajor Asha Kanojiya (1): accel/qaic: Fix GEM import path code Qu Wenruo (2): btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() Quan Nguyen (1): i2c: aspeed: Handle the coalesced stop conditions with the start conditions. Rafał Miłecki (1): nvmem: brcm_nvram: store a copy of NVRAM content Rahul Rameshbabu (2): net/mlx5e: Correct snprintf truncation handling for fw_version buffer net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors Rajvi Jingar (1): platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() Ranjani Sridharan (2): ASoC: SOF: ipc4-topology: Add core_mask in struct snd_sof_pipeline ASoC: SOF: sof-audio: Modify logic for enabling/disabling topology cores Reinhard Speyerer (1): USB: serial: option: add Quectel RM500Q R13 firmware support Ricardo Rivera-Matos (3): ASoC: cs35l45: Use modern pm_ops ASoC: cs35l45: Prevent IRQ handling when suspending/resuming ASoC: cs35l45: Prevents spinning during runtime suspend Rob Herring (1): arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru Rodrigo Cataldo (1): igc: Fix hicredit calculation Ronald Wahl (2): net: ks8851: Fix TX stall caused by TX buffer overrun dmaengine: ti: k3-psil-am62: Fix SPI PDMA data Rouven Czerwinski (1): net: rfkill: gpio: set GPIO direction Ryan McClelland (1): HID: nintendo: fix initializer element is not constant error Sarannya S (1): net: qrtr: ns: Return 0 if server port is not present SeongJae Park (2): mm/damon/core: use number of passed access sampling as a timer mm/damon/core: make damon_start() waits until kdamond_fn() starts Shannon Nelson (3): pds_vdpa: fix up format-truncation complaint pds_vdpa: clear config callback when status goes to 0 pds_vdpa: set features order Shengjiu Wang (3): ASoC: fsl_sai: Fix channel swap issue on i.MX8MP ASoC: fsl_xcvr: Enable 2 * TX bit clock for spdif only case ASoC: fsl_xcvr: refine the requested phy clock frequency Shifeng Li (2): net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() net/mlx5e: Fix a race in command alloc flow Shigeru Yoshida (1): net: Return error from sk_stream_wait_connect() if sk_wait_event() fails Shin'ichiro Kawasaki (2): platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe Revert "platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe" Shuming Fan (1): ASoC: rt5650: add mutex to avoid the jack detection failure Shyam Prasad N (2): cifs: cifs_chan_is_iface_active should be called with chan_lock held cifs: do not depend on release_iface for maintaining iface_list Siddh Raman Pant (2): nfc: llcp_core: Hold a ref to llcp_local->dev when holding a ref to llcp_local nfc: Do not send datagram if socket state isn't LLCP_BOUND Siddhesh Dharme (1): ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP ProBook 440 G6 Sidhartha Kumar (1): maple_tree: do not preallocate nodes for slot stores Sjoerd Simons (2): bus: moxtet: Mark the irq as shared bus: moxtet: Add spi device table Slark Xiao (1): USB: serial: option: add Foxconn T99W265 with new baseline Stefan Binding (1): ALSA: hda/realtek: Add quirks for ASUS Zenbook 2022 Models Stefan Hajnoczi (1): virtio_blk: fix snprintf truncation compiler warning Stefan Wahren (2): ARM: sun9i: smp: Fix array-index-out-of-bounds read in sunxi_mc_smp_init ARM: sun9i: smp: fix return code check of of_property_match_string Steven Rostedt (Google) (9): ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() ring-buffer: Fix slowpath of interrupted event tracing / synthetic: Disable events after testing in synth_event_gen_test_init() ring-buffer: Fix wake ups when buffer_percent is set to 100 ftrace: Fix modification of direct_function hash while in use tracing: Fix blocked reader of snapshot buffer tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing tracing: Add size check when printing trace_marker output ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI Su Hui (2): iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw phy: sunplus: return negative error code in sp_usb_phy_probe Sudheer Mogilappagari (1): i40e: Fix filter input checks to prevent config with invalid values Suman Ghosh (2): octeontx2-pf: Fix graceful exit during PFC configuration failure octeontx2-af: Fix marking couple of structure as __packed Sumanth Korikkar (1): mm/memory_hotplug: fix memmap_on_memory sysfs value retrieval Svyatoslav Pankratov (1): crypto: qat - fix double free during reset Takashi Sakamoto (1): firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards Tasos Sahanidis (1): usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 Thinh Tran (1): net/tg3: fix race condition in tg3_reset_task() Thomas Gleixner (3): x86/alternatives: Sync core before enabling interrupts x86/alternatives: Disable interrupts and sync when optimizing NOPs in place x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully Thomas Lange (1): net: Implement missing SO_TIMESTAMPING_NEW cmsg support Thomas Weißschuh (1): net: avoid build bug in skb extension length calculation Tirthendu Sarkar (1): xsk: add multi-buffer support for sockets sharing umem Tom Jason Schwanke (1): ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP Envy X360 13-ay0xxx Tony Lindgren (2): ARM: dts: Fix occasional boot hang for am3 usb bus: ti-sysc: Flush posted write only after srst_udelay Tvrtko Ursulin (1): drm: Update file owner during use Umesh Nerlige Ramappa (1): drm/i915/perf: Update handling of MMIO triggered reports Vasiliy Kovalev (1): ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro Ville Syrjälä (5): drm/i915: Fix FEC state dump drm/i915: Introduce crtc_state->enhanced_framing drm/i915: Reject async flips with bigjoiner drm/i915/dmc: Don't enable any pipe DMC events drm/i915: Call intel_pre_plane_updates() also for pipes getting enabled Vineet Gupta (2): ARC: fix spare error ARC: fix smatch warning Vineeth Vijayan (1): s390/scm: fix virtual vs physical address confusion Vishnu Sankar (1): platform/x86: thinkpad_acpi: fix for incorrect fan reporting on some ThinkPad systems Vlad Buslov (3): Revert "net/mlx5e: fix double free of encap_header in update funcs" Revert "net/mlx5e: fix double free of encap_header" net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num Vladimir Oltean (2): net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above WANG Rui (1): LoongArch: Apply dynamic relocations for LLD Wadim Egorov (1): iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Wang Yao (1): efi/loongarch: Use load address to calculate kernel entry address Wayne Lin (2): drm/amd/display: pbn_div need be updated for hotplug event drm/amd/display: Add case for dcn35 to support usb4 dmub hpd event Wei Yongjun (1): scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() Weihao Li (1): clk: rockchip: rk3128: Fix HCLK_OTG gate register Wen Gu (1): net/smc: fix invalid link access in dumping SMC-R connections Wenchao Chen (1): mmc: sdhci-sprd: Fix eMMC init failure after hw reset Xiang Yang (1): drm/exynos: fix a potential error pointer dereference Xiao Yao (1): Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE Xiaolei Wang (2): dmaengine: fsl-edma: Do not suspend and resume the masked dma channel when the system is sleeping dmaengine: fsl-edma: Add judgment on enabling round robin arbitration Xuan Zhuo (2): virtio_ring: fix syncs DMA memory with different direction virtio_net: fix missing dma unmap for resize Yang Yingliang (2): i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() dmaengine: fsl-edma: fix wrong pointer check in fsl_edma3_attach_pd() Yaxiong Tian (1): thunderbolt: Fix memory leak in margining_port_remove() Ye Bin (1): jbd2: fix soft lockup in journal_finish_inode_data_buffers() Ying Hsu (1): Bluetooth: Fix deadlock in vhci_send_frame Yong-Xuan Wang (1): RISCV: KVM: update external interrupt atomically for IMSIC swfile Yu Kuai (1): block: warn once for each partition in bio_check_ro() Yu Zhao (1): mm/mglru: skip special VMAs in lru_gen_look_around() Yury Norov (1): net: mana: select PAGE_POOL Zhang Yi (2): jbd2: correct the printing of write_flags in jbd2_write_superblock() jbd2: increase the journal IO's priority ZhenGuo Yin (2): drm/amdgpu: re-create idle bo's PTE during VM state machine reset drm/amdkfd: Free gang_ctx_bo and wptr_bo in pqm_uninit Zheng Yejian (1): tracing: Fix uaf issue when open the hist or hist_debug file Zhipeng Lu (2): ethernet: atheros: fix a memleak in atl1e_setup_ring_resources sfc: fix a double-free bug in efx_probe_filters Ziqi Zhao (1): drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Ziyang Huang (1): mmc: meson-mx-sdhc: Fix initialization frozen issue Zizhi Wo (1): fs: cifs: Fix atime update check Zongmin Zhou (1): ksmbd: prevent memory leak on error return wangkeqi (1): connector: Fix proc_event_num_listeners count not cleared xiongxin (1): gpio: dwapb: mask/unmask IRQ when disable/enale it .../devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 +- arch/arc/kernel/setup.c | 4 +- arch/arc/kernel/signal.c | 6 +- arch/arm/boot/dts/ti/omap/am33xx.dtsi | 1 + arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +- arch/arm/mach-omap2/id.c | 5 + arch/arm/mach-sunxi/mc_smp.c | 8 +- .../allwinner/sun50i-h616-orangepi-zero.dtsi | 3 - .../allwinner/sun50i-h616-orangepi-zero2.dts | 3 + .../allwinner/sun50i-h618-orangepi-zero3.dts | 2 + .../dts/rockchip/rk3399-gru-chromebook.dtsi | 3 +- .../dts/rockchip/rk3399-gru-scarlet-dumo.dts | 4 +- arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 + arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +- arch/arm64/include/asm/syscall_wrapper.h | 4 - arch/arm64/kvm/arm.c | 2 +- arch/arm64/kvm/vgic/vgic-init.c | 47 ++-- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/kvm/vgic/vgic.h | 1 + arch/loongarch/Makefile | 2 +- arch/loongarch/include/asm/efi.h | 2 +- arch/loongarch/include/asm/elf.h | 2 +- arch/loongarch/kernel/stacktrace.c | 2 +- arch/loongarch/kernel/unwind.c | 1 - arch/loongarch/kernel/unwind_prologue.c | 2 +- .../boot/dts/loongson/loongson64-2k1000.dtsi | 3 +- arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +- arch/powerpc/Kconfig | 4 +- arch/powerpc/platforms/pseries/vas.c | 51 +++- arch/powerpc/platforms/pseries/vas.h | 2 + arch/riscv/Kconfig | 4 +- arch/riscv/include/asm/syscall_wrapper.h | 5 - arch/riscv/kernel/cpufeature.c | 4 + arch/riscv/kvm/aia_imsic.c | 13 + arch/s390/Kconfig | 4 +- arch/s390/include/asm/fpu/api.h | 2 +- arch/s390/include/asm/syscall_wrapper.h | 13 +- arch/s390/kvm/vsie.c | 4 - arch/x86/Kconfig | 4 +- arch/x86/events/intel/core.c | 7 +- arch/x86/include/asm/syscall_wrapper.h | 34 +-- arch/x86/kernel/alternative.c | 14 +- arch/x86/kernel/head_64.S | 16 ++ arch/x86/kernel/kprobes/core.c | 3 +- arch/x86/lib/csum-partial_64.c | 105 +++----- arch/x86/net/bpf_jit_comp.c | 46 ++++ arch/x86/xen/Kconfig | 1 + block/blk-core.c | 14 +- block/blk-mq.c | 14 +- crypto/xts.c | 23 +- drivers/accel/qaic/mhi_controller.c | 15 +- drivers/accel/qaic/qaic_data.c | 6 +- drivers/acpi/resource.c | 7 + drivers/acpi/thermal.c | 4 +- drivers/android/binder.c | 2 +- drivers/android/binder_alloc.c | 10 +- drivers/block/virtio_blk.c | 8 +- drivers/bluetooth/hci_vhci.c | 10 +- drivers/bus/moxtet.c | 9 +- drivers/bus/ti-sysc.c | 18 +- drivers/clk/clk-si521xx.c | 4 +- drivers/clk/rockchip/clk-rk3128.c | 24 +- drivers/clk/rockchip/clk-rk3568.c | 1 + drivers/connector/cn_proc.c | 5 +- drivers/crypto/intel/qat/qat_common/adf_aer.c | 3 +- drivers/cxl/core/hdm.c | 9 +- drivers/cxl/core/mbox.c | 2 +- drivers/cxl/core/memdev.c | 31 ++- drivers/cxl/core/pmu.c | 2 +- drivers/cxl/core/port.c | 7 + drivers/cxl/core/region.c | 5 - drivers/cxl/cxl.h | 1 + drivers/dma/fsl-edma-main.c | 12 +- drivers/dma/idxd/submit.c | 14 +- drivers/dma/ti/k3-psil-am62.c | 12 +- drivers/dma/ti/k3-psil-am62a.c | 12 +- drivers/firewire/ohci.c | 51 ++++ drivers/firmware/efi/libstub/loongarch-stub.c | 4 +- drivers/firmware/efi/libstub/loongarch.c | 6 +- drivers/gpio/gpio-dwapb.c | 12 +- drivers/gpio/gpiolib-cdev.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 + drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c | 5 - drivers/gpu/drm/amd/amdgpu/soc15.c | 17 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +- .../amd/amdkfd/kfd_process_queue_manager.c | 54 ++-- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 18 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 14 +- .../amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 6 + .../drm/amd/display/dc/bios/bios_parser2.c | 23 +- .../drm/amd/display/dc/bios/command_table2.c | 12 +- .../drm/amd/display/dc/bios/command_table2.h | 2 +- .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 8 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 26 +- .../gpu/drm/amd/display/dc/dc_bios_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 1 + drivers/gpu/drm/amd/display/dc/dce/dmub_abm.c | 8 +- .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c | 7 +- .../gpu/drm/amd/display/dc/dce/dmub_abm_lcd.h | 2 +- .../display/dc/dce110/dce110_hw_sequencer.c | 16 +- .../amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 +- .../gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 12 +- .../drm/amd/display/dc/dcn21/dcn21_hwseq.c | 36 ++- .../amd/display/dc/dcn31/dcn31_panel_cntl.c | 5 +- drivers/gpu/drm/amd/display/dc/dml/Makefile | 4 + .../gpu/drm/amd/display/dc/dml/dc_features.h | 2 +- .../drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 110 +++++++- drivers/gpu/drm/amd/display/dc/inc/hw/abm.h | 3 +- .../drm/amd/display/dc/inc/hw/panel_cntl.h | 2 + .../drm/amd/display/dc/link/link_factory.c | 56 ++-- .../gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 14 +- .../display/include/grph_object_ctrl_defs.h | 2 + .../display/modules/info_packet/info_packet.c | 13 +- drivers/gpu/drm/bridge/parade-ps8640.c | 7 +- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 +- drivers/gpu/drm/drm_auth.c | 3 +- drivers/gpu/drm/drm_crtc.c | 8 +- drivers/gpu/drm/drm_debugfs.c | 10 +- drivers/gpu/drm/drm_file.c | 40 ++- drivers/gpu/drm/drm_ioctl.c | 3 + drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +- drivers/gpu/drm/exynos/exynos_hdmi.c | 2 + drivers/gpu/drm/i915/display/g4x_dp.c | 10 +- drivers/gpu/drm/i915/display/intel_crt.c | 2 + .../drm/i915/display/intel_crtc_state_dump.c | 3 + drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 +- drivers/gpu/drm/i915/display/intel_ddi.c | 22 +- drivers/gpu/drm/i915/display/intel_display.c | 15 +- .../drm/i915/display/intel_display_types.h | 2 + drivers/gpu/drm/i915/display/intel_dmc.c | 43 ++- drivers/gpu/drm/i915/display/intel_dp.c | 5 +- .../drm/i915/display/intel_dp_link_training.c | 35 ++- drivers/gpu/drm/i915/i915_hwmon.c | 4 +- drivers/gpu/drm/i915/i915_perf.c | 39 ++- drivers/gpu/drm/mgag200/mgag200_drv.h | 5 + drivers/gpu/drm/mgag200/mgag200_g200er.c | 5 + drivers/gpu/drm/mgag200/mgag200_g200ev.c | 5 + drivers/gpu/drm/mgag200/mgag200_g200se.c | 5 + drivers/gpu/drm/mgag200/mgag200_mode.c | 10 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +- .../drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 6 +- drivers/hid/hid-nintendo.c | 71 ++--- drivers/hwmon/corsair-psu.c | 18 +- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- drivers/i2c/busses/i2c-aspeed.c | 48 ++-- drivers/i2c/busses/i2c-qcom-geni.c | 8 +- drivers/i2c/busses/i2c-rk3x.c | 13 +- drivers/i2c/i2c-core.h | 4 +- drivers/iio/accel/kionix-kx022a.c | 37 ++- drivers/iio/adc/imx93_adc.c | 4 + drivers/iio/adc/meson_saradc.c | 16 +- drivers/iio/adc/ti_am335x_adc.c | 4 +- .../buffer/industrialio-triggered-buffer.c | 10 + .../iio/common/ms_sensors/ms_sensors_i2c.c | 4 +- drivers/iio/imu/adis16475.c | 121 +++++---- drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +- drivers/iio/magnetometer/tmag5273.c | 2 +- drivers/infiniband/hw/mlx5/mr.c | 2 + drivers/input/joystick/xpad.c | 1 + drivers/input/keyboard/atkbd.c | 46 +++- drivers/input/keyboard/ipaq-micro-keys.c | 3 + drivers/input/misc/soc_button_array.c | 5 + drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/i8042-acpipnpio.h | 8 + drivers/interconnect/core.c | 3 + drivers/interconnect/qcom/sm8250.c | 1 + drivers/leds/trigger/ledtrig-tty.c | 4 + drivers/md/Kconfig | 1 + drivers/md/dm-integrity.c | 11 +- .../platform/qcom/camss/camss-csid-gen2.c | 14 +- drivers/media/platform/qcom/camss/camss.c | 45 ++-- drivers/mmc/core/block.c | 7 +- drivers/mmc/core/host.c | 1 + drivers/mmc/host/meson-mx-sdhc-mmc.c | 26 +- drivers/mmc/host/sdhci-sprd.c | 10 +- .../net/ethernet/atheros/atl1e/atl1e_main.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 4 +- drivers/net/ethernet/broadcom/tg3.c | 11 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 11 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 ++- .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 +- drivers/net/ethernet/intel/ice/ice_lag.c | 2 + drivers/net/ethernet/intel/ice/ice_lib.c | 7 +- drivers/net/ethernet/intel/ice/ice_main.c | 12 +- drivers/net/ethernet/intel/igc/igc.h | 1 + drivers/net/ethernet/intel/igc/igc_ethtool.c | 42 ++- drivers/net/ethernet/intel/igc/igc_tsn.c | 2 +- .../net/ethernet/marvell/octeontx2/af/npc.h | 4 +- .../net/ethernet/marvell/octeontx2/af/rvu.h | 1 + .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 17 ++ .../ethernet/marvell/octeontx2/af/rvu_nix.c | 118 +-------- .../marvell/octeontx2/nic/otx2_dcbnl.c | 17 +- drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +- .../mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../mellanox/mlx5/core/en/fs_tt_redirect.c | 1 + .../mellanox/mlx5/core/en/tc/act/mirred.c | 5 +- .../ethernet/mellanox/mlx5/core/en/tc_tun.c | 30 ++- .../mellanox/mlx5/core/en/tc_tun_encap.c | 3 +- .../net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +- .../ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 10 +- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +- .../mellanox/mlx5/core/eswitch_offloads.c | 31 ++- .../mlx5/core/eswitch_offloads_termtbl.c | 4 +- .../net/ethernet/mellanox/mlx5/core/vport.c | 2 +- .../mellanox/mlxbf_gige/mlxbf_gige_rx.c | 9 +- drivers/net/ethernet/micrel/ks8851.h | 3 + drivers/net/ethernet/micrel/ks8851_common.c | 20 +- drivers/net/ethernet/micrel/ks8851_spi.c | 42 +-- drivers/net/ethernet/microsoft/Kconfig | 1 + drivers/net/ethernet/mscc/ocelot_stats.c | 16 +- drivers/net/ethernet/qlogic/qla3xxx.c | 2 + drivers/net/ethernet/realtek/r8169_main.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 65 +++-- drivers/net/ethernet/sfc/rx_common.c | 4 +- .../ethernet/stmicro/stmmac/dwmac-loongson.c | 5 - .../ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 2 +- drivers/net/phy/phy_device.c | 6 +- drivers/net/usb/ax88172a.c | 4 +- drivers/net/usb/ax88179_178a.c | 23 +- drivers/net/virtio_net.c | 90 +++---- .../wireless/intel/iwlwifi/pcie/internal.h | 4 +- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 10 +- .../net/wireless/intel/iwlwifi/pcie/trans.c | 21 +- drivers/net/wireless/mediatek/mt76/dma.c | 10 +- drivers/nvme/host/core.c | 67 +++-- drivers/nvme/host/fc.c | 27 +- drivers/nvme/host/ioctl.c | 21 +- drivers/nvme/host/nvme.h | 6 + drivers/nvme/host/pci.c | 14 +- drivers/nvme/host/rdma.c | 23 +- drivers/nvme/host/tcp.c | 27 +- drivers/nvme/target/configfs.c | 3 + drivers/nvmem/brcm_nvram.c | 134 +++++++--- drivers/parport/parport_serial.c | 64 +++++ drivers/pci/pci.c | 6 + drivers/pci/pci.h | 2 + drivers/pci/pcie/aspm.c | 19 ++ drivers/pci/quirks.c | 8 +- .../phy/mediatek/phy-mtk-mipi-dsi-mt8183.c | 2 +- drivers/phy/sunplus/phy-sunplus-usb2.c | 2 +- drivers/phy/ti/phy-gmii-sel.c | 5 +- drivers/pinctrl/cirrus/Kconfig | 3 +- drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 +- drivers/pinctrl/pinctrl-amd.c | 9 + drivers/pinctrl/pinctrl-amd.h | 5 + drivers/pinctrl/pinctrl-at91-pio4.c | 8 + drivers/pinctrl/pinctrl-cy8c95x0.c | 14 +- .../starfive/pinctrl-starfive-jh7100.c | 4 +- .../starfive/pinctrl-starfive-jh7110.c | 4 +- drivers/platform/x86/amd/pmc/pmc-quirks.c | 20 ++ drivers/platform/x86/amd/pmc/pmc.c | 33 +-- drivers/platform/x86/amd/pmc/pmc.h | 12 + drivers/platform/x86/intel/pmc/adl.c | 9 +- drivers/platform/x86/intel/pmc/cnp.c | 26 +- drivers/platform/x86/intel/pmc/core.c | 14 +- drivers/platform/x86/intel/pmc/core.h | 7 +- drivers/platform/x86/intel/pmc/mtl.c | 9 +- drivers/platform/x86/intel/pmc/tgl.c | 9 +- drivers/platform/x86/intel/vbtn.c | 19 +- drivers/platform/x86/thinkpad_acpi.c | 98 ++++++- drivers/reset/core.c | 8 +- drivers/reset/hisilicon/hi6220_reset.c | 2 +- drivers/s390/block/scm_blk.c | 7 +- drivers/scsi/aacraid/aacraid.h | 1 - drivers/scsi/aacraid/commsup.c | 6 +- drivers/scsi/aacraid/linit.c | 14 - drivers/scsi/aacraid/src.c | 25 +- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +- drivers/scsi/scsi_error.c | 2 + drivers/soundwire/intel_ace2x.c | 3 +- drivers/spi/spi-atmel.c | 92 ++++++- drivers/spi/spi-cadence.c | 1 - drivers/spi/spi-imx.c | 15 +- drivers/thunderbolt/debugfs.c | 2 +- drivers/ufs/core/ufshcd.c | 3 +- drivers/ufs/host/ufs-qcom.c | 6 +- drivers/uio/uio.c | 7 +- drivers/usb/fotg210/fotg210-hcd.c | 3 - drivers/usb/serial/ftdi_sio.c | 6 +- drivers/usb/serial/ftdi_sio_ids.h | 6 +- drivers/usb/serial/option.c | 5 + drivers/usb/storage/unusual_devs.h | 11 + drivers/usb/typec/ucsi/ucsi_glink.c | 2 +- drivers/vdpa/pds/debugfs.c | 2 +- drivers/vdpa/pds/vdpa_dev.c | 7 +- drivers/virtio/virtio_ring.c | 6 +- fs/afs/cell.c | 6 +- fs/afs/dynroot.c | 31 ++- fs/afs/internal.h | 2 + fs/afs/volume.c | 26 +- fs/btrfs/disk-io.c | 28 ++ fs/btrfs/qgroup.c | 96 +++---- fs/btrfs/qgroup.h | 9 + fs/btrfs/transaction.c | 2 - fs/btrfs/transaction.h | 3 + fs/dax.c | 24 +- fs/debugfs/file.c | 8 + fs/debugfs/inode.c | 27 +- fs/debugfs/internal.h | 10 +- fs/jbd2/commit.c | 10 +- fs/jbd2/journal.c | 24 +- fs/libfs.c | 41 ++- fs/nfsd/nfsctl.c | 32 ++- fs/nfsd/nfsd.h | 8 +- fs/nfsd/nfssvc.c | 2 +- fs/smb/client/cifs_debug.c | 12 +- fs/smb/client/cifsglob.h | 4 +- fs/smb/client/cifspdu.h | 24 +- fs/smb/client/cifssmb.c | 6 +- fs/smb/client/connect.c | 14 +- fs/smb/client/file.c | 18 +- fs/smb/client/fscache.h | 6 +- fs/smb/client/inode.c | 17 +- fs/smb/client/misc.c | 4 + fs/smb/client/smb2misc.c | 30 +-- fs/smb/client/smb2ops.c | 65 +++-- fs/smb/client/smb2pdu.c | 37 ++- fs/smb/client/smb2pdu.h | 16 +- fs/smb/common/smb2pdu.h | 18 +- fs/smb/server/connection.c | 16 -- fs/smb/server/ksmbd_work.c | 51 ++-- fs/smb/server/mgmt/user_config.h | 1 - fs/smb/server/oplock.c | 118 ++++++++- fs/smb/server/oplock.h | 8 +- fs/smb/server/smb2ops.c | 9 +- fs/smb/server/smb2pdu.c | 179 +++++++------ fs/smb/server/smbacl.c | 11 +- fs/smb/server/transport_rdma.c | 40 ++- fs/smb/server/unicode.c | 187 ++++++++++---- fs/smb/server/vfs.c | 14 +- fs/smb/server/vfs_cache.c | 30 ++- fs/smb/server/vfs_cache.h | 9 +- include/drm/drm_file.h | 13 +- include/linux/blk_types.h | 2 + include/linux/blkdev.h | 2 +- include/linux/bpf.h | 3 + include/linux/damon.h | 16 +- include/linux/dax.h | 10 +- include/linux/device.h | 2 + include/linux/export-internal.h | 6 +- include/linux/fs.h | 85 +++++- include/linux/ieee80211.h | 7 +- include/linux/jbd2.h | 3 + include/linux/key-type.h | 1 + include/net/bluetooth/hci_core.h | 9 +- include/net/ip6_fib.h | 64 +---- include/net/netfilter/nf_tables_ipv4.h | 2 +- include/net/sock.h | 9 +- include/net/tcp.h | 2 + include/net/xdp_sock.h | 2 + include/trace/events/9p.h | 11 +- io_uring/cancel.c | 11 +- io_uring/io_uring.c | 36 +-- kernel/Kconfig.kexec | 2 + kernel/bpf/arraymap.c | 58 +---- kernel/rcu/rcu.h | 2 + kernel/rcu/tasks.h | 32 ++- kernel/rcu/tree.c | 43 ++- kernel/resource.c | 4 +- kernel/sys_ni.c | 14 + kernel/time/posix-stubs.c | 45 ---- kernel/trace/ftrace.c | 100 ++++--- kernel/trace/ring_buffer.c | 148 ++++------- kernel/trace/synth_event_gen_test.c | 11 + kernel/trace/trace.c | 32 ++- kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 12 +- kernel/trace/trace_output.c | 6 +- lib/idr.c | 2 +- lib/kunit/test.c | 42 ++- lib/maple_tree.c | 11 + lib/test_ida.c | 40 +++ lib/vsprintf.c | 11 +- mm/damon/core.c | 102 ++++---- mm/filemap.c | 9 + mm/memory-failure.c | 60 ++--- mm/memory.c | 4 +- mm/memory_hotplug.c | 8 +- mm/migrate.c | 9 +- mm/vmscan.c | 13 +- net/8021q/vlan_core.c | 9 +- net/9p/protocol.c | 17 +- net/bluetooth/af_bluetooth.c | 7 +- net/bluetooth/hci_event.c | 30 ++- net/bluetooth/l2cap_core.c | 21 +- net/bluetooth/mgmt.c | 25 +- net/bluetooth/smp.c | 7 + net/core/dev.c | 3 + net/core/neighbour.c | 9 +- net/core/skbuff.c | 5 +- net/core/sock.c | 12 +- net/core/sock_map.c | 2 + net/core/stream.c | 2 +- net/dns_resolver/dns_key.c | 25 +- net/ife/ife.c | 1 + net/ipv4/tcp.c | 3 +- net/ipv4/tcp_output.c | 16 +- net/ipv6/ip6_fib.c | 55 +--- net/ipv6/route.c | 6 +- net/mac80211/cfg.c | 4 +- net/mac80211/driver-ops.c | 6 +- net/mac80211/ht.c | 1 + net/mac80211/mesh_plink.c | 16 +- net/mac80211/mlme.c | 4 +- net/mptcp/options.c | 1 + net/mptcp/protocol.c | 27 +- net/mptcp/protocol.h | 63 ++++- net/mptcp/sockopt.c | 5 +- net/mptcp/subflow.c | 42 ++- net/netfilter/nf_nat_ovs.c | 3 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nf_tables_core.c | 2 +- net/netfilter/nft_immediate.c | 2 +- net/nfc/llcp_core.c | 39 ++- net/nfc/llcp_sock.c | 5 + net/qrtr/ns.c | 4 +- net/rfkill/rfkill-gpio.c | 8 + net/rose/af_rose.c | 39 ++- net/sched/em_text.c | 4 +- net/smc/smc_diag.c | 3 +- net/socket.c | 2 + net/sunrpc/svc_xprt.c | 5 +- net/wireless/certs/wens.hex | 87 +++++++ net/wireless/core.c | 2 + net/wireless/core.h | 1 + net/wireless/nl80211.c | 56 ++-- net/xdp/xsk.c | 2 +- net/xdp/xsk_buff_pool.c | 3 + samples/vfio-mdev/mtty.c | 239 +++++++++++------ scripts/decode_stacktrace.sh | 19 +- security/apparmor/apparmorfs.c | 1 + security/apparmor/mount.c | 4 + security/keys/gc.c | 31 ++- security/keys/internal.h | 11 +- security/keys/key.c | 15 +- security/keys/proc.c | 2 +- sound/drivers/pcmtest.c | 13 +- sound/hda/intel-nhlt.c | 33 ++- sound/pci/hda/patch_realtek.c | 20 +- sound/pci/hda/tas2781_hda_i2c.c | 244 ++++++++++-------- sound/soc/amd/yc/acp6x-mach.c | 14 + sound/soc/codecs/cs35l45-i2c.c | 2 +- sound/soc/codecs/cs35l45-spi.c | 2 +- sound/soc/codecs/cs35l45.c | 56 +++- sound/soc/codecs/cs43130.c | 6 +- sound/soc/codecs/da7219-aad.c | 2 +- sound/soc/codecs/hdac_hda.c | 23 +- sound/soc/codecs/hdmi-codec.c | 12 +- sound/soc/codecs/nau8822.c | 9 +- sound/soc/codecs/rt5645.c | 10 +- sound/soc/codecs/tas2781-comlib.c | 4 +- sound/soc/codecs/tas2781-fmwlib.c | 14 +- sound/soc/codecs/tas2781-i2c.c | 2 + sound/soc/codecs/wm8974.c | 6 +- sound/soc/fsl/fsl_rpmsg.c | 10 +- sound/soc/fsl/fsl_sai.c | 3 + sound/soc/fsl/fsl_xcvr.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 31 ++- sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 + sound/soc/intel/skylake/skl-pcm.c | 9 +- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +- sound/soc/mediatek/mt8186/mt8186-dai-adda.c | 2 +- sound/soc/meson/g12a-toacodec.c | 5 +- sound/soc/meson/g12a-tohdmitx.c | 8 +- sound/soc/sof/intel/hda-codec.c | 18 +- sound/soc/sof/ipc3-topology.c | 2 + sound/soc/sof/ipc4-control.c | 20 +- sound/soc/sof/ipc4-topology.c | 61 +++-- sound/soc/sof/ipc4-topology.h | 34 ++- sound/soc/sof/sof-audio.c | 65 +++-- sound/soc/sof/sof-audio.h | 2 + sound/soc/sof/topology.c | 4 +- sound/usb/quirks.c | 4 +- tools/bpf/bpftool/gen.c | 15 +- tools/testing/cxl/Kbuild | 1 + tools/testing/cxl/cxl_core_exports.c | 7 + tools/testing/cxl/test/cxl.c | 5 +- tools/testing/radix-tree/maple.c | 2 +- tools/testing/selftests/alsa/mixer-test.c | 2 +- .../bonding/bond-arp-interval-causes-panic.sh | 6 +- tools/testing/selftests/mm/memfd_secret.c | 3 + .../testing/selftests/net/mptcp/mptcp_join.sh | 8 +- 493 files changed, 5473 insertions(+), 2775 deletions(-) create mode 100644 net/wireless/certs/wens.hex create mode 100644 tools/testing/cxl/cxl_core_exports.c -- 2.25.1

2 471

[PATCH openEuler-1.0-LTS v4 0/5] CVE-2023-52595
by Pu Lehui 19 Mar '24

19 Mar '24

Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 1 + .../net/wireless/ralink/rt2x00/rt2800soc.c | 1 + .../net/wireless/ralink/rt2x00/rt2800usb.c | 1 + drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 26 +++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 78 insertions(+), 17 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-22.03-LTS-SP1 6/6] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 19 Mar '24

19 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 19 Mar '24

19 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] mpt3sas bugfix
by Baogen Shang 19 Mar '24

19 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH OLK-5.10 0/1] CVE-2023-52593
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Chen Ridong (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/staging/wfx/sta.c | 42 ++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] iommu/arm-smmu-v3: Disable ECMDQ before reset
by Wang Wensheng 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97CSY -------------------------------- In kdump kernel, the ECMDQ is enabled before and cannot be reset before it is disabled. This leads to "CMD_SYNC timeout" problem. Disable the ECMDQ before reset the ECMDQ to fix. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 3d3e0c935023..4b006590ae05 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3869,6 +3869,20 @@ static int arm_smmu_ecmdq_reset(struct arm_smmu_device *smmu) q->llq.prod = 0; q->llq.cons = 0; } + + reg = readl(q->prod_reg); + if (reg & ECMDQ_PROD_EN) { + /* disable ecmdq */ + writel(reg & ~ECMDQ_PROD_EN, q->prod_reg); + ret = readl_relaxed_poll_timeout(q->cons_reg, reg, + !(reg & ECMDQ_CONS_ENACK), 1, ARM_SMMU_POLL_TIMEOUT_US); + if (ret) { + dev_warn(smmu->dev, "ecmdq[%d] disable failed\n", i); + smmu->ecmdq_enabled = 0; + return ret; + } + } + writeq_relaxed(q->q_base, ecmdq->base + ARM_SMMU_ECMDQ_BASE); writel_relaxed(q->llq.prod, ecmdq->base + ARM_SMMU_ECMDQ_PROD); writel_relaxed(q->llq.cons, ecmdq->base + ARM_SMMU_ECMDQ_CONS); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS v2 0/3] jfs: fix two cve issue
by Long Li 19 Mar '24

19 Mar '24

This patch set fix two cve issue. Dongliang Mu (1): JFS: fix memleak in jfs_mount Edward Adam Davis (2): jfs: fix uaf in jfs_evict_inode jfs: fix array-index-out-of-bounds in diNewExt fs/jfs/jfs_imap.c | 3 +++ fs/jfs/jfs_mount.c | 57 ++++++++++++++++++++-------------------------- 2 files changed, 28 insertions(+), 32 deletions(-) -- 2.31.1

2 4

[PATCH openEuler-22.03-LTS-SP2 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 306 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 315 insertions(+), 310 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS-SP1 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 304 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 309 insertions(+), 308 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 304 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 7 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 10 files changed, 309 insertions(+), 304 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10 0/7] CVE-2023-52452
by Pu Lehui 19 Mar '24

19 Mar '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Fix accesses to uninit stack slots Eduard Zingerman (1): bpf: Allow reads from uninit stack Kees Cook (1): bpf, verifier: Fix memory leak in array reallocation for stack state Lorenz Bauer (2): bpf: verifier: Improve function state reallocation bpf: verifier: Use copy_array for jmp_history Stanislav Fomichev (1): bpf: expose bpf_strtol and bpf_strtoul to all program types kernel/bpf/cgroup.c | 4 - kernel/bpf/helpers.c | 7 +- kernel/bpf/verifier.c | 306 +++++++++--------- .../selftests/bpf/verifier/basic_stack.c | 11 +- tools/testing/selftests/bpf/verifier/calls.c | 17 +- .../bpf/verifier/helper_access_var_len.c | 104 ++++-- .../testing/selftests/bpf/verifier/int_ptr.c | 16 +- .../selftests/bpf/verifier/raw_stack.c | 7 +- .../selftests/bpf/verifier/search_pruning.c | 13 +- tools/testing/selftests/bpf/verifier/sock.c | 27 -- .../testing/selftests/bpf/verifier/var_off.c | 113 +++---- 11 files changed, 315 insertions(+), 310 deletions(-) -- 2.34.1

2 8

[PATCH OLK-5.10] s390/ptrace: handle setting of fpc register correctly
by Zheng Zucheng 19 Mar '24

19 Mar '24

From: Heiko Carstens <hca(a)linux.ibm.com> mainline inclusion from mainline-v6.8-rc1 commit 8b13601d19c541158a6e18b278c00ba69ae37829 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7Q CVE: CVE-2023-52598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ] If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl(). Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c index 3009bb527252..f381caddd905 100644 --- a/arch/s390/kernel/ptrace.c +++ b/arch/s390/kernel/ptrace.c @@ -411,6 +411,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if ((unsigned int) data != 0 || test_fp_ctl(data >> (BITS_PER_LONG - 32))) return -EINVAL; @@ -771,6 +772,7 @@ static int __poke_user_compat(struct task_struct *child, /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if (test_fp_ctl(tmp)) return -EINVAL; child->thread.fpu.fpc = data; @@ -1010,9 +1012,7 @@ static int s390_fpregs_set(struct task_struct *target, int rc = 0; freg_t fprs[__NUM_FPRS]; - if (target == current) - save_fpu_regs(); - + save_fpu_regs(); if (MACHINE_HAS_VX) convert_vx_to_fp(fprs, target->thread.fpu.vxrs); else -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] s390/ptrace: handle setting of fpc register correctly
by Zheng Zucheng 19 Mar '24

19 Mar '24

From: Heiko Carstens <hca(a)linux.ibm.com> mainline inclusion from mainline-v6.8-rc1 commit 8b13601d19c541158a6e18b278c00ba69ae37829 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G7Q CVE: CVE-2023-52598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 8b13601d19c541158a6e18b278c00ba69ae37829 ] If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl(). Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- arch/s390/kernel/ptrace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c index cd3df5514552..05e93dd5f67e 100644 --- a/arch/s390/kernel/ptrace.c +++ b/arch/s390/kernel/ptrace.c @@ -389,6 +389,7 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data) /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if ((unsigned int) data != 0 || test_fp_ctl(data >> (BITS_PER_LONG - 32))) return -EINVAL; @@ -747,6 +748,7 @@ static int __poke_user_compat(struct task_struct *child, /* * floating point control reg. is in the thread structure */ + save_fpu_regs(); if (test_fp_ctl(tmp)) return -EINVAL; child->thread.fpu.fpc = data; @@ -977,9 +979,7 @@ static int s390_fpregs_set(struct task_struct *target, int rc = 0; freg_t fprs[__NUM_FPRS]; - if (target == current) - save_fpu_regs(); - + save_fpu_regs(); if (MACHINE_HAS_VX) convert_vx_to_fp(fprs, target->thread.fpu.vxrs); else -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 6/6] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Baogen Shang 19 Mar '24

19 Mar '24

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index b7bb3a1c1428..1b9b266b2b54 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Wenchao Hao <haowenchao2(a)huawei.com> stable inclusion from stable-v5.10.176 commit 6f0c2f70d9929208d8427ec72c3ed91e2251e289 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ] Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access. If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access. Fixes: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") Signed-off-by: Wenchao Hao <haowenchao2(a)huawei.com> Link: https://lore.kernel.org/r/20230225100135.2109330-1-haowenchao2@huawei.com Acked-by: Sathya Prakash Veerichetty <sathya.prakash(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index b58f4d9c296a..326265fd7f91 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -670,7 +670,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port = sas_port_alloc_num(sas_node->parent_dev); - if ((sas_port_add(port))) { + if (!port || (sas_port_add(port))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); goto out_fail; @@ -695,6 +695,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy = sas_expander_alloc(port, mpt3sas_port->remote_identify.device_type); + if (!rphy) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify; if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -714,6 +720,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__); sas_rphy_free(rphy); rphy = NULL; + goto out_delete_port; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { @@ -740,7 +747,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy)); return mpt3sas_port; - out_fail: +out_delete_port: + sas_port_delete(port); + +out_fail: list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings) list_del(&mpt3sas_phy->port_siblings); -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] scsi: mpt3sas: Remove usage of dma_get_required_mask() API
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 1dfc0a52f768d481de6bb672904cd382ead7ca0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 06e472acf964649a58b7de35fc9cdc3151acb970 upstream. Remove the usage of dma_get_required_mask() API. Directly set the DMA mask to 63/64 if the system is a 64bit machine. Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Link: https://lore.kernel.org/r/20221028091655.17741-2-sreekanth.reddy@broadcom.c… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 222c5cf344c8..b7bb3a1c1428 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2824,8 +2824,7 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) struct sysinfo s; u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4) { ioc->dma_mask = 32; coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] scsi: mpt3sas: Don't change DMA mask while reallocating pools
by Baogen Shang 19 Mar '24

19 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.173 commit 2392303df240e7d036df8872ada176734e108036 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9df650963bf6d6c2c3fcd325d8c44ca2b99554fe upstream. When a pool crosses the 4GB boundary region then before reallocating pools change the coherent DMA mask to 32 bits and keep the normal DMA mask set to 63/64 bits. Link: https://lore.kernel.org/r/20220825075457.16422-2-sreekanth.reddy@broadcom.c… Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Salvatore Bonaccorso <carnil(a)debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> Signed-off-by: Siyu Zhang <Siyu.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..222c5cf344c8 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -2822,19 +2822,26 @@ static int _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) { struct sysinfo s; + u64 coherent_dma_mask, dma_mask; - if (ioc->is_mcpu_endpoint || - sizeof(dma_addr_t) == 4 || ioc->use_32bit_dma || - dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) + if (ioc->is_mcpu_endpoint || sizeof(dma_addr_t) == 4 || + dma_get_required_mask(&pdev->dev) <= DMA_BIT_MASK(32)) { ioc->dma_mask = 32; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(32); /* Set 63 bit DMA mask for all SAS3 and SAS35 controllers */ - else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) + } else if (ioc->hba_mpi_version_belonged > MPI2_VERSION) { ioc->dma_mask = 63; - else + coherent_dma_mask = dma_mask = DMA_BIT_MASK(63); + } else { ioc->dma_mask = 64; + coherent_dma_mask = dma_mask = DMA_BIT_MASK(64); + } + + if (ioc->use_32bit_dma) + coherent_dma_mask = DMA_BIT_MASK(32); - if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask)) || - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(ioc->dma_mask))) + if (dma_set_mask(&pdev->dev, dma_mask) || + dma_set_coherent_mask(&pdev->dev, coherent_dma_mask)) return -ENODEV; if (ioc->dma_mask > 32) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] scsi: mpt3sas: Fix a memory leak
by Baogen Shang 19 Mar '24

19 Mar '24

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v5.10.173 commit 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 54dd96015e8d7a2a07359e2dfebf05b529d1780c ] Add a forgotten kfree(). Fixes: dbec4c9040ed ("scsi: mpt3sas: lockless command submission") Link: https://lore.kernel.org/r/20230207152159.18627-1-thenzl@redhat.com Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 320dc1091cc7..55902825ecb5 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -4905,6 +4905,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) } dma_pool_destroy(ioc->pcie_sgl_dma_pool); } + kfree(ioc->pcie_sg_lookup); + ioc->pcie_sg_lookup = NULL; + if (ioc->config_page) { dexitprintk(ioc, ioc_info(ioc, "config_page(0x%p): free\n", -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
by Baogen Shang 19 Mar '24

19 Mar '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.163 commit ce1a69cc85006b494353911b35171da195d79e25 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8AGBT CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resource allocated in sas_end_device_alloc(). Otherwise a kernel crash will happen: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : device_del+0x54/0x3d0 lr : device_del+0x37c/0x3d0 Call trace: device_del+0x54/0x3d0 attribute_container_class_device_del+0x28/0x38 transport_remove_classdev+0x6c/0x80 attribute_container_device_trigger+0x108/0x110 transport_remove_device+0x28/0x38 sas_rphy_remove+0x50/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_rphy_remove+0x38/0x78 [scsi_transport_sas] sas_port_delete+0x30/0x148 [scsi_transport_sas] do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] device_for_each_child+0x68/0xb0 sas_remove_children+0x30/0x50 [scsi_transport_sas] sas_remove_host+0x20/0x38 [scsi_transport_sas] scsih_remove+0xd8/0x420 [mpt3sas] Because transport_add_device() is not called when sas_rphy_add() fails, the device is not added. When sas_rphy_remove() is subsequently called to remove the device in the remove() path, a NULL pointer dereference happens. Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 6ec5b7f33dfd..b58f4d9c296a 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -712,6 +712,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, if ((sas_rphy_add(rphy))) { ioc_err(ioc, "failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); + sas_rphy_free(rphy); + rphy = NULL; } if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] mpt3sas bugfix
by Baogen Shang 19 Mar '24

19 Mar '24

From: Baogen Shang <baogen.shang(a)windriver.com> Run sync from the openEuler-22.03-LTS fail, so create a new PR. Just remove 3 patches from the openEuler-22.03-LTS PR, since they have been applied on SP1. Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (2): scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: Remove usage of dma_get_required_mask() API Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 69 +++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +++++- 3 files changed, 64 insertions(+), 22 deletions(-) -- 2.33.0

1 0

[PATCH OLK-6.6 v2] s390/vfio-ap: always filter entire AP matrix
by Xiang Yang 19 Mar '24

19 Mar '24

From: Tony Krowiak <akrowiak(a)linux.ibm.com> stable inclusion from stable-v6.6.15 commit c69d821197611678533fb3eb784fc823b921349a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NH7 CVE: CVE-2024-26620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 upstream. The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new domain are inspected. If an APQN does not reference a queue device bound to the vfio_ap device driver, then it's APID will be filtered from the mdev's matrix when updating the guest's AP configuration. Inspecting only the APID of the new adapter or APQI of the new domain will result in passing AP queues through to a guest that are not bound to the vfio_ap device driver under certain circumstances. Consider the following: guest's AP configuration (all also assigned to the mdev's matrix): 14.0004 14.0005 14.0006 16.0004 16.0005 16.0006 unassign domain 4 unbind queue 16.0005 assign domain 4 When domain 4 is re-assigned, since only domain 4 will be inspected, the APQNs that will be examined will be: 14.0004 16.0004 Since both of those APQNs reference queue devices that are bound to the vfio_ap device driver, nothing will get filtered from the mdev's matrix when updating the guest's AP configuration. Consequently, queue 16.0005 will get passed through despite not being bound to the driver. This violates the linux device model requirement that a guest shall only be given access to devices bound to the device driver facilitating their pass-through. To resolve this problem, every adapter and domain assigned to the mdev will be inspected when filtering the mdev's matrix. Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com> Acked-by: Halil Pasic <pasic(a)linux.ibm.com> Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240115185441.31526-2-akrowiak@linux.ibm.com Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/s390/crypto/vfio_ap_ops.c | 57 +++++++++---------------------- 1 file changed, 17 insertions(+), 40 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index 4db538a55192..9382b32e5bd1 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -670,8 +670,7 @@ static bool vfio_ap_mdev_filter_cdoms(struct ap_matrix_mdev *matrix_mdev) * Return: a boolean value indicating whether the KVM guest's APCB was changed * by the filtering or not. */ -static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, - struct ap_matrix_mdev *matrix_mdev) +static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) { unsigned long apid, apqi, apqn; DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES); @@ -692,8 +691,8 @@ static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, bitmap_and(matrix_mdev->shadow_apcb.aqm, matrix_mdev->matrix.aqm, (unsigned long *)matrix_dev->info.aqm, AP_DOMAINS); - for_each_set_bit_inv(apid, apm, AP_DEVICES) { - for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) { + for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) { + for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) { /* * If the APQN is not bound to the vfio_ap device * driver, then we can't assign it to the guest's @@ -958,7 +957,6 @@ static ssize_t assign_adapter_store(struct device *dev, { int ret; unsigned long apid; - DECLARE_BITMAP(apm_delta, AP_DEVICES); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -987,11 +985,8 @@ static ssize_t assign_adapter_store(struct device *dev, } vfio_ap_mdev_link_adapter(matrix_mdev, apid); - memset(apm_delta, 0, sizeof(apm_delta)); - set_bit_inv(apid, apm_delta); - if (vfio_ap_mdev_filter_matrix(apm_delta, - matrix_mdev->matrix.aqm, matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -1167,7 +1162,6 @@ static ssize_t assign_domain_store(struct device *dev, { int ret; unsigned long apqi; - DECLARE_BITMAP(aqm_delta, AP_DOMAINS); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -1196,11 +1190,8 @@ static ssize_t assign_domain_store(struct device *dev, } vfio_ap_mdev_link_domain(matrix_mdev, apqi); - memset(aqm_delta, 0, sizeof(aqm_delta)); - set_bit_inv(apqi, aqm_delta); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, aqm_delta, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -2091,9 +2082,7 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) if (matrix_mdev) { vfio_ap_mdev_link_queue(matrix_mdev, q); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, - matrix_mdev->matrix.aqm, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); } dev_set_drvdata(&apdev->device, q); @@ -2443,34 +2432,22 @@ void vfio_ap_on_cfg_changed(struct ap_config_info *cur_cfg_info, static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) { - bool do_hotplug = false; - int filter_domains = 0; - int filter_adapters = 0; - DECLARE_BITMAP(apm, AP_DEVICES); - DECLARE_BITMAP(aqm, AP_DOMAINS); + bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false; mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); - filter_adapters = bitmap_and(apm, matrix_mdev->matrix.apm, - matrix_mdev->apm_add, AP_DEVICES); - filter_domains = bitmap_and(aqm, matrix_mdev->matrix.aqm, - matrix_mdev->aqm_add, AP_DOMAINS); - - if (filter_adapters && filter_domains) - do_hotplug |= vfio_ap_mdev_filter_matrix(apm, aqm, matrix_mdev); - else if (filter_adapters) - do_hotplug |= - vfio_ap_mdev_filter_matrix(apm, - matrix_mdev->shadow_apcb.aqm, - matrix_mdev); - else - do_hotplug |= - vfio_ap_mdev_filter_matrix(matrix_mdev->shadow_apcb.apm, - aqm, matrix_mdev); + filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm, + matrix_mdev->apm_add, AP_DEVICES); + filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm, + matrix_mdev->aqm_add, AP_DOMAINS); + filter_cdoms = bitmap_intersects(matrix_mdev->matrix.adm, + matrix_mdev->adm_add, AP_DOMAINS); + + if (filter_adapters || filter_domains) + do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev); - if (bitmap_intersects(matrix_mdev->matrix.adm, matrix_mdev->adm_add, - AP_DOMAINS)) + if (filter_cdoms) do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev); if (do_hotplug) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] CVE-2023-52447
by Pu Lehui 19 Mar '24

19 Mar '24

Hou Tao (3): bpf: Add map and need_defer parameters to .map_fd_put_ptr() bpf: Set need_defer as false when clearing fd array during map free bpf: Defer the free of inner map when necessary Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_map and struct bpf_map_ops include/linux/bpf.h | 18 +++++++++++++++--- kernel/bpf/arraymap.c | 33 ++++++++++++++++++++------------- kernel/bpf/hashtab.c | 6 +++--- kernel/bpf/map_in_map.c | 13 +++++++++---- kernel/bpf/map_in_map.h | 2 +- kernel/bpf/syscall.c | 23 +++++++++++++++++++++-- 6 files changed, 69 insertions(+), 26 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] powerpc/lib: Validate size for vector operations
by Zhu Wang 19 Mar '24

19 Mar '24

From: Naveen N Rao <naveen(a)kernel.org> mainline inclusion from mainline-v6.8-rc1 commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G83 CVE: CVE-2023-52606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr(). Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption. Signed-off-by: Naveen N Rao <naveen(a)kernel.org> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Build-tested-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- arch/powerpc/lib/sstep.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c index d81568f783e5..6c8531928274 100644 --- a/arch/powerpc/lib/sstep.c +++ b/arch/powerpc/lib/sstep.c @@ -473,6 +473,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -523,6 +525,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -567,6 +571,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u = {}; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ @@ -594,6 +601,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] CVE-2023-52593
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Dmitry Antipov (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/net/wireless/silabs/wfx/sta.c | 42 ++++++++++++++++----------- 1 file changed, 25 insertions(+), 17 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] binder: fix race between mmput() and do_exit()
by Zheng Yejian 19 Mar '24

19 Mar '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.209 commit 7e7a0d86542b0ea903006d3f42f33c4f7ead6918 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JWJ CVE: CVE-2023-52609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 61406bfa454b..7bd086ab74c5 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return 0; @@ -304,7 +304,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, err_no_vma: if (mm) { mmap_write_unlock(mm); - mmput(mm); + mmput_async(mm); } return vma ? -ENOMEM : -ESRCH; } -- 2.25.1

2 1

[PATCH OLK-6.6] s390/vfio-ap: always filter entire AP matrix
by Xiang Yang 19 Mar '24

19 Mar '24

From: Tony Krowiak <akrowiak(a)linux.ibm.com> mainline inclusion from mainline-v6.6.15 commit c69d821197611678533fb3eb784fc823b921349a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NH7 CVE: CVE-2024-26620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 upstream. The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new domain are inspected. If an APQN does not reference a queue device bound to the vfio_ap device driver, then it's APID will be filtered from the mdev's matrix when updating the guest's AP configuration. Inspecting only the APID of the new adapter or APQI of the new domain will result in passing AP queues through to a guest that are not bound to the vfio_ap device driver under certain circumstances. Consider the following: guest's AP configuration (all also assigned to the mdev's matrix): 14.0004 14.0005 14.0006 16.0004 16.0005 16.0006 unassign domain 4 unbind queue 16.0005 assign domain 4 When domain 4 is re-assigned, since only domain 4 will be inspected, the APQNs that will be examined will be: 14.0004 16.0004 Since both of those APQNs reference queue devices that are bound to the vfio_ap device driver, nothing will get filtered from the mdev's matrix when updating the guest's AP configuration. Consequently, queue 16.0005 will get passed through despite not being bound to the driver. This violates the linux device model requirement that a guest shall only be given access to devices bound to the device driver facilitating their pass-through. To resolve this problem, every adapter and domain assigned to the mdev will be inspected when filtering the mdev's matrix. Signed-off-by: Tony Krowiak <akrowiak(a)linux.ibm.com> Acked-by: Halil Pasic <pasic(a)linux.ibm.com> Fixes: 48cae940c31d ("s390/vfio-ap: refresh guest's APCB by filtering AP resources assigned to mdev") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240115185441.31526-2-akrowiak@linux.ibm.com Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/s390/crypto/vfio_ap_ops.c | 57 +++++++++---------------------- 1 file changed, 17 insertions(+), 40 deletions(-) diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c index 4db538a55192..9382b32e5bd1 100644 --- a/drivers/s390/crypto/vfio_ap_ops.c +++ b/drivers/s390/crypto/vfio_ap_ops.c @@ -670,8 +670,7 @@ static bool vfio_ap_mdev_filter_cdoms(struct ap_matrix_mdev *matrix_mdev) * Return: a boolean value indicating whether the KVM guest's APCB was changed * by the filtering or not. */ -static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, - struct ap_matrix_mdev *matrix_mdev) +static bool vfio_ap_mdev_filter_matrix(struct ap_matrix_mdev *matrix_mdev) { unsigned long apid, apqi, apqn; DECLARE_BITMAP(prev_shadow_apm, AP_DEVICES); @@ -692,8 +691,8 @@ static bool vfio_ap_mdev_filter_matrix(unsigned long *apm, unsigned long *aqm, bitmap_and(matrix_mdev->shadow_apcb.aqm, matrix_mdev->matrix.aqm, (unsigned long *)matrix_dev->info.aqm, AP_DOMAINS); - for_each_set_bit_inv(apid, apm, AP_DEVICES) { - for_each_set_bit_inv(apqi, aqm, AP_DOMAINS) { + for_each_set_bit_inv(apid, matrix_mdev->matrix.apm, AP_DEVICES) { + for_each_set_bit_inv(apqi, matrix_mdev->matrix.aqm, AP_DOMAINS) { /* * If the APQN is not bound to the vfio_ap device * driver, then we can't assign it to the guest's @@ -958,7 +957,6 @@ static ssize_t assign_adapter_store(struct device *dev, { int ret; unsigned long apid; - DECLARE_BITMAP(apm_delta, AP_DEVICES); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -987,11 +985,8 @@ static ssize_t assign_adapter_store(struct device *dev, } vfio_ap_mdev_link_adapter(matrix_mdev, apid); - memset(apm_delta, 0, sizeof(apm_delta)); - set_bit_inv(apid, apm_delta); - if (vfio_ap_mdev_filter_matrix(apm_delta, - matrix_mdev->matrix.aqm, matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -1167,7 +1162,6 @@ static ssize_t assign_domain_store(struct device *dev, { int ret; unsigned long apqi; - DECLARE_BITMAP(aqm_delta, AP_DOMAINS); struct ap_matrix_mdev *matrix_mdev = dev_get_drvdata(dev); mutex_lock(&ap_perms_mutex); @@ -1196,11 +1190,8 @@ static ssize_t assign_domain_store(struct device *dev, } vfio_ap_mdev_link_domain(matrix_mdev, apqi); - memset(aqm_delta, 0, sizeof(aqm_delta)); - set_bit_inv(apqi, aqm_delta); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, aqm_delta, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); ret = count; @@ -2091,9 +2082,7 @@ int vfio_ap_mdev_probe_queue(struct ap_device *apdev) if (matrix_mdev) { vfio_ap_mdev_link_queue(matrix_mdev, q); - if (vfio_ap_mdev_filter_matrix(matrix_mdev->matrix.apm, - matrix_mdev->matrix.aqm, - matrix_mdev)) + if (vfio_ap_mdev_filter_matrix(matrix_mdev)) vfio_ap_mdev_update_guest_apcb(matrix_mdev); } dev_set_drvdata(&apdev->device, q); @@ -2443,34 +2432,22 @@ void vfio_ap_on_cfg_changed(struct ap_config_info *cur_cfg_info, static void vfio_ap_mdev_hot_plug_cfg(struct ap_matrix_mdev *matrix_mdev) { - bool do_hotplug = false; - int filter_domains = 0; - int filter_adapters = 0; - DECLARE_BITMAP(apm, AP_DEVICES); - DECLARE_BITMAP(aqm, AP_DOMAINS); + bool filter_domains, filter_adapters, filter_cdoms, do_hotplug = false; mutex_lock(&matrix_mdev->kvm->lock); mutex_lock(&matrix_dev->mdevs_lock); - filter_adapters = bitmap_and(apm, matrix_mdev->matrix.apm, - matrix_mdev->apm_add, AP_DEVICES); - filter_domains = bitmap_and(aqm, matrix_mdev->matrix.aqm, - matrix_mdev->aqm_add, AP_DOMAINS); - - if (filter_adapters && filter_domains) - do_hotplug |= vfio_ap_mdev_filter_matrix(apm, aqm, matrix_mdev); - else if (filter_adapters) - do_hotplug |= - vfio_ap_mdev_filter_matrix(apm, - matrix_mdev->shadow_apcb.aqm, - matrix_mdev); - else - do_hotplug |= - vfio_ap_mdev_filter_matrix(matrix_mdev->shadow_apcb.apm, - aqm, matrix_mdev); + filter_adapters = bitmap_intersects(matrix_mdev->matrix.apm, + matrix_mdev->apm_add, AP_DEVICES); + filter_domains = bitmap_intersects(matrix_mdev->matrix.aqm, + matrix_mdev->aqm_add, AP_DOMAINS); + filter_cdoms = bitmap_intersects(matrix_mdev->matrix.adm, + matrix_mdev->adm_add, AP_DOMAINS); + + if (filter_adapters || filter_domains) + do_hotplug = vfio_ap_mdev_filter_matrix(matrix_mdev); - if (bitmap_intersects(matrix_mdev->matrix.adm, matrix_mdev->adm_add, - AP_DOMAINS)) + if (filter_cdoms) do_hotplug |= vfio_ap_mdev_filter_cdoms(matrix_mdev); if (do_hotplug) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS] binder: fix race between mmput() and do_exit()
by Zheng Yejian 19 Mar '24

19 Mar '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v4.19.306 commit 95b1d336b0642198b56836b89908d07b9a0c9608 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JWJ CVE: CVE-2023-52609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl(a)google.com> Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com [cmllamas: fix trivial conflict with missing d8ed45c5dcd4.] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index d866a70cba7b..6f073d7fd7c6 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -281,7 +281,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, } if (mm) { up_read(&mm->mmap_sem); - mmput(mm); + mmput_async(mm); } return 0; @@ -314,7 +314,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, err_no_vma: if (mm) { up_read(&mm->mmap_sem); - mmput(mm); + mmput_async(mm); } return vma ? -ENOMEM : -ESRCH; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] CVE-2023-52593 wifi
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Chen Ridong (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/staging/wfx/sta.c | 42 ++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH V4 OLK-6.6] iommu/iova: avoid softlockup in fq_flush_timeout
by Zhang Zekun 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZE0I CVE: NA -------------------------------- There is a softlockup undering cpu pressure test. ... pc : _raw_spin_unlock_irqrestore+0x14/0x78 lr : fq_flush_timeout+0x94/0x118 ... Call trace: _raw_spin_unlock_irqrestore+0x14/0x78 call_timer_fn+0x3c/0x1d0 expire_timers+0xcc/0x190 run_timer_softirq+0xfc/0x268 __do_softirq+0x128/0x3dc ____do_softirq+0x18/0x30 call_on_irq_stack+0x24/0x30 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0xc0/0xe8 el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x78/0x80 __schedule+0xf28/0x12a0 schedule+0x3c/0x108 schedule_timeout+0xa0/0x1d0 pktgen_thread_worker+0x1180/0x15d0 kthread+0x120/0x130 ret_from_fork+0x10/0x20 This is because the timer callback fq_flush_timeout may run more than 10ms, and timer may be processed continuously in the softirq so trigger softlockup. We can use work to deal with fq_ring_free for each cpu which may take long time, that to avoid triggering softlockup. Signed-off-by: Li Bin <huawei.libin(a)huawei.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- v4: - fix code check warnings. drivers/iommu/dma-iommu.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 037fcf826407..06ccdda6173b 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -85,6 +85,8 @@ struct iommu_dma_cookie { /* Options for dma-iommu use */ struct iommu_dma_options options; struct mutex mutex; + + struct work_struct free_iova_work; }; static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled); @@ -184,17 +186,11 @@ static void fq_flush_iotlb(struct iommu_dma_cookie *cookie) static void fq_flush_timeout(struct timer_list *t) { struct iommu_dma_cookie *cookie = from_timer(cookie, t, fq_timer); - int cpu; atomic_set(&cookie->fq_timer_on, 0); fq_flush_iotlb(cookie); - if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { - fq_ring_free(cookie, cookie->single_fq); - } else { - for_each_possible_cpu(cpu) - fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); - } + schedule_work(&cookie->free_iova_work); } static void queue_iova(struct iommu_dma_cookie *cookie, @@ -279,6 +275,7 @@ static void iommu_dma_free_fq(struct iommu_dma_cookie *cookie) return; del_timer_sync(&cookie->fq_timer); + flush_work(&cookie->free_iova_work); if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) iommu_dma_free_fq_single(cookie->single_fq); else @@ -330,6 +327,21 @@ static int iommu_dma_init_fq_percpu(struct iommu_dma_cookie *cookie) return 0; } +static void free_iova_work_func(struct work_struct *work) +{ + struct iommu_dma_cookie *cookie; + int cpu; + + cookie = container_of(work, struct iommu_dma_cookie, free_iova_work); + if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { + fq_ring_free(cookie, cookie->single_fq); + } else { + for_each_possible_cpu(cpu) + fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); + } + +} + /* sysfs updates are serialised by the mutex of the group owning @domain */ int iommu_dma_init_fq(struct iommu_domain *domain) { @@ -352,6 +364,7 @@ int iommu_dma_init_fq(struct iommu_domain *domain) return -ENOMEM; } + INIT_WORK(&cookie->free_iova_work, free_iova_work_func); timer_setup(&cookie->fq_timer, fq_flush_timeout, 0); atomic_set(&cookie->fq_timer_on, 0); /* -- 2.17.1

2 1

[PATCH OLK-6.6] iommu/arm-smmu-v3: Disable ECMDQ before reset
by Wang Wensheng 19 Mar '24

19 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97CSY -------------------------------- In kdump kernel, the ECMDQ is enabled before and cannot be reset before it is disabled. This leads to "CMD_SYNC timeout" problem. Disable the ECMDQ before reset the ECMDQ to fix. Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 3d3e0c935023..4b006590ae05 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3869,6 +3869,20 @@ static int arm_smmu_ecmdq_reset(struct arm_smmu_device *smmu) q->llq.prod = 0; q->llq.cons = 0; } + + reg = readl(q->prod_reg); + if (reg & ECMDQ_PROD_EN) { + /* disable ecmdq */ + writel(reg & ~ECMDQ_PROD_EN, q->prod_reg); + ret = readl_relaxed_poll_timeout(q->cons_reg, reg, + !(reg & ECMDQ_CONS_ENACK), 1, ARM_SMMU_POLL_TIMEOUT_US); + if (ret) { + dev_warn(smmu->dev, "ecmdq[%d] disable failed\n", i); + smmu->ecmdq_enabled = 0; + return ret; + } + } + writeq_relaxed(q->q_base, ecmdq->base + ARM_SMMU_ECMDQ_BASE); writel_relaxed(q->llq.prod, ecmdq->base + ARM_SMMU_ECMDQ_PROD); writel_relaxed(q->llq.cons, ecmdq->base + ARM_SMMU_ECMDQ_CONS); -- 2.17.1

1 0

[PATCH OLK-5.10 0/1] CVE-2023-52593
by Chen Ridong 19 Mar '24

19 Mar '24

*** BLURB HERE *** Chen Ridong (1): wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap() drivers/staging/wfx/sta.c | 42 ++++++++++++++++++++++----------------- 1 file changed, 24 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS 0/3]
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 8

[PATCH openEuler-22.03-LTS-SP2] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH OLK-5.10] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 7aa33854477d9c346f5560a1a1fcb3fe7783e2a8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..fafcb90219cf 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1970,7 +1970,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47114
by Yifan Qiao 19 Mar '24

19 Mar '24

Junxiao Bi (3): ocfs2: fix data corruption by fallocate ocfs2: fix zero out valid data ocfs2: issue zeroout to EOF blocks fs/ocfs2/file.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 70 insertions(+), 4 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-22.03-LTS-SP2] jfs: fix slab-out-of-bounds Read in dtSearch
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 1c40ca3d39d769931b28295b3145c25f1decf5a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G8Y CVE: CVE-2023-52602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ] Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/ Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..aaee08319214 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data, for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) { index = base + (lim >> 1); + if (stbl[index] < 0) { + rc = -EIO; + goto out; + } + if (p->header.flag & BT_LEAF) { /* uppercase leaf name to compare */ cmp = -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: fix slab-out-of-bounds Read in dtSearch
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 1c40ca3d39d769931b28295b3145c25f1decf5a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G8Y CVE: CVE-2023-52602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ] Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/ Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..aaee08319214 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data, for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) { index = base + (lim >> 1); + if (stbl[index] < 0) { + rc = -EIO; + goto out; + } + if (p->header.flag & BT_LEAF) { /* uppercase leaf name to compare */ cmp = -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] jfs: fix slab-out-of-bounds Read in dtSearch
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 1c40ca3d39d769931b28295b3145c25f1decf5a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G8Y CVE: CVE-2023-52602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ] Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/ Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..aaee08319214 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data, for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) { index = base + (lim >> 1); + if (stbl[index] < 0) { + rc = -EIO; + goto out; + } + if (p->header.flag & BT_LEAF) { /* uppercase leaf name to compare */ cmp = -- 2.39.2

2 1

[PATCH OLK-5.10] jfs: fix slab-out-of-bounds Read in dtSearch
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v5.10.210 commit 1c40ca3d39d769931b28295b3145c25f1decf5a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G8Y CVE: CVE-2023-52602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ] Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/ Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 837d42f61464..aaee08319214 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -633,6 +633,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data, for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) { index = base + (lim >> 1); + if (stbl[index] < 0) { + rc = -EIO; + goto out; + } + if (p->header.flag & BT_LEAF) { /* uppercase leaf name to compare */ cmp = -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] UBSAN: array-index-out-of-bounds in dtSplitRoot
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v4.19.307 commit e30b52a2ea3d1e0aaee68096957cf90a2f4ec5af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G93 CVE: CVE-2023-52603 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27e56f59bab5ddafbcfe69ad7a4a6ea1279c1b16 ] Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-executor270 Not tainted 6.0.0-syzkaller-09423-g493ffd6605b2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_out_of_bounds+0xdb/0x130 lib/ubsan.c:283 dtSplitRoot+0x8d8/0x1900 fs/jfs/jfs_dtree.c:1971 dtSplitUp fs/jfs/jfs_dtree.c:985 [inline] dtInsert+0x1189/0x6b80 fs/jfs/jfs_dtree.c:863 jfs_mkdir+0x757/0xb00 fs/jfs/namei.c:270 vfs_mkdir+0x3b3/0x590 fs/namei.c:4013 do_mkdirat+0x279/0x550 fs/namei.c:4038 __do_sys_mkdirat fs/namei.c:4053 [inline] __se_sys_mkdirat fs/namei.c:4051 [inline] __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4051 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcdc0113fd9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb8bc67d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcdc0113fd9 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 RBP: 00007fcdc00d37a0 R08: 0000000000000000 R09: 00007fcdc00d37a0 R10: 00005555559a72c0 R11: 0000000000000246 R12: 00000000f8008000 R13: 0000000000000000 R14: 00083878000000f8 R15: 0000000000000000 </TASK> The issue is caused when the value of fsi becomes less than -1. The check to break the loop when fsi value becomes -1 is present but syzbot was able to produce value less than -1 which cause the error. This patch simply add the change for the values less than 0. The patch is tested via syzbot. Reported-and-tested-by: syzbot+d4b1df2e9d4ded6488ec(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d4b1df2e9d4ded6488ec Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 52bae3f5c914..320c9f42b65b 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -1983,7 +1983,7 @@ static int dtSplitRoot(tid_t tid, do { f = &rp->slot[fsi]; fsi = f->next; - } while (fsi != -1); + } while (fsi >= 0); f->next = n; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] jfs: fix slab-out-of-bounds Read in dtSearch
by ZhaoLong Wang 19 Mar '24

19 Mar '24

From: Manas Ghandat <ghandatmanas(a)gmail.com> stable inclusion from stable-v4.19.307 commit ce8bc22e948634a5c0a3fa58a179177d0e3f3950 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G8Y CVE: CVE-2023-52602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5492ee89463a7590a1449358002ff7ef63529f ] Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the error. Dave: Set return code to -EIO Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/r/202310241724.Ed02yUz9-lkp@intel.com/ Signed-off-by: Manas Ghandat <ghandatmanas(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dtree.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 52bae3f5c914..02c223e85327 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -646,6 +646,11 @@ int dtSearch(struct inode *ip, struct component_name * key, ino_t * data, for (base = 0, lim = p->header.nextindex; lim; lim >>= 1) { index = base + (lim >> 1); + if (stbl[index] < 0) { + rc = -EIO; + goto out; + } + if (p->header.flag & BT_LEAF) { /* uppercase leaf name to compare */ cmp = -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ocfs2: fix data corruption by fallocate
by Yifan Qiao 19 Mar '24

19 Mar '24

From: Junxiao Bi <junxiao.bi(a)oracle.com> stable inclusion from stable-5.10.43 commit c8d5faee46242c3f33b8a71a4d7d52214785bfcc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9909V CVE: CVE-2021-47114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 6bba4471f0cc1296fe3c2089b9e52442d3074b2e upstream. When fallocate punches holes out of inode size, if original isize is in the middle of last cluster, then the part from isize to the end of the cluster will be zeroed with buffer write, at that time isize is not yet updated to match the new size, if writeback is kicked in, it will invoke ocfs2_writepage()->block_write_full_page() where the pages out of inode size will be dropped. That will cause file corruption. Fix this by zero out eof blocks when extending the inode size. Running the following command with qemu-image 4.2.1 can get a corrupted coverted image file easily. qemu-img convert -p -t none -T none -f qcow2 $qcow_image \ -O qcow2 -o compat=1.1 $qcow_image.conv The usage of fallocate in qemu is like this, it first punches holes out of inode size, then extend the inode size. fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0 fallocate(11, 0, 2276196352, 65536) = 0 v1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html v2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/… Link: https://lkml.kernel.org/r/20210528210648.9124-1-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi <junxiao.bi(a)oracle.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Jan Kara <jack(a)suse.cz> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ocfs2/file.c | 55 ++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 5 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index a3e077fcfeb9..3e699c4a2e37 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1859,6 +1859,45 @@ int ocfs2_remove_inode_range(struct inode *inode, return ret; } +/* + * zero out partial blocks of one cluster. + * + * start: file offset where zero starts, will be made upper block aligned. + * len: it will be trimmed to the end of current cluster if "start + len" + * is bigger than it. + */ +static int ocfs2_zeroout_partial_cluster(struct inode *inode, + u64 start, u64 len) +{ + int ret; + u64 start_block, end_block, nr_blocks; + u64 p_block, offset; + u32 cluster, p_cluster, nr_clusters; + struct super_block *sb = inode->i_sb; + u64 end = ocfs2_align_bytes_to_clusters(sb, start); + + if (start + len < end) + end = start + len; + + start_block = ocfs2_blocks_for_bytes(sb, start); + end_block = ocfs2_blocks_for_bytes(sb, end); + nr_blocks = end_block - start_block; + if (!nr_blocks) + return 0; + + cluster = ocfs2_bytes_to_clusters(sb, start); + ret = ocfs2_get_clusters(inode, cluster, &p_cluster, + &nr_clusters, NULL); + if (ret) + return ret; + if (!p_cluster) + return 0; + + offset = start_block - ocfs2_clusters_to_blocks(sb, cluster); + p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset; + return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS); +} + /* * Parts of this function taken from xfs_change_file_space() */ @@ -1869,7 +1908,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, { int ret; s64 llen; - loff_t size; + loff_t size, orig_isize; struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); struct buffer_head *di_bh = NULL; handle_t *handle; @@ -1900,6 +1939,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, goto out_inode_unlock; } + orig_isize = i_size_read(inode); switch (sr->l_whence) { case 0: /*SEEK_SET*/ break; @@ -1907,7 +1947,7 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, sr->l_start += f_pos; break; case 2: /*SEEK_END*/ - sr->l_start += i_size_read(inode); + sr->l_start += orig_isize; break; default: ret = -EINVAL; @@ -1961,6 +2001,14 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, default: ret = -EINVAL; } + + /* zeroout eof blocks in the cluster. */ + if (!ret && change_size && orig_isize < size) { + ret = ocfs2_zeroout_partial_cluster(inode, orig_isize, + size - orig_isize); + if (!ret) + i_size_write(inode, size); + } up_write(&OCFS2_I(inode)->ip_alloc_sem); if (ret) { mlog_errno(ret); @@ -1977,9 +2025,6 @@ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, goto out_inode_unlock; } - if (change_size && i_size_read(inode) < size) - i_size_write(inode, size); - inode->i_ctime = inode->i_mtime = current_time(inode); ret = ocfs2_mark_inode_dirty(handle, inode, di_bh); if (ret < 0) -- 2.39.2

2 1

[PATCH OLK-6.6 000/157] Backport 6.6.8 LTS Patches
by Peng Zhang 19 Mar '24

19 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> Backport linux-6.6.8 LTS patches from upstream. git cherry-pick v6.6.7..v6.6.8~1 -s There are only 2 simple context conflicts. Build and boot test passed for arm64 & x86. Al Viro (1): io_uring/cmd: fix breakage in SOCKET_URING_OP_SIOC* implementation Alex Deucher (1): drm/amdgpu/sdma5.2: add begin/end_use ring callbacks Amelie Delaunay (1): dmaengine: stm32-dma: avoid bitfield overflow assertion Amir Goldstein (1): fuse: disable FOPEN_PARALLEL_DIRECT_WRITES with FUSE_DIRECT_IO_ALLOW_MMAP Andrew Halaney (1): net: stmmac: Handle disabled MDIO busses from devicetree Andrzej Kacprowski (1): accel/ivpu/37xx: Fix interrupt_clear_with_0 WA initialization Andy Shevchenko (1): platform/x86: intel_telemetry: Fix kernel doc descriptions Aoba K (1): HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad Ard Biesheuvel (1): efi/x86: Avoid physical KASLR on older Dell systems Baokun Li (1): ext4: prevent the normalized size from exceeding EXT_MAX_BLOCKS Bjorn Helgaas (1): Revert "PCI: acpiphp: Reassign resources on bridge if necessary" Boris Burkov (3): btrfs: free qgroup reserve when ORDERED_IOERR is set btrfs: fix qgroup_free_reserved_data int overflow btrfs: don't clear qgroup reserved bit in release_folio Brett Raye (1): HID: glorious: fix Glorious Model I HID report Chengfeng Ye (2): atm: solos-pci: Fix potential deadlock on &cli_queue_lock atm: solos-pci: Fix potential deadlock on &tx_queue_lock Chris Mi (2): net/mlx5e: Disable IPsec offload support if not FW steering net/mlx5e: TC, Don't offload post action rule if not supported Christian König (1): drm/amdgpu: fix tear down order in amdgpu_vm_pt_free Colin Ian King (1): bcache: remove redundant assignment to variable cur_idx Coly Li (3): bcache: avoid oversize memory allocation by small stripe_size bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() bcache: avoid NULL checking to c->root in run_cache_set() Dan Carpenter (1): net/mlx5: Fix a NULL vs IS_ERR() check Dan Williams (1): cxl/hdm: Fix dpa translation locking David Arinzon (4): net: ena: Destroy correct number of xdp queues upon failure net: ena: Fix xdp drops handling due to multibuf packets net: ena: Fix DMA syncing in XDP path when SWIOTLB is on net: ena: Fix XDP redirection error David Hildenbrand (1): selftests/mm: cow: print ksft header before printing anything else David Howells (2): afs: Fix refcount underflow from error handling race rxrpc: Fix some minor issues with bundle tracing David Stevens (1): mm/shmem: fix race in shmem_undo_range w/THP Denis Benato (2): HID: hid-asus: reset the backlight brightness level on resume HID: hid-asus: add const to read-only outgoing usb buffer Dinghao Liu (1): qed: Fix a potential use-after-free in qed_cxt_tables_alloc Dong Chenchen (1): net: Remove acked SYN flag from packet in the transmit queue correctly Eduard Zingerman (1): selftests/bpf: fix bpf_loop_bench for new callback verification scheme Fangrui Song (1): x86/speculation, objtool: Use absolute relocations for annotations Florent Revest (1): team: Fix use-after-free when an option instance allocation fails Frank Li (1): dmaengine: fsl-edma: fix DMA channel leak in eDMAv4 Gavin Li (1): net/mlx5e: Check netdev pointer before checking its net ns Gergo Koteles (4): ALSA: hda/tas2781: leave hda_component in usable state ALSA: hda/tas2781: handle missing EFI calibration data ALSA: hda/tas2781: call cleanup functions only once ALSA: hda/tas2781: reset the amp before component_add Hamish Martin (2): HID: mcp2221: Set driver data before I2C adapter add HID: mcp2221: Allow IO to start during probe Hangyu Hua (1): fuse: dax: set fc->dax to NULL in fuse_dax_conn_free() Hannes Reinecke (1): nvme: catch errors from nvme_configure_metadata() Hariprasad Kelam (3): octeontx2-pf: Fix promisc mcam entry action octeontx2-af: Update RSS algorithm index octeontx2-af: Fix pause frame configuration Hartmut Knaack (1): ALSA: hda/realtek: Apply mute LED quirk for HP15-db Heiko Carstens (1): scripts/checkstack.pl: match all stack sizes for s390 Huacai Chen (2): LoongArch: Silence the boot warning about 'nokaslr' LoongArch: Mark {dmw,tlb}_virt_to_page() exports as non-GPL Hyunwoo Kim (3): atm: Fix Use-After-Free in do_vcc_ioctl net/rose: Fix Use-After-Free in rose_ioctl appletalk: Fix Use-After-Free in atalk_ioctl Ignat Korchagin (1): kexec: drop dependency on ARCH_SUPPORTS_KEXEC from CRASH_DUMP Igor Russkikh (1): net: atlantic: fix double free in ring reinit logic Ioana Ciornei (2): dpaa2-switch: fix size of the dma_unmap dpaa2-switch: do not ask for MDB, VLAN and FDB replay James Houghton (1): arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify Jan Kara (1): ext4: fix warning in ext4_dio_write_end_io() Jani Nikula (1): drm/edid: also call add modes in EDID connector update fallback Jason-JH.Lin (1): drm/mediatek: Add spinlock for setting vblank event in atomic_begin Jean Delvare (1): stmmac: dwmac-loongson: Add architecture dependency Jianbo Liu (2): net/mlx5e: Reduce eswitch mode_lock protection context net/mlx5e: Check the number of elements before walk TC rhashtable Jiaxun Yang (1): PCI: loongson: Limit MRRS to 256 Johan Hovold (2): PCI/ASPM: Add pci_enable_link_state_locked() PCI: vmd: Fix potential deadlock when enabling ASPM John Hubbard (1): Revert "selftests: error out if kernel header files are not yet built" Josef Bacik (1): btrfs: do not allow non subvolume root targets for snapshot Kai Vehmanen (2): ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170 variants Kalesh AP (1): bnxt_en: Fix wrong return value check in bnxt_close_nic() Kelly Kane (1): r8152: add vendor/device ID pair for ASUS USB-C2500 Krister Johansen (1): fuse: share lookup state between submount and its parent Krzysztof Kozlowski (1): soundwire: stream: fix NULL pointer dereference for multi_link Lech Perczak (1): net: usb: qmi_wwan: claim interface 4 for ZTE MF290 Leon Romanovsky (3): net/mlx5e: Honor user choice of IPsec replay window size net/mlx5e: Ensure that IPsec sequence packet number starts from 1 net/mlx5e: Tidy up IPsec NAT-T SA discovery Linus Torvalds (1): asm-generic: qspinlock: fix queued_spin_value_unlocked() implementation Maciej Żenczykowski (1): net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX Mario Limonciello (3): HID: i2c-hid: Add IDEA5002 to i2c_hid_acpi_blacklist[] drm/amd/display: Restore guard against default backlight value < 1 nit drm/amd/display: Disable PSR-SU on Parade 0803 TCON again Mark O'Donovan (1): nvme-auth: set explanation code for failure2 msgs Mark Rutland (1): perf: Fix perf_event_validate_size() lockdep splat Masahiro Yamada (2): LoongArch: Add dependency between vmlinuz.efi and vmlinux.efi arm64: add dependency between vmlinuz.efi and Image Michael Chan (1): bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic Michael Walle (1): drm/mediatek: fix kernel oops if no crtc is found Mikhail Khvainitski (1): HID: lenovo: Restrict detection of patched firmware only to USB cptkbd Ming Lei (1): blk-throttle: fix lockdep warning of "cgroup_mutex or RCU read lock required!" Moshe Shemesh (2): net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work net/mlx5: Nack sync reset request when HotPlug is enabled Namjae Jeon (1): ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE Nguyen Dinh Phi (1): nfc: virtual_ncidev: Add variable to check if ndev is running Nikolay Kuratov (1): vsock/virtio: Fix unsigned integer wrap around in virtio_transport_has_space() Oliver Neukum (2): usb: aqc111: check packet for fixup for true limit HID: add ALWAYS_POLL quirk for Apple kb Patrisious Haddad (3): net/mlx5e: Unify esw and normal IPsec status table creation/destruction RDMA/mlx5: Send events from IB driver about device affiliation state RDMA/mlx5: Change the key being sent for MPV device affiliation Paulo Alcantara (6): smb: client: implement ->query_reparse_point() for SMB1 smb: client: introduce ->parse_reparse_point() smb: client: set correct file type from NFS reparse points smb: client: fix potential OOBs in smb2_parse_contexts() smb: client: fix NULL deref in asn1_ber_decoder() smb: client: fix OOB in smb2_query_reparse_point() Piotr Gardocki (2): iavf: Introduce new state machines for flow director iavf: Handle ntuple on/off based on new state machines for flow director Radu Bulie (1): net: fec: correct queue selection Saurabh Sengar (1): x86/hyperv: Fix the detection of E820_TYPE_PRAM in a Gen2 VM Sebastian Parschauer (1): HID: Add quirk for Labtec/ODDOR/aikeec handbrake Shinas Rasheed (1): octeon_ep: explicitly test for firmware ready value Slawomir Laba (1): iavf: Fix iavf_shutdown to call iavf_remove instead iavf_close Sneh Shah (1): net: stmmac: dwmac-qcom-ethqos: Fix drops in 10M SGMII RX Somnath Kotur (1): bnxt_en: Clear resource reservation during resume Sreekanth Reddy (1): bnxt_en: Fix skb recycling logic in bnxt_deliver_skb() Stanislaw Gruszka (1): accel/ivpu: Print information about used workarounds Stefan Wahren (3): qca_debug: Prevent crash on TX ring changes qca_debug: Fix ethtool -G iface tx behavior qca_spi: Fix reset behavior Steven Rostedt (Google) (9): eventfs: Do not allow NULL parent to eventfs_start_creating() ring-buffer: Fix memory leak of free page tracing: Update snapshot buffer on resize if it is allocated ring-buffer: Do not update before stamp when switching sub-buffers ring-buffer: Have saved event hold the entire event ring-buffer: Fix writing to the buffer with max_data_size ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs ring-buffer: Do not try to put back write_stamp ring-buffer: Have rb_time_cmpxchg() set the msb counter too Stuart Lee (1): drm/mediatek: Fix access violation in mtk_drm_crtc_dma_dev_get Tvrtko Ursulin (2): drm/i915/selftests: Fix engine reset count storage for multi-tile drm/i915: Use internal class when counting engine resets Tyler Fanelli (1): fuse: Rename DIRECT_IO_RELAX to DIRECT_IO_ALLOW_MMAP Ville Syrjälä (3): drm/i915: Fix ADL+ tiled plane stride when the POT stride is smaller than the original drm/i915: Fix intel_atomic_setup_scalers() plane_state handling drm/i915: Fix remapped stride with CCS on ADL+ Vlad Buslov (1): net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table WANG Rui (1): LoongArch: Record pc instead of offset in la_abs relocation Yanteng Si (1): stmmac: dwmac-loongson: Make sure MDIO is initialized before use Yihong Cao (1): HID: apple: add Jamesdonkey and A3R to non-apple keyboards list Yu Zhao (4): mm/mglru: fix underprotected page cache mm/mglru: try to stop at high watermarks mm/mglru: respect min_ttl_ms with memcgs mm/mglru: reclaim offlined memcgs harder Yusong Gao (1): sign-file: Fix incorrect return values check Zhipeng Lu (1): octeontx2-af: fix a use-after-free in rvu_nix_register_reporters Zizhi Wo (1): ksmbd: fix memory leak in smb2_lock() arch/arm64/Makefile | 2 +- arch/arm64/include/asm/pgtable.h | 6 + arch/loongarch/Makefile | 2 + arch/loongarch/include/asm/asmmacro.h | 3 +- arch/loongarch/include/asm/setup.h | 2 +- arch/loongarch/kernel/relocate.c | 10 +- arch/loongarch/mm/pgtable.c | 4 +- arch/riscv/Kconfig | 4 +- arch/riscv/kernel/crash_core.c | 4 +- arch/x86/hyperv/hv_init.c | 25 +- arch/x86/include/asm/alternative.h | 4 +- arch/x86/include/asm/nospec-branch.h | 4 +- block/blk-throttle.c | 2 + drivers/accel/ivpu/ivpu_drv.h | 5 + drivers/accel/ivpu/ivpu_hw_37xx.c | 17 +- drivers/accel/ivpu/ivpu_hw_40xx.c | 4 + drivers/atm/solos-pci.c | 8 +- drivers/cxl/core/hdm.c | 3 +- drivers/cxl/core/port.c | 4 +- drivers/dma/fsl-edma-common.c | 1 + drivers/dma/stm32-dma.c | 8 +- drivers/firmware/efi/libstub/x86-stub.c | 31 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 3 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 28 +++ .../link/protocols/link_edp_panel_control.c | 4 +- .../amd/display/modules/power/power_helpers.c | 2 + drivers/gpu/drm/drm_edid.c | 3 +- drivers/gpu/drm/i915/display/intel_fb.c | 19 +- drivers/gpu/drm/i915/display/skl_scaler.c | 2 +- drivers/gpu/drm/i915/gt/intel_reset.c | 2 +- .../gpu/drm/i915/gt/uc/intel_guc_submission.c | 5 +- drivers/gpu/drm/i915/i915_gpu_error.h | 12 +- .../gpu/drm/i915/selftests/igt_live_test.c | 9 +- .../gpu/drm/i915/selftests/igt_live_test.h | 3 +- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 14 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 +- drivers/hid/hid-apple.c | 2 + drivers/hid/hid-asus.c | 27 ++- drivers/hid/hid-glorious.c | 16 +- drivers/hid/hid-ids.h | 12 +- drivers/hid/hid-lenovo.c | 3 +- drivers/hid/hid-mcp2221.c | 4 +- drivers/hid/hid-multitouch.c | 5 + drivers/hid/hid-quirks.c | 2 + drivers/hid/i2c-hid/i2c-hid-acpi.c | 5 + drivers/infiniband/hw/mlx5/main.c | 17 ++ drivers/md/bcache/bcache.h | 1 + drivers/md/bcache/btree.c | 7 + drivers/md/bcache/super.c | 4 +- drivers/md/bcache/writeback.c | 2 +- drivers/net/ethernet/amazon/ena/ena_eth_com.c | 3 - drivers/net/ethernet/amazon/ena/ena_netdev.c | 53 +++-- .../net/ethernet/aquantia/atlantic/aq_ring.c | 5 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 38 ++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 10 +- .../net/ethernet/broadcom/bnxt/bnxt_devlink.c | 11 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 19 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 5 +- .../freescale/dpaa2/dpaa2-switch-flower.c | 7 +- .../ethernet/freescale/dpaa2/dpaa2-switch.c | 11 +- drivers/net/ethernet/freescale/fec_main.c | 27 +-- drivers/net/ethernet/intel/iavf/iavf.h | 1 + .../net/ethernet/intel/iavf/iavf_ethtool.c | 27 ++- drivers/net/ethernet/intel/iavf/iavf_fdir.h | 15 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 179 +++++++++----- .../net/ethernet/intel/iavf/iavf_virtchnl.c | 71 +++++- .../ethernet/marvell/octeon_ep/octep_main.c | 3 +- .../net/ethernet/marvell/octeontx2/af/rpm.c | 11 +- .../marvell/octeontx2/af/rvu_devlink.c | 5 +- .../ethernet/marvell/octeontx2/af/rvu_npc.c | 55 ++++- .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 25 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../mellanox/mlx5/core/en/tc/post_act.c | 6 + .../mellanox/mlx5/core/en_accel/ipsec.c | 56 +++-- .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 218 +++++++++++++----- .../mlx5/core/en_accel/ipsec_offload.c | 10 +- .../net/ethernet/mellanox/mlx5/core/en_main.c | 27 ++- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- .../net/ethernet/mellanox/mlx5/core/en_tc.c | 25 +- .../mellanox/mlx5/core/esw/ipsec_fs.c | 154 +------------ .../mellanox/mlx5/core/esw/ipsec_fs.h | 15 -- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 35 +-- .../net/ethernet/mellanox/mlx5/core/eswitch.h | 2 + .../mellanox/mlx5/core/eswitch_offloads.c | 54 +++-- .../ethernet/mellanox/mlx5/core/fw_reset.c | 29 +++ .../net/ethernet/mellanox/mlx5/core/main.c | 6 + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 + drivers/net/ethernet/qualcomm/qca_debug.c | 17 +- drivers/net/ethernet/qualcomm/qca_spi.c | 20 +- drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +- .../ethernet/stmicro/stmmac/dwmac-loongson.c | 14 +- .../stmicro/stmmac/dwmac-qcom-ethqos.c | 10 + .../net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 +- drivers/net/team/team.c | 4 +- drivers/net/usb/aqc111.c | 8 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 1 + drivers/nfc/virtual_ncidev.c | 7 +- drivers/nvme/host/auth.c | 2 + drivers/nvme/host/core.c | 19 +- drivers/pci/controller/pci-loongson.c | 46 +++- drivers/pci/controller/vmd.c | 2 +- drivers/pci/hotplug/acpiphp_glue.c | 9 +- drivers/pci/pcie/aspm.c | 53 +++-- drivers/platform/x86/intel/telemetry/core.c | 4 +- drivers/soundwire/stream.c | 7 +- fs/afs/rxrpc.c | 2 +- fs/btrfs/delalloc-space.c | 2 +- fs/btrfs/extent_io.c | 3 +- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 16 +- fs/btrfs/ioctl.c | 9 + fs/btrfs/ordered-data.c | 11 +- fs/btrfs/qgroup.c | 25 +- fs/btrfs/qgroup.h | 4 +- fs/ext4/file.c | 14 +- fs/ext4/mballoc.c | 4 + fs/fuse/dax.c | 1 + fs/fuse/file.c | 8 +- fs/fuse/fuse_i.h | 19 +- fs/fuse/inode.c | 81 ++++++- fs/smb/client/cached_dir.c | 17 +- fs/smb/client/cifsglob.h | 14 +- fs/smb/client/cifspdu.h | 4 +- fs/smb/client/cifsproto.h | 11 +- fs/smb/client/cifssmb.c | 193 +++++++--------- fs/smb/client/inode.c | 74 ++++-- fs/smb/client/readdir.c | 6 +- fs/smb/client/smb1ops.c | 73 ++---- fs/smb/client/smb2inode.c | 2 +- fs/smb/client/smb2misc.c | 26 +-- fs/smb/client/smb2ops.c | 164 ++++++------- fs/smb/client/smb2pdu.c | 93 +++++--- fs/smb/client/smb2proto.h | 12 +- fs/smb/common/smb2pdu.h | 2 +- fs/smb/server/smb2pdu.c | 1 + fs/tracefs/inode.c | 13 +- include/asm-generic/qspinlock.h | 2 +- include/linux/mlx5/device.h | 2 + include/linux/mlx5/driver.h | 2 + include/linux/mlx5/mlx5_ifc.h | 9 +- include/linux/mm_inline.h | 23 +- include/linux/mmzone.h | 34 +-- include/linux/objtool.h | 10 +- include/linux/pci.h | 3 + include/linux/usb/r8152.h | 1 + include/net/addrconf.h | 12 +- include/net/if_inet6.h | 4 - include/net/netfilter/nf_flow_table.h | 10 + include/uapi/linux/fuse.h | 10 +- io_uring/uring_cmd.c | 2 +- kernel/Kconfig.kexec | 1 - kernel/events/core.c | 10 + kernel/trace/ring_buffer.c | 58 ++--- kernel/trace/trace.c | 4 +- mm/shmem.c | 19 +- mm/vmscan.c | 92 +++++--- mm/workingset.c | 6 +- net/appletalk/ddp.c | 9 +- net/atm/ioctl.c | 7 +- net/ipv4/tcp_output.c | 6 + net/ipv6/addrconf.c | 6 +- net/rose/af_rose.c | 4 +- net/rxrpc/conn_client.c | 7 +- net/sched/act_ct.c | 34 ++- net/vmw_vsock/virtio_transport_common.c | 2 +- scripts/checkstack.pl | 3 +- scripts/sign-file.c | 12 +- sound/pci/hda/patch_hdmi.c | 3 + sound/pci/hda/patch_realtek.c | 1 + sound/pci/hda/tas2781_hda_i2c.c | 21 +- tools/testing/selftests/Makefile | 21 +- .../selftests/bpf/progs/bpf_loop_bench.c | 13 +- tools/testing/selftests/lib.mk | 40 +--- tools/testing/selftests/mm/cow.c | 3 +- 175 files changed, 2023 insertions(+), 1214 deletions(-) -- 2.25.1

2 158

[openeuler:OLK-5.10] BUILD REGRESSION 513f709d962ef0b351f70da2b7edf7f8e18dc582
by kernel test robot 19 Mar '24

19 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 513f709d962ef0b351f70da2b7edf7f8e18dc582 !5242 Revert two stable patches to keep binary compatible Error/Warning: (recently discovered and may have been fixed) mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] mm/share_pool.c:4234:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] mm/share_pool.c:4256:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] mm/share_pool.c:4258:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 |-- mm-share_pool.c:error:implicit-declaration-of-function-huge_add_to_page_cache |-- mm-share_pool.c:error:implicit-declaration-of-function-huge_pte_none |-- mm-share_pool.c:error:implicit-declaration-of-function-hugetlb_count_add `-- mm-share_pool.c:error:implicit-declaration-of-function-set_huge_pte_at clang_recent_errors `-- x86_64-allyesconfig |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-eecd-description-in-rnpm_lower_eeprom_clk |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hash_value-description-in-rnpm_set_mta |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-hw-description-in-rnpm_mta_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Excess-function-parameter-pf-description-in-rnpm_set_vlan_anti_spoofing |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-count-not-described-in-rnpm_shift_in_eeprom_bits |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-eec-not-described-in-rnpm_lower_eeprom_clk |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mc_addr-not-described-in-rnpm_set_mta |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-mode-not-described-in-rnpm_mta_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:Function-parameter-or-member-vf-not-described-in-rnpm_set_vlan_anti_spoofing |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnpm_dbg_adapter_exit |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_dbg_adapter_exit |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_get_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-dev-description-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-ee-description-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-flags-description-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-kec-description-in-rnpm_set_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_module_info |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnpm_get_rxnfc |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Excess-function-parameter-pf-description-in-rnpm_get_rss_hash_opts |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_get_rss_hash_opts |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_module_info |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_get_rxnfc |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-eeprom-not-described-in-rnpm_get_module_eeprom |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_get_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnpm_set_coalesce |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_get_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-netdev-not-described-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:Function-parameter-or-member-priv_flags-not-described-in-rnpm_set_priv_flags |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-autoneg_changed-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-dma_ch-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:variable-duplex_changed-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Excess-function-parameter-v_count-description-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnpm_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnpm_alloc_q_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_layer2_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-function-rnpm_setup_tuple5_remapping_tcam |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-data-description-in-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-ent-description-in-rnpm_probe |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-hw-description-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-link_speed-description-in-rnpm_watchdog_update_link |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-maxrate-description-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_setup_tc |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-netdev-description-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-pb-description-in-rnpm_lpbthresh |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-queue-description-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-skb-description-in-rnpm_is_non_eop |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_rx_resources |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_setup_tx_resources |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_tx_maxrate_own |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnpm_setup_tc |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-id-not-described-in-rnpm_probe |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-is_rxframe-not-described-in-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnpm_clean_tx_irq |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_msix_vector-not-described-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-rnpm_queue-not-described-in-rnpm_set_ring_vector |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnpm_wol_supported |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnpm_tx_timeout |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-clean_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-control_mac_rx |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_can_rpu_start |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_check_mc_addr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_clear_udp_tunnel_port |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_fix_queue_number |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_event_schedule |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_task |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_vlan_stags_flag |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-rnpm_xmit_nop_frame_ring_temp |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-update_pf_vlan |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-function-wait_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-packets-is-used-uninitialized-whenever-if-condition-is-false |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:variable-xdp_xmit-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_ack_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_check_for_msg_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnpm_read_mbx_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_ack_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_check_for_msg_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnpm_read_mbx_pf |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-mbx_cookie_zalloc |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_get_capablity |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_reg_read |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_fw_send_cmd_wait |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_get_port_stats2 |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_link_stat_mark_disable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_fw_post_req |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_pluginout_evt_en |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-function-rnpm_mbx_write_posted_locked |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-is-uninitialized-when-used-here |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-err-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:variable-value-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-atr_input-description-in-rnpm_atr_compute_perfect_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Excess-function-parameter-stream-description-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-common-not-described-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_perfect_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:Function-parameter-or-member-input-not-described-in-rnpm_atr_compute_sig_hash_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-function-rnpm_reset_pipeline_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:variable-status-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-eeprom_data-description-in-rnpm_read_i2c_sff8472_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_i2c_data |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Excess-function-parameter-hw-description-in-rnpm_get_phy_type_from_id |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-autoneg_wait_to_complete-not-described-in-rnpm_setup_phy_link_speed_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_read_i2c_byte_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-dev_addr-not-described-in-rnpm_write_i2c_byte_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-device_type-not-described-in-rnpm_read_phy_reg_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-link_up-not-described-in-rnpm_check_phy_link_tnx |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-phy_id-not-described-in-rnpm_get_phy_type_from_id |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-sff8472_data-not-described-in-rnpm_read_i2c_sff8472_generic |-- drivers-net-ethernet-mucse-rnpm-rnpm_phy.c:warning:Function-parameter-or-member-speed-not-described-in-rnpm_check_phy_link_tnx |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-function-rnpm_ptp_setup_ptp |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:variable-target-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-function-rnpm_mbx_get_pn_sn |-- drivers-net-ethernet-yusur-k2-..-platform-ys_intr.c:warning:overlapping-comparisons-always-evaluate-to-false |-- drivers-net-ethernet-yusur-k2-ys_k2_tx.c:warning:variable-clean_tail_ptr-set-but-not-used |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 721m configs tested: 35 configs skipped: 147 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240319 gcc arm64 randconfig-002-20240319 clang arm64 randconfig-003-20240319 clang arm64 randconfig-004-20240319 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240318 gcc x86_64 buildonly-randconfig-002-20240318 gcc x86_64 buildonly-randconfig-003-20240318 gcc x86_64 buildonly-randconfig-004-20240318 gcc x86_64 buildonly-randconfig-005-20240318 gcc x86_64 buildonly-randconfig-006-20240318 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240318 gcc x86_64 randconfig-002-20240318 clang x86_64 randconfig-003-20240318 clang x86_64 randconfig-004-20240318 clang x86_64 randconfig-005-20240318 clang x86_64 randconfig-006-20240318 gcc x86_64 randconfig-011-20240318 clang x86_64 randconfig-012-20240318 clang x86_64 randconfig-013-20240318 gcc x86_64 randconfig-014-20240318 gcc x86_64 randconfig-015-20240318 clang x86_64 randconfig-016-20240318 gcc x86_64 randconfig-071-20240318 gcc x86_64 randconfig-072-20240318 gcc x86_64 randconfig-073-20240318 gcc x86_64 randconfig-074-20240318 clang x86_64 randconfig-075-20240318 gcc x86_64 randconfig-076-20240318 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS fe60ff2ca247d5d8a715a9348f9278c21603153b
by kernel test robot 18 Mar '24

18 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: fe60ff2ca247d5d8a715a9348f9278c21603153b !5241 powerpc/lib: Validate size for vector operations Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- arm64-defconfig |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized elapsed time: 731m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 23534451f50070452c470859343af52684963e9d
by kernel test robot 18 Mar '24

18 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 23534451f50070452c470859343af52684963e9d !5250 f2fs: fix to tag gcing flag on page during block migration Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403181245.X9tjCWvK-lkp@intel.com Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo `-- loongarch-randconfig-r123-20240317 |-- drivers-char-ipmi-ipmi_si_ls2k500.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-addressable-assigned-addr_source_data-got-void-noderef-__iomem |-- drivers-char-ipmi-ipmi_si_ls2k500.c:sparse:sparse:symbol-ipmi_ls2k500_platform_driver-was-not-declared.-Should-it-be-static `-- drivers-char-ipmi-ipmi_si_ls2k500.c:sparse:sparse:symbol-ipmi_si_sim_setup-was-not-declared.-Should-it-be-static clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-allyesconfig |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true elapsed time: 732m configs tested: 10 configs skipped: 94 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] KVM: s390: fix setting of fpc register
by Ze Zuo 18 Mar '24

18 Mar '24

From: Heiko Carstens <hca(a)linux.ibm.com> stable inclusion from stable-v5.10.210 commit 150a3a3871490e8c454ffbac2e60abeafcecff99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GPO CVE: CVE-2023-52597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b988b1bb0053c0dcd26187d29ef07566a565cf55 ] kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the host process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space / host process fpc register value, however it will be discarded, when returning to user space. In result the host process will incorrectly continue to run with the value that was supposed to be used for a guest cpu. Fix this by simply removing the test. There is another test right before the SIE context is entered which will handles invalid values. This results in a change of behaviour: invalid values will now be accepted instead of that the ioctl fails with -EINVAL. This seems to be acceptable, given that this interface is most likely not used anymore, and this is in addition the same behaviour implemented with the memory mapped interface (replace invalid values with zero) - see sync_regs() in kvm-s390.c. Reviewed-by: Christian Borntraeger <borntraeger(a)linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- arch/s390/kvm/kvm-s390.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c index af58d9d421de..5f3d91136d2b 100644 --- a/arch/s390/kvm/kvm-s390.c +++ b/arch/s390/kvm/kvm-s390.c @@ -3647,10 +3647,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) vcpu_load(vcpu); - if (test_fp_ctl(fpu->fpc)) { - ret = -EINVAL; - goto out; - } vcpu->run->s.regs.fpc = fpu->fpc; if (MACHINE_HAS_VX) convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs, @@ -3658,7 +3654,6 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu) else memcpy(vcpu->run->s.regs.fprs, &fpu->fprs, sizeof(fpu->fprs)); -out: vcpu_put(vcpu); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10 v2] iomap: add support to track dirty state of sub pages
by Yu Kuai 18 Mar '24

18 Mar '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I93TU0 CVE: NA ------------------------------------------ commit 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads") replace the per-block structure buffer_head with the per-page structure iomap_page. However, iomap_page can't track the dirty state of sub pages, which will cause performance issue since sub pages will be writeback even if they are not dirty. For example, if block size is 4k and page size is 64k: dd if=/dev/zero of=testfile bs=4k count=16 oflag=sync With buffer_head implementation, the above dd cmd will writeback 4k in each round. However, with iomap_page implementation, the range of writeback in each round is from the start of the page to the end offset we just wrote. Thus add support to track dirty state in iomap_page. test environment: platform: arm64 pagesize: 64k blocksize: 4k test case: dd if=/dev/zero of=/mnt/testfile bs=1M count=128 fio --ioengine=sync --rw=randwrite --iodepth=64 --name=test \ --filename=/mnt/testfile --bs=4k --fsync=1 The test result is: xfs with patch: WRITE: bw=4609KiB/s (4720kB/s) xfs without patch WRITE: bw=2714KiB/s (2780kB/s) ext4: WRITE: bw=3840KiB/s (3932kB/s) Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- Changes in v2: - remove changes to iomap_page_mkwrite_actor(). fs/iomap/buffered-io.c | 83 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 67 insertions(+), 16 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index d9092aa5c3fb..25448d5827d2 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -25,13 +25,13 @@ /* * Structure allocated for each page or THP when block size < page size - * to track sub-page uptodate status and I/O completions. + * to track sub-page uptodate and dirty status and I/O completions. */ struct iomap_page { atomic_t read_bytes_pending; atomic_t write_bytes_pending; - spinlock_t uptodate_lock; - unsigned long uptodate[]; + spinlock_t state_lock; + unsigned long state[]; }; static inline struct iomap_page *to_iomap_page(struct page *page) @@ -59,11 +59,13 @@ iomap_page_create(struct inode *inode, struct page *page) if (iop || nr_blocks <= 1) return iop; - iop = kzalloc(struct_size(iop, uptodate, BITS_TO_LONGS(nr_blocks)), + iop = kzalloc(struct_size(iop, state, BITS_TO_LONGS(2 * nr_blocks)), GFP_NOFS | __GFP_NOFAIL); - spin_lock_init(&iop->uptodate_lock); + spin_lock_init(&iop->state_lock); if (PageUptodate(page)) - bitmap_fill(iop->uptodate, nr_blocks); + bitmap_set(iop->state, 0, nr_blocks); + if (PageDirty(page)) + bitmap_set(iop->state, nr_blocks, nr_blocks); attach_page_private(page, iop); return iop; } @@ -78,7 +80,7 @@ iomap_page_release(struct page *page) return; WARN_ON_ONCE(atomic_read(&iop->read_bytes_pending)); WARN_ON_ONCE(atomic_read(&iop->write_bytes_pending)); - WARN_ON_ONCE(bitmap_full(iop->uptodate, nr_blocks) != + WARN_ON_ONCE(bitmap_full(iop->state, nr_blocks) != PageUptodate(page)); kfree(iop); } @@ -109,7 +111,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* move forward for each leading block marked uptodate */ for (i = first; i <= last; i++) { - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) break; *pos += block_size; poff += block_size; @@ -119,7 +121,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* truncate len if we find any trailing uptodate block(s) */ for ( ; i <= last; i++) { - if (test_bit(i, iop->uptodate)) { + if (test_bit(i, iop->state)) { plen -= (last - i + 1) * block_size; last = i - 1; break; @@ -143,6 +145,53 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, *lenp = plen; } +static void +iomap_set_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (len) + iomap_set_page_dirty(page); + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + +static void +iomap_clear_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_clear(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + static void iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) { @@ -152,11 +201,11 @@ iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) unsigned last = (off + len - 1) >> inode->i_blkbits; unsigned long flags; - spin_lock_irqsave(&iop->uptodate_lock, flags); - bitmap_set(iop->uptodate, first, last - first + 1); - if (bitmap_full(iop->uptodate, i_blocks_per_page(inode, page))) + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first, last - first + 1); + if (bitmap_full(iop->state, i_blocks_per_page(inode, page))) SetPageUptodate(page); - spin_unlock_irqrestore(&iop->uptodate_lock, flags); + spin_unlock_irqrestore(&iop->state_lock, flags); } static void @@ -451,7 +500,7 @@ iomap_is_partially_uptodate(struct page *page, unsigned long from, if (iop) { for (i = first; i <= last; i++) - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) return 0; return 1; } @@ -708,7 +757,7 @@ static size_t __iomap_write_end(struct inode *inode, loff_t pos, size_t len, if (unlikely(copied < len && !PageUptodate(page))) return 0; iomap_set_range_uptodate(page, offset_in_page(pos), len); - iomap_set_page_dirty(page); + iomap_set_range_dirty(page, offset_in_page(pos), len); return copied; } @@ -1407,6 +1456,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, { struct iomap_page *iop = iomap_page_create(inode, page); struct iomap_ioend *ioend, *next; + unsigned int nr_blocks = i_blocks_per_page(inode, page); unsigned len = i_blocksize(inode); u64 file_offset; /* file offset of page */ int error = 0, count = 0, i; @@ -1422,7 +1472,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, for (i = 0, file_offset = page_offset(page); i < (PAGE_SIZE >> inode->i_blkbits) && file_offset < end_offset; i++, file_offset += len) { - if (iop && !test_bit(i, iop->uptodate)) + if (iop && !test_bit(i + nr_blocks, iop->state)) continue; error = wpc->ops->map_blocks(wpc, inode, file_offset); @@ -1465,6 +1515,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, } } + iomap_clear_range_dirty(page, 0, PAGE_SIZE); set_page_writeback(page); unlock_page(page); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v3 0/6] CVE-2023-52595
by Pu Lehui 18 Mar '24

18 Mar '24

Pu Lehui (1): rt2x00: Fix kabi breakage in struct rt2x00lib_ops Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800soc.c | 5 ++ .../net/wireless/ralink/rt2x00/rt2800usb.c | 5 ++ drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 30 ++++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 94 insertions(+), 17 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-22.03-LTS-SP1 00/29] fix CVE-2023-20569
by Jialin Zhang 18 Mar '24

18 Mar '24

New architectural features and CPUID bits related to the Speculative Return Stack Overflow (SRSO) vulnerability. Arnaldo Carvalho de Melo (2): tools headers cpufeatures: Sync with the kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources Borislav Petkov (AMD) (9): x86/bugs: Increase the x86 bugs vector size to two u32s x86/srso: Add a Speculative RAS Overflow mitigation x86/srso: Add IBPB_BRTYPE support x86/srso: Add SRSO_NO support x86/srso: Add IBPB x86/srso: Add IBPB on VMEXIT x86/srso: Tie SBPB bit setting to microcode patch detection x86/srso: Disable the mitigation on unaffected configurations x86/srso: Correct the mitigation status when SMT is disabled Christophe Leroy (1): objtool: Fix SEGFAULT Jialin Zhang (1): x86/cpufeatures: Fix abi breakage caused by NCAPINTS in cpufeature header file. Josh Poimboeuf (2): x86/srso: Fix return thunks in generated code objtool: Add frame-pointer-specific function ignore Kim Phillips (1): x86/cpu, kvm: Add support for CPUID_80000021_EAX Nick Desaulniers (1): x86/srso: Fix build breakage with the LLVM linker Nikolay Borisov (1): kabi: Allow extra bugsints (bsc#1213927). Peter Zijlstra (10): x86/ibt: Add ANNOTATE_NOENDBR x86/cpu: Fix __x86_return_thunk symbol type x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() x86/alternative: Make custom return thunk unconditional x86/cpu: Clean up SRSO return thunk mess x86/cpu: Rename original retbleed methods x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 x86/cpu: Cleanup the untrain mess objtool/x86: Fixup frame-pointer vs rethunk objtool/x86: Fix SRSO mess Sean Christopherson (1): x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() Documentation/admin-guide/hw-vuln/index.rst | 1 + Documentation/admin-guide/hw-vuln/srso.rst | 133 ++++++++++++ .../admin-guide/kernel-parameters.txt | 11 + arch/x86/Kconfig | 7 + arch/x86/include/asm/cpufeature.h | 23 +- arch/x86/include/asm/cpufeatures.h | 15 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/nospec-branch.h | 34 ++- arch/x86/include/asm/processor.h | 7 +- arch/x86/kernel/alternative.c | 2 +- arch/x86/kernel/cpu/amd.c | 19 ++ arch/x86/kernel/cpu/bugs.c | 197 ++++++++++++++++++ arch/x86/kernel/cpu/common.c | 17 +- arch/x86/kernel/cpu/mkcapflags.sh | 2 +- arch/x86/kernel/cpu/proc.c | 2 +- arch/x86/kernel/cpu/scattered.c | 3 + arch/x86/kernel/vmlinux.lds.S | 38 +++- arch/x86/kvm/cpuid.c | 7 + arch/x86/kvm/cpuid.h | 14 ++ arch/x86/kvm/svm/svm.c | 4 +- arch/x86/kvm/svm/vmenter.S | 3 + arch/x86/lib/retpoline.S | 135 ++++++++++-- drivers/base/cpu.c | 8 + include/linux/cpu.h | 2 + include/linux/objtool.h | 28 +++ tools/arch/x86/include/asm/cpufeatures.h | 16 +- tools/arch/x86/include/asm/msr-index.h | 1 + tools/include/linux/objtool.h | 28 +++ tools/objtool/arch.h | 1 + tools/objtool/arch/x86/decode.c | 6 + tools/objtool/check.c | 43 +++- tools/objtool/elf.h | 1 + .../perf/trace/beauty/tracepoints/x86_msr.sh | 2 +- 33 files changed, 759 insertions(+), 52 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/srso.rst -- 2.25.1

2 30

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99JF1 CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..82d6e9e8bddf 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 2c9493011aec..72dae2623f05 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2917,6 +2917,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 0ce17ea8fa8a..23e51992c964 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2902,6 +2902,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 0ce17ea8fa8a..23e51992c964 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2902,6 +2902,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 27 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 32 +++++++++++++------ 3 files changed, 44 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index c7df8aad6613..f376e87e0768 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -215,6 +215,7 @@ struct dpu_encoder_irq { * @hw_pp: Hardware interface to the ping pong registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -246,13 +247,14 @@ struct dpu_encoder_phys { struct dpu_hw_pingpong *hw_pp; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; enum dpu_rm_topology_name topology_name; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 3084675ed425..ec88fafc9cb3 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -316,7 +316,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -332,13 +333,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -361,7 +370,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -846,6 +855,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -887,7 +899,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index c9962a36b86b..7173169d2f3b 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -445,9 +445,11 @@ static int dpu_encoder_phys_vid_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); vid_enc = to_dpu_encoder_phys_vid(phys_enc); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; + /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) goto end; @@ -458,16 +460,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -742,7 +752,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), vid_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -877,6 +887,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(vid_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -904,7 +917,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH OLK-5.10] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v5.10.210 commit 2037cb9d95f1741885f7daf50e8a028c4ade5317 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index a9c078fc2302..cb31ea51a54d 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2928,6 +2928,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH OLK-5.10 V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 27 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 31 +++++++++++++------ 3 files changed, 43 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index f8f25157f635..f32a05355e78 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -194,6 +194,7 @@ struct dpu_encoder_irq { * @hw_intf: Hardware interface to the intf registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -223,12 +224,13 @@ struct dpu_encoder_phys { struct dpu_hw_intf *hw_intf; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 8493d68ad841..ce8a4db87180 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -263,7 +263,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -279,13 +280,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -301,7 +310,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, { trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -724,6 +733,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = p->dpu_kms->hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -765,7 +777,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index 805e059b50b7..17da19ccc692 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -395,7 +395,8 @@ static int dpu_encoder_phys_vid_control_vblank_irq( int ret = 0; int refcount; - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) @@ -407,16 +408,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -631,7 +640,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -700,6 +709,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(phys_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -727,7 +739,6 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v4.19.307 commit e3e95c6850661c77e6dab079d9b5374a618ebb15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNQ CVE: CVE-2023-52604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9862ec7ac1cbc6eb5ee4a045b5d5b8edbb2f7e68 ] Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot. Reported-by: syzbot+39ba34a099ac2e9bd3cb(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=39ba34a099ac2e9bd3cb Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index a5b51c2c5e32..8f856e0a85a6 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -2908,6 +2908,9 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) /* is the current value the same as the old value ? if so, * there is nothing to do. */ + if (WARN_ON_ONCE(lp >= CTLTREESIZE)) + return; + if (tp->dmt_stree[lp] == newval) return; -- 2.39.2

2 1

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96S0P CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..82d6e9e8bddf 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 33 +++++++++++++------ 3 files changed, 46 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index c7df8aad6613..f376e87e0768 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -215,6 +215,7 @@ struct dpu_encoder_irq { * @hw_pp: Hardware interface to the ping pong registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -246,13 +247,14 @@ struct dpu_encoder_phys { struct dpu_hw_pingpong *hw_pp; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; enum dpu_rm_topology_name topology_name; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 3084675ed425..b53a566f1ffc 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -316,7 +316,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -332,13 +333,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -361,7 +370,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -846,6 +855,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -887,7 +899,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index c9962a36b86b..27d283dd97aa 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -445,9 +445,11 @@ static int dpu_encoder_phys_vid_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); vid_enc = to_dpu_encoder_phys_vid(phys_enc); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; + /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) goto end; @@ -458,16 +460,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -742,7 +752,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), vid_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -877,6 +887,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(vid_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -904,7 +917,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH OLK-5.10 V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 32 +++++++++++++------ 3 files changed, 45 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index f8f25157f635..f32a05355e78 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -194,6 +194,7 @@ struct dpu_encoder_irq { * @hw_intf: Hardware interface to the intf registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -223,12 +224,13 @@ struct dpu_encoder_phys { struct dpu_hw_intf *hw_intf; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 8493d68ad841..cad7f5686dc0 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -263,7 +263,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -279,13 +280,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -301,7 +310,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, { trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -724,6 +733,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = p->dpu_kms->hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -765,7 +777,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index 805e059b50b7..3aaaf58e798b 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -395,7 +395,8 @@ static int dpu_encoder_phys_vid_control_vblank_irq( int ret = 0; int refcount; - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) @@ -407,16 +408,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -631,7 +640,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -700,6 +709,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(phys_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -727,7 +739,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: 189679 CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..82d6e9e8bddf 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (sizeof(struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH OLK-5.10 V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 32 +++++++++++++------ 3 files changed, 45 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index f8f25157f635..f32a05355e78 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -194,6 +194,7 @@ struct dpu_encoder_irq { * @hw_intf: Hardware interface to the intf registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -223,12 +224,13 @@ struct dpu_encoder_phys { struct dpu_hw_intf *hw_intf; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 8493d68ad841..cad7f5686dc0 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -263,7 +263,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -279,13 +280,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -301,7 +310,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, { trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -724,6 +733,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = p->dpu_kms->hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -765,7 +777,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index 805e059b50b7..3aaaf58e798b 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -395,7 +395,8 @@ static int dpu_encoder_phys_vid_control_vblank_irq( int ret = 0; int refcount; - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) @@ -407,16 +408,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -631,7 +640,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -700,6 +709,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(phys_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -727,7 +739,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2 0/5] CVE-2023-52595
by Pu Lehui 18 Mar '24

18 Mar '24

Shiji Yang (1): wifi: rt2x00: restart beacon queue when hardware reset Stanislaw Gruszka (4): rt2800: do not nullify initialization vector data rt2800: add pre_reset_hw callback rt2x00: clear IV's on start to fix AP mode regression rt2x00: clear up IV's on key removal .../net/wireless/ralink/rt2x00/rt2800lib.c | 52 +++++++++++++++---- .../net/wireless/ralink/rt2x00/rt2800lib.h | 1 + .../net/wireless/ralink/rt2x00/rt2800pci.c | 1 + .../net/wireless/ralink/rt2x00/rt2800soc.c | 1 + .../net/wireless/ralink/rt2x00/rt2800usb.c | 1 + drivers/net/wireless/ralink/rt2x00/rt2x00.h | 2 + .../net/wireless/ralink/rt2x00/rt2x00dev.c | 26 +++++++--- .../net/wireless/ralink/rt2x00/rt2x00mac.c | 11 ++++ 8 files changed, 78 insertions(+), 17 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] bus: mhi: host: Add alignment check for event ring read pointer
by Cai Xinchen 18 Mar '24

18 Mar '24

From: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> mainline inclusion from mainline-v6.8-rc1 commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f category: bugfix bugzilla: 189679 CVE: CVE-2023-52494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is another risk the pointer may be not aligned. Since we are expecting event ring elements are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer could lead to multiple issues like DoS or ring buffer memory corruption. So add a alignment check for event ring read pointer. Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use") cc: stable(a)vger.kernel.org Signed-off-by: Krishna chaitanya chundru <quic_krichai(a)quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo(a)quicinc.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicin… Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> conflicts: drivers/bus/mhi/host/main.c Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/bus/mhi/host/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bus/mhi/host/main.c b/drivers/bus/mhi/host/main.c index 614dd287cb4f..a705bd78e659 100644 --- a/drivers/bus/mhi/host/main.c +++ b/drivers/bus/mhi/host/main.c @@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct mhi_controller *mhi_cntrl, static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr) { - return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len; + return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len && + !(addr & (struct mhi_tre) - 1)); } int mhi_destroy_device(struct device *dev, void *data) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 18 Mar '24

18 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AUA CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c fs/cifs/connect.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 30 ++++++++++++++++++++---------- 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 71c2dd0c7f03..f9abe37c549c 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1597,6 +1597,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 4ca6fd66df03..684dbd580a27 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1079,7 +1079,8 @@ cifs_demultiplex_thread(void *p) if (mids[i] != NULL) { mids[i]->resp_buf_size = server->pdu_size; if ((mids[i]->mid_flags & MID_WAIT_CANCELLED) && - mids[i]->mid_state == MID_RESPONSE_RECEIVED && + (mids[i]->mid_state == MID_RESPONSE_RECEIVED || + mids[i]->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid( mids[i]->resp_buf, diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index eb76f7a59e50..fa83799b3ec0 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -46,6 +46,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -561,7 +563,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -699,7 +702,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -790,6 +793,8 @@ cifs_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst) static void cifs_noop_callback(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } int @@ -912,7 +917,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, midQ[i]->mid); send_cancel(ses->server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->mid_flags |= MID_WAIT_CANCELLED; midQ[i]->callback = DeleteMidQEntry; cancelled_mid[i] = true; @@ -938,7 +944,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1118,7 +1124,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1135,7 +1142,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1254,13 +1261,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(ses->server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((ses->server->tcpStatus != CifsGood) && (ses->server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((ses->server->tcpStatus == CifsGood) || (ses->server->tcpStatus == CifsNew))) { @@ -1290,7 +1299,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1308,7 +1318,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS V1] drm/msm/dpu: Add mutex lock in control vblank irq
by Cheng Yu 18 Mar '24

18 Mar '24

From: Paloma Arellano <quic_parellan(a)quicinc.com> stable inclusion from stable-v6.7.4 commit 14f109bf74dd67e1d0469fed859c8e506b0df53f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GNY CVE: CVE-2023-52586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 45284ff733e4caf6c118aae5131eb7e7cf3eea5a ] Add a mutex lock to control vblank irq to synchronize vblank enable/disable operations happening from different threads to prevent race conditions while registering/unregistering the vblank irq callback. v4: -Removed vblank_ctl_lock from dpu_encoder_virt, so it is only a parameter of dpu_encoder_phys. -Switch from atomic refcnt to a simple int counter as mutex has now been added v3: Mistakenly did not change wording in last version. It is done now. v2: Slightly changed wording of commit message Signed-off-by: Paloma Arellano <quic_parellan(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/571854/ Link: https://lore.kernel.org/r/20231212231101.9240-2-quic_parellan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h | 4 ++- .../drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 28 +++++++++++----- .../drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 33 +++++++++++++------ 3 files changed, 46 insertions(+), 19 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h index c7df8aad6613..f376e87e0768 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys.h @@ -215,6 +215,7 @@ struct dpu_encoder_irq { * @hw_pp: Hardware interface to the ping pong registers * @dpu_kms: Pointer to the dpu_kms top level * @cached_mode: DRM mode cached at mode_set time, acted on in enable + * @vblank_ctl_lock: Vblank ctl mutex lock to protect vblank_refcount * @enabled: Whether the encoder has enabled and running a mode * @split_role: Role to play in a split-panel configuration * @intf_mode: Interface mode @@ -246,13 +247,14 @@ struct dpu_encoder_phys { struct dpu_hw_pingpong *hw_pp; struct dpu_kms *dpu_kms; struct drm_display_mode cached_mode; + struct mutex vblank_ctl_lock; enum dpu_enc_split_role split_role; enum dpu_intf_mode intf_mode; enum dpu_intf intf_idx; enum dpu_rm_topology_name topology_name; spinlock_t *enc_spinlock; enum dpu_enc_enable_state enable_state; - atomic_t vblank_refcount; + int vblank_refcount; atomic_t vsync_cnt; atomic_t underrun_cnt; atomic_t pending_ctlstart_cnt; diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c index 3084675ed425..b53a566f1ffc 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c @@ -316,7 +316,8 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_cmd_is_master(phys_enc)) @@ -332,13 +333,21 @@ static int dpu_encoder_phys_cmd_control_vblank_irq( phys_enc->hw_pp->idx - PINGPONG_0, enable ? "true" : "false", refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_RDPTR); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_RDPTR); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("vblank irq err id:%u pp:%d ret:%d, enable %s/%d\n", DRMID(phys_enc->parent), @@ -361,7 +370,7 @@ static void dpu_encoder_phys_cmd_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_cmd_irq_ctrl(DRMID(phys_enc->parent), phys_enc->hw_pp->idx - PINGPONG_0, - enable, atomic_read(&phys_enc->vblank_refcount)); + enable, phys_enc->vblank_refcount); if (enable) { dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_PINGPONG); @@ -846,6 +855,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( phys_enc->hw_mdptop = hw_mdp; phys_enc->intf_idx = p->intf_idx; + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_cmd_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -887,7 +899,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_cmd_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_cmd_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount; atomic_set(&phys_enc->pending_kickoff_cnt, 0); atomic_set(&phys_enc->pending_ctlstart_cnt, 0); atomic_set(&cmd_enc->pending_vblank_cnt, 0); diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c index c9962a36b86b..27d283dd97aa 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c @@ -445,9 +445,11 @@ static int dpu_encoder_phys_vid_control_vblank_irq( return -EINVAL; } - refcount = atomic_read(&phys_enc->vblank_refcount); vid_enc = to_dpu_encoder_phys_vid(phys_enc); + mutex_lock(&phys_enc->vblank_ctl_lock); + refcount = phys_enc->vblank_refcount; + /* Slave encoders don't report vblank */ if (!dpu_encoder_phys_vid_is_master(phys_enc)) goto end; @@ -458,16 +460,24 @@ static int dpu_encoder_phys_vid_control_vblank_irq( goto end; } - DRM_DEBUG_KMS("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, - atomic_read(&phys_enc->vblank_refcount)); + DRM_DEBUG_VBL("id:%u enable=%d/%d\n", DRMID(phys_enc->parent), enable, + refcount); - if (enable && atomic_inc_return(&phys_enc->vblank_refcount) == 1) - ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); - else if (!enable && atomic_dec_return(&phys_enc->vblank_refcount) == 0) - ret = dpu_encoder_helper_unregister_irq(phys_enc, - INTR_IDX_VSYNC); + if (enable) { + if (phys_enc->vblank_refcount == 0) + ret = dpu_encoder_helper_register_irq(phys_enc, INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount++; + } else if (!enable) { + if (phys_enc->vblank_refcount == 1) + ret = dpu_encoder_helper_unregister_irq(phys_enc, + INTR_IDX_VSYNC); + if (!ret) + phys_enc->vblank_refcount--; + } end: + mutex_unlock(&phys_enc->vblank_ctl_lock); if (ret) { DRM_ERROR("failed: id:%u intf:%d ret:%d enable:%d refcnt:%d\n", DRMID(phys_enc->parent), @@ -742,7 +752,7 @@ static void dpu_encoder_phys_vid_irq_control(struct dpu_encoder_phys *phys_enc, trace_dpu_enc_phys_vid_irq_ctrl(DRMID(phys_enc->parent), vid_enc->hw_intf->idx - INTF_0, enable, - atomic_read(&phys_enc->vblank_refcount)); + phys_enc->vblank_refcount); if (enable) { ret = dpu_encoder_phys_vid_control_vblank_irq(phys_enc, true); @@ -877,6 +887,9 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( DPU_DEBUG_VIDENC(vid_enc, "\n"); + mutex_init(&phys_enc->vblank_ctl_lock); + phys_enc->vblank_refcount = 0; + dpu_encoder_phys_vid_init_ops(&phys_enc->ops); phys_enc->parent = p->parent; phys_enc->parent_ops = p->parent_ops; @@ -904,7 +917,7 @@ struct dpu_encoder_phys *dpu_encoder_phys_vid_init( irq->intr_idx = INTR_IDX_UNDERRUN; irq->cb.func = dpu_encoder_phys_vid_underrun_irq; - atomic_set(&phys_enc->vblank_refcount, 0); + phys_enc->vblank_refcount = 0; atomic_set(&phys_enc->pending_kickoff_cnt, 0); init_waitqueue_head(&phys_enc->pending_kickoff_wq); phys_enc->enable_state = DPU_ENC_DISABLED; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 1/5] rt2800: do not nullify initialization vector data
by Pu Lehui 18 Mar '24

18 Mar '24

From: Stanislaw Gruszka <sgruszka(a)redhat.com> mainline inclusion from mainline-v5.3-rc1 commit 710e6cc1595e25378c4b9977f7a8b4ad4a72a109 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GO9 CVE: CVE-2023-52595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If we restart hw we should keep existing IV (initialization vector) otherwise HW encryption will be broken after restart. Also fix some coding style issues on the way. Signed-off-by: Stanislaw Gruszka <sgruszka(a)redhat.com> Signed-off-by: Kalle Valo <kvalo(a)codeaurora.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c index a567bc273ffc..e499789674ca 100644 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c @@ -1440,14 +1440,15 @@ static void rt2800_config_wcid_attr_cipher(struct rt2x00_dev *rt2x00dev, offset = MAC_IVEIV_ENTRY(key->hw_key_idx); - memset(&iveiv_entry, 0, sizeof(iveiv_entry)); + rt2800_register_multiread(rt2x00dev, offset, + &iveiv_entry, sizeof(iveiv_entry)); if ((crypto->cipher == CIPHER_TKIP) || (crypto->cipher == CIPHER_TKIP_NO_MIC) || (crypto->cipher == CIPHER_AES)) iveiv_entry.iv[3] |= 0x20; iveiv_entry.iv[3] |= key->keyidx << 6; rt2800_register_multiwrite(rt2x00dev, offset, - &iveiv_entry, sizeof(iveiv_entry)); + &iveiv_entry, sizeof(iveiv_entry)); } int rt2800_config_shared_key(struct rt2x00_dev *rt2x00dev, @@ -5546,13 +5547,11 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev) * ASIC will keep garbage value after boot, clear encryption keys. */ for (i = 0; i < 4; i++) - rt2800_register_write(rt2x00dev, - SHARED_KEY_MODE_ENTRY(i), 0); + rt2800_register_write(rt2x00dev, SHARED_KEY_MODE_ENTRY(i), 0); for (i = 0; i < 256; i++) { rt2800_config_wcid(rt2x00dev, NULL, i); rt2800_delete_wcid_attr(rt2x00dev, i); - rt2800_register_write(rt2x00dev, MAC_IVEIV_ENTRY(i), 0); } /* -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] nfsd: fix use-after-free due to delegation race
by Li Lingfeng 18 Mar '24

18 Mar '24

From: "J. Bruce Fields" <bfields(a)redhat.com> mainline inclusion from mainline-v5.16-rc5 commit 548ec0805c399c65ed66c6641be467f717833ab5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I99EU2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru. Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread. I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning. Cc: stable(a)vger.kernel.org Signed-off-by: J. Bruce Fields <bfields(a)redhat.com> Conflict: fs/nfsd/nfs4state.c Commit 20b7d86f29d3("nfsd: use boottime for lease expiry calculation") get cl_time by ktime_get_boottime_seconds() instead of get_seconds(). Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index c8ce128e0054..d5d40aefd0a6 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -971,6 +971,11 @@ hash_delegation_locked(struct nfs4_delegation *dp, struct nfs4_file *fp) return 0; } +static bool delegation_hashed(struct nfs4_delegation *dp) +{ + return !(list_empty(&dp->dl_perfile)); +} + static bool unhash_delegation_locked(struct nfs4_delegation *dp) { @@ -978,7 +983,7 @@ unhash_delegation_locked(struct nfs4_delegation *dp) lockdep_assert_held(&state_lock); - if (list_empty(&dp->dl_perfile)) + if (!delegation_hashed(dp)) return false; dp->dl_stid.sc_type = NFS4_CLOSED_DELEG_STID; @@ -3901,7 +3906,7 @@ static void nfsd4_cb_recall_prepare(struct nfsd4_callback *cb) * queued for a lease break. Don't queue it again. */ spin_lock(&state_lock); - if (dp->dl_time == 0) { + if (delegation_hashed(dp) && dp->dl_time == 0) { dp->dl_time = get_seconds(); list_add_tail(&dp->dl_recall_lru, &nn->del_recall_lru); } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/3] crypto: algif_aead - Only wake up when ctx->more is zero
by GUO Zihua 18 Mar '24

18 Mar '24

This patchset backports commit f3c802a1f300 ("crypto: algif_aead - Only wake up when ctx->more is zero") and following bugfixes. commit 21dfbcd1f5cb ("crypto: algif_aead - fix uninitialized ctx->init") is merged beforehand. Herbert Xu (3): crypto: algif_aead - Only wake up when ctx->more is zero crypto: af_alg - Fix regression on empty requests crypto: af_alg - Work around empty control messages without MSG_MORE crypto/af_alg.c | 22 +++++++++++++++++----- crypto/algif_aead.c | 4 ++-- crypto/algif_skcipher.c | 4 ++-- include/crypto/if_alg.h | 4 +++- 4 files changed, 24 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[openeuler:OLK-6.6 1626/4034] drivers/char/ipmi/ipmi_si_ls2k500.c:92:5: sparse: sparse: symbol 'ipmi_si_sim_setup' was not declared. Should it be static?
by kernel test robot 18 Mar '24

18 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 23534451f50070452c470859343af52684963e9d commit: 4fbeaa84ef36adce930088074f8c088e5dd780c0 [1626/4034] ipmi: add ls2k500 bmc ipmi support. config: loongarch-randconfig-r123-20240317 (https://download.01.org/0day-ci/archive/20240318/202403181245.X9tjCWvK-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240318/202403181245.X9tjCWvK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403181245.X9tjCWvK-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/char/ipmi/ipmi_si_ls2k500.c:92:5: sparse: sparse: symbol 'ipmi_si_sim_setup' was not declared. Should it be static? >> drivers/char/ipmi/ipmi_si_ls2k500.c:116:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[addressable] [assigned] addr_source_data @@ got void [noderef] __iomem * @@ drivers/char/ipmi/ipmi_si_ls2k500.c:116:29: sparse: expected void *[addressable] [assigned] addr_source_data drivers/char/ipmi/ipmi_si_ls2k500.c:116:29: sparse: got void [noderef] __iomem * >> drivers/char/ipmi/ipmi_si_ls2k500.c:148:24: sparse: sparse: symbol 'ipmi_ls2k500_platform_driver' was not declared. Should it be static? drivers/char/ipmi/ipmi_si_ls2k500.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/umh.h, include/linux/kmod.h, ...): include/linux/page-flags.h:242:46: sparse: sparse: self-comparison always evaluates to false vim +/ipmi_si_sim_setup +92 drivers/char/ipmi/ipmi_si_ls2k500.c 91 > 92 int ipmi_si_sim_setup(struct si_sm_io *io) 93 { 94 io->inputb = intf_sim_inb; 95 io->outputb = intf_sim_outb; 96 io->io_cleanup = ipmi_ls2k500_cleanup; 97 return 0; 98 } 99 100 #define platform_resource_start(dev, bar) ((dev)->resource[(bar)].start) 101 #define platform_resource_end(dev, bar) ((dev)->resource[(bar)].end) 102 static int of_ipmi_ls2k500_probe(struct platform_device *pdev) 103 { 104 int rv; 105 struct si_sm_io io; 106 void **kcs_data; 107 108 memset(&io, 0, sizeof(io)); 109 io.addr_source = SI_PLATFORM; 110 dev_info(&pdev->dev, "probing via ls2k500 platform"); 111 io.si_type = SI_KCS; 112 113 io.addr_space = IPMI_MEM_ADDR_SPACE; 114 io.io_setup = ipmi_si_sim_setup; 115 io.addr_data = pdev->resource[0].start; > 116 io.addr_source_data = ioremap(pdev->resource[0].start, 117 pdev->resource[0].end - 118 pdev->resource[0].start + 1); 119 kcs_data = dev_get_platdata(&pdev->dev); 120 event_jiffies = kcs_data[0]; 121 mscycles = kcs_data[1]; 122 io.dev = &pdev->dev; 123 io.regspacing = 4; 124 io.regsize = DEFAULT_REGSIZE; 125 io.regshift = 0; 126 io.irq = 0; 127 if (io.irq) 128 io.irq_setup = ipmi_std_irq_setup; 129 130 dev_info(&pdev->dev, "%pR regsize %d spacing %d irq %d\n", 131 &pdev->resource[0], io.regsize, io.regspacing, io.irq); 132 133 rv = ipmi_si_add_smi(&io); 134 if (rv) 135 ipmi_si_remove_by_dev(&pdev->dev); 136 137 return rv; 138 } 139 140 static int ipmi_ls2k500_remove(struct platform_device *pdev) 141 { 142 ipmi_si_remove_by_dev(&pdev->dev); 143 144 return 0; 145 } 146 147 #define LS2K500_SI_DEVICE_NAME "ipmi_ls2k500_si" > 148 struct platform_driver ipmi_ls2k500_platform_driver = { 149 .driver = { 150 .name = LS2K500_SI_DEVICE_NAME, 151 }, 152 .probe = of_ipmi_ls2k500_probe, 153 .remove = ipmi_ls2k500_remove, 154 }; 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
by GONG, Ruiqi 18 Mar '24

18 Mar '24

From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> stable inclusion from stable-v6.1.76 commit 416b10d2817c94db86829fb92ad43ce7d002c573 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96ZNC CVE: CVE-2023-52488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbf4ab821804df071c8b566d9813083125e6d97b upstream. The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is sent ($00), followed by all the FIFO data without having to resend the register address each time. In this mode, the IC doesn't increment the register address for each R/W byte. The regmap_raw_read() and regmap_raw_write() are functions which can perform IO over multiple registers. They are currently used to read/write from/to the FIFO, and although they operate correctly in this burst mode on the SPI bus, they would corrupt the regmap cache if it was not disabled manually. The reason is that when the R/W size is more than 1 byte, these functions assume that the register address is incremented and handle the cache accordingly. Convert FIFO R/W functions to use the regmap _noinc_ versions in order to remove the manual cache control which was a workaround when using the _raw_ versions. FIFO registers are properly declared as volatile so cache will not be used/updated for FIFO accesses. Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: <stable(a)vger.kernel.org> Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com> Link: https://lore.kernel.org/r/20231211171353.2901416-6-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/sc16is7xx.c Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- drivers/tty/serial/sc16is7xx.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index c681ed589303..5a08fe0df132 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -375,9 +375,7 @@ static void sc16is7xx_fifo_read(struct uart_port *port, unsigned int rxlen) const u8 line = sc16is7xx_line(port); u8 addr = (SC16IS7XX_RHR_REG << SC16IS7XX_REG_SHIFT) | line; - regcache_cache_bypass(s->regmap, true); - regmap_raw_read(s->regmap, addr, s->buf, rxlen); - regcache_cache_bypass(s->regmap, false); + regmap_noinc_read(s->regmap, addr, s->buf, rxlen); } static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) @@ -393,9 +391,7 @@ static void sc16is7xx_fifo_write(struct uart_port *port, u8 to_send) if (unlikely(!to_send)) return; - regcache_cache_bypass(s->regmap, true); - regmap_raw_write(s->regmap, addr, s->buf, to_send); - regcache_cache_bypass(s->regmap, false); + regmap_noinc_write(s->regmap, addr, s->buf, to_send); } static void sc16is7xx_port_update(struct uart_port *port, u8 reg, @@ -488,6 +484,11 @@ static bool sc16is7xx_regmap_precious(struct device *dev, unsigned int reg) return false; } +static bool sc16is7xx_regmap_noinc(struct device *dev, unsigned int reg) +{ + return reg == SC16IS7XX_RHR_REG; +} + static int sc16is7xx_set_baud(struct uart_port *port, int baud) { struct sc16is7xx_port *s = dev_get_drvdata(port->dev); @@ -1426,6 +1427,8 @@ static struct regmap_config regcfg = { .cache_type = REGCACHE_RBTREE, .volatile_reg = sc16is7xx_regmap_volatile, .precious_reg = sc16is7xx_regmap_precious, + .writeable_noinc_reg = sc16is7xx_regmap_noinc, + .readable_noinc_reg = sc16is7xx_regmap_noinc, }; #ifdef CONFIG_SERIAL_SC16IS7XX_SPI -- 2.25.1

2 1

[PATCH OLK-6.6 v2 0/2] Fix CVE-2024-26629
by Li Lingfeng 18 Mar '24

18 Mar '24

The first patch is the fix patch of CVE. The second patch is the fix patch of the first one. NeilBrown (2): nfsd: fix RELEASE_LOCKOWNER nfsd: don't take fi_lock in nfsd_break_deleg_cb() fs/nfsd/nfs4state.c | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) -- 2.31.1

2 3

[PATCH OLK-6.6 0/2] Fix CVE-2024-26629
by Li Lingfeng 18 Mar '24

18 Mar '24

The first patch is the fix patch of CVE. The second patch is the fix patch of the first one. NeilBrown (2): [Backport] nfsd: fix RELEASE_LOCKOWNER [Backport] nfsd: don't take fi_lock in nfsd_break_deleg_cb() fs/nfsd/nfs4state.c | 37 ++++++++++++++++++++----------------- 1 file changed, 20 insertions(+), 17 deletions(-) -- 2.31.1

2 3

[PATCH OLK-5.10 v2 0/4] Fix CVE-2024-26629
by Li Lingfeng 18 Mar '24

18 Mar '24

The first two patches are applied to reduce conflict. The third patch is the fix patch of CVE. The fourth patch is the fix patch of the third one. Chuck Lever (2): NFSD: Modernize nfsd4_release_lockowner() NFSD: Add documenting comment for nfsd4_release_lockowner() NeilBrown (2): nfsd: fix RELEASE_LOCKOWNER nfsd: don't take fi_lock in nfsd_break_deleg_cb() fs/nfsd/nfs4state.c | 76 ++++++++++++++++++++++++--------------------- 1 file changed, 41 insertions(+), 35 deletions(-) -- 2.31.1

2 5

[PATCH v3 OLK-6.6] iommu/iova: avoid softlockup in fq_flush_timeout
by Zhang Zekun 18 Mar '24

18 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZE0I CVE: NA -------------------------------- There is a softlockup undering cpu pressure test. ... pc : _raw_spin_unlock_irqrestore+0x14/0x78 lr : fq_flush_timeout+0x94/0x118 ... Call trace: _raw_spin_unlock_irqrestore+0x14/0x78 call_timer_fn+0x3c/0x1d0 expire_timers+0xcc/0x190 run_timer_softirq+0xfc/0x268 __do_softirq+0x128/0x3dc ____do_softirq+0x18/0x30 call_on_irq_stack+0x24/0x30 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0xc0/0xe8 el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x78/0x80 __schedule+0xf28/0x12a0 schedule+0x3c/0x108 schedule_timeout+0xa0/0x1d0 pktgen_thread_worker+0x1180/0x15d0 kthread+0x120/0x130 ret_from_fork+0x10/0x20 This is because the timer callback fq_flush_timeout may run more than 10ms, and timer may be processed continuously in the softirq so trigger softlockup. We can use work to deal with fq_ring_free for each cpu which may take long time, that to avoid triggering softlockup. Signed-off-by: Li Bin <huawei.libin(a)huawei.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/dma-iommu.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 037fcf826407..58a90521630e 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -85,6 +85,8 @@ struct iommu_dma_cookie { /* Options for dma-iommu use */ struct iommu_dma_options options; struct mutex mutex; + + struct work_struct free_iova_work; }; static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled); @@ -184,17 +186,11 @@ static void fq_flush_iotlb(struct iommu_dma_cookie *cookie) static void fq_flush_timeout(struct timer_list *t) { struct iommu_dma_cookie *cookie = from_timer(cookie, t, fq_timer); - int cpu; atomic_set(&cookie->fq_timer_on, 0); fq_flush_iotlb(cookie); - if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { - fq_ring_free(cookie, cookie->single_fq); - } else { - for_each_possible_cpu(cpu) - fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); - } + schedule_work(&cookie->free_iova_work); } static void queue_iova(struct iommu_dma_cookie *cookie, @@ -279,6 +275,7 @@ static void iommu_dma_free_fq(struct iommu_dma_cookie *cookie) return; del_timer_sync(&cookie->fq_timer); + flush_work(&cookie->free_iova_work); if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) iommu_dma_free_fq_single(cookie->single_fq); else @@ -330,6 +327,20 @@ static int iommu_dma_init_fq_percpu(struct iommu_dma_cookie *cookie) return 0; } +static void free_iova_work_func(struct work_struct *work) +{ + struct iommu_dma_cookie *cookie = container_of(work, struct iommu_dma_cookie, free_iova_work); + int cpu; + + if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { + fq_ring_free(cookie, cookie->single_fq); + } else { + for_each_possible_cpu(cpu) + fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); + } + +} + /* sysfs updates are serialised by the mutex of the group owning @domain */ int iommu_dma_init_fq(struct iommu_domain *domain) { @@ -352,6 +363,7 @@ int iommu_dma_init_fq(struct iommu_domain *domain) return -ENOMEM; } + INIT_WORK(&cookie->free_iova_work, free_iova_work_func); timer_setup(&cookie->fq_timer, fq_flush_timeout, 0); atomic_set(&cookie->fq_timer_on, 0); /* -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] printk: avoid deadlock in panic
by Ye Weihua 18 Mar '24

18 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 06a14c5f9e7d ("printk: Drop console_sem during panic") Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f52eceb3c48a..11ebe66c473a 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2426,7 +2426,7 @@ void console_unlock(void) static char text[LOG_LINE_MAX + PREFIX_MAX]; static int panic_console_dropped; unsigned long flags; - bool do_cond_resched, retry; + bool do_cond_resched, retry, locked = false; if (console_suspended) { up_console_sem(); @@ -2469,6 +2469,7 @@ void console_unlock(void) printk_safe_enter_irqsave(flags); raw_spin_lock(&logbuf_lock); + locked = true; if (console_seq < log_first_seq) { len = snprintf(text, sizeof(text), "** %llu printk messages dropped **\n", @@ -2520,6 +2521,7 @@ void console_unlock(void) } console_idx = log_next(console_idx); console_seq++; + locked = false; raw_spin_unlock(&logbuf_lock); /* @@ -2539,19 +2541,20 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } console_locked = 0; - raw_spin_unlock(&logbuf_lock); + if (likely(locked)) + raw_spin_unlock(&logbuf_lock); up_console_sem(); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Add Huawei Intelligent Network Card Driver: hinic3
by Zhou Shuai 18 Mar '24

18 Mar '24

Update hinic3 driver, the NIC driver supports the following features: Supports IPv4/IPv6 TCP/UDP checksum offload, TSO/LRO/RSS. Supports interrupt aggregation parameter configuration and interrupt adaptation. Supports 802.1Q VLAN (Virtual Local Area Network) offloading and filtering. Supports NIC SR-IOV (Single Root I/O Virtualization). Loopback testing is supported. Support port lighting. Support Ethernet mouth self-negotiation, support pause frame. Zhou Shuai (1): net/hinic3: add huawei/hinic3 driver Documentation/networking/hinic3.rst | 128 + MAINTAINERS | 7 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hinic3/Kconfig | 13 + drivers/net/ethernet/huawei/hinic3/Makefile | 45 + .../ethernet/huawei/hinic3/cfg_mgt_comm_pub.h | 212 ++ .../ethernet/huawei/hinic3/comm_cmdq_intf.h | 239 ++ .../net/ethernet/huawei/hinic3/comm_defs.h | 100 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 664 +++++ .../ethernet/huawei/hinic3/hinic3_comm_cmd.h | 185 ++ .../ethernet/huawei/hinic3/hinic3_common.h | 118 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 1162 +++++++++ .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 983 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.c | 405 ++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.h | 78 + .../ethernet/huawei/hinic3/hinic3_ethtool.c | 1332 ++++++++++ .../huawei/hinic3/hinic3_ethtool_stats.c | 1259 ++++++++++ .../ethernet/huawei/hinic3/hinic3_filter.c | 483 ++++ .../net/ethernet/huawei/hinic3/hinic3_hw.h | 828 +++++++ .../net/ethernet/huawei/hinic3/hinic3_irq.c | 189 ++ .../net/ethernet/huawei/hinic3/hinic3_lld.h | 205 ++ .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 953 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_main.c | 1115 +++++++++ .../huawei/hinic3/hinic3_mgmt_interface.h | 1209 ++++++++++ .../net/ethernet/huawei/hinic3/hinic3_mt.h | 681 ++++++ .../huawei/hinic3/hinic3_netdev_ops.c | 1945 +++++++++++++++ .../net/ethernet/huawei/hinic3/hinic3_nic.h | 183 ++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.c | 1608 +++++++++++++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 620 +++++ .../huawei/hinic3/hinic3_nic_cfg_vf.c | 637 +++++ .../ethernet/huawei/hinic3/hinic3_nic_cmd.h | 159 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.c | 146 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.h | 21 + .../ethernet/huawei/hinic3/hinic3_nic_dev.h | 387 +++ .../ethernet/huawei/hinic3/hinic3_nic_event.c | 580 +++++ .../ethernet/huawei/hinic3/hinic3_nic_io.c | 1121 +++++++++ .../ethernet/huawei/hinic3/hinic3_nic_io.h | 325 +++ .../ethernet/huawei/hinic3/hinic3_nic_prof.c | 47 + .../ethernet/huawei/hinic3/hinic3_nic_prof.h | 59 + .../ethernet/huawei/hinic3/hinic3_nic_qp.h | 384 +++ .../ethernet/huawei/hinic3/hinic3_ntuple.c | 904 +++++++ .../ethernet/huawei/hinic3/hinic3_profile.h | 146 ++ .../net/ethernet/huawei/hinic3/hinic3_rss.c | 971 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_rss.h | 95 + .../ethernet/huawei/hinic3/hinic3_rss_cfg.c | 384 +++ .../net/ethernet/huawei/hinic3/hinic3_rx.c | 1343 +++++++++++ .../net/ethernet/huawei/hinic3/hinic3_rx.h | 155 ++ .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 213 ++ .../net/ethernet/huawei/hinic3/hinic3_tx.c | 1002 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_tx.h | 157 ++ .../net/ethernet/huawei/hinic3/hinic3_wq.h | 130 + .../huawei/hinic3/hw/hinic3_api_cmd.c | 1210 ++++++++++ .../huawei/hinic3/hw/hinic3_api_cmd.h | 286 +++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 1540 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 204 ++ .../ethernet/huawei/hinic3/hw/hinic3_common.c | 93 + .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 187 ++ .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 802 +++++++ .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 105 + .../huawei/hinic3/hw/hinic3_devlink.c | 392 +++ .../huawei/hinic3/hw/hinic3_devlink.h | 149 ++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 1379 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.h | 164 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.c | 453 ++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.h | 141 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 1480 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 332 +++ .../huawei/hinic3/hw/hinic3_hw_comm.c | 1540 ++++++++++++ .../huawei/hinic3/hw/hinic3_hw_comm.h | 51 + .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 598 +++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.h | 49 + .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 2133 +++++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 175 ++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 994 ++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.h | 113 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 1383 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 1837 ++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 1512 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 179 ++ .../huawei/hinic3/hw/hinic3_nictool.c | 974 ++++++++ .../huawei/hinic3/hw/hinic3_nictool.h | 35 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 18 + .../huawei/hinic3/hw/hinic3_prof_adap.c | 44 + .../huawei/hinic3/hw/hinic3_prof_adap.h | 109 + .../ethernet/huawei/hinic3/hw/hinic3_sm_lt.h | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sml_lt.c | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.c | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.h | 35 + .../net/ethernet/huawei/hinic3/hw/hinic3_wq.c | 157 ++ .../huawei/hinic3/hw/ossl_knl_linux.c | 107 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 818 +++++++ .../ethernet/huawei/hinic3/mgmt_msg_base.h | 27 + .../net/ethernet/huawei/hinic3/nic_cfg_comm.h | 63 + drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 35 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 268 +++ 99 files changed, 49344 insertions(+) create mode 100644 Documentation/networking/hinic3.rst create mode 100644 drivers/net/ethernet/huawei/hinic3/Kconfig create mode 100644 drivers/net/ethernet/huawei/hinic3/Makefile create mode 100644 drivers/net/ethernet/huawei/hinic3/cfg_mgt_comm_pub.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_cmdq_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_msg_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_comm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_crm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_filter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_hw.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_event.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_srv_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_common.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_pci_id_tbl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/ossl_knl_linux.c create mode 100644 drivers/net/ethernet/huawei/hinic3/mag_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/mgmt_msg_base.h create mode 100644 drivers/net/ethernet/huawei/hinic3/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h -- 2.24.0

2 2

[openeuler:OLK-5.10 24826/30000] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb'
by kernel test robot 18 Mar '24

18 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: c4cd0655c0c898569c0a70162f36258fd5c50eeb [24826/30000] ub: uburma add cmd create jfc implementation. config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240318/202403180149.ZWPewByz-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240318/202403180149.ZWPewByz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403180149.ZWPewByz-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:168:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 168 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfc_event_cb +144 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfc_uobj *jfc_uobj; 147 148 if (event->element.jfc == NULL) 149 return; 150 151 jfc_uobj = (struct uburma_jfc_uobj *)event->element.jfc->jfc_cfg.jfc_context; 152 uburma_write_async_event(ctx, event->element.jfc->urma_jfc, event->event_type, 153 &jfc_uobj->async_event_list, &jfc_uobj->async_events_reported); 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 777/4034] arch/loongarch/kernel/legacy_boot.c:39:19: sparse: sparse: symbol 'liointc_domain' was not declared. Should it be static?
by kernel test robot 18 Mar '24

18 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 22a313585b0ee196eb843e8b7182402b92d12ce6 commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [777/4034] LoongArch: Old BPI compatibility config: loongarch-randconfig-r132-20240317 (https://download.01.org/0day-ci/archive/20240318/202403180017.WZB6OP2s-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240318/202403180017.WZB6OP2s-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403180017.WZB6OP2s-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/legacy_boot.c:39:19: sparse: sparse: symbol 'liointc_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:40:19: sparse: sparse: symbol 'pch_lpc_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:41:19: sparse: sparse: symbol 'pch_msi_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:42:19: sparse: sparse: symbol 'pch_pic_domain' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:45:5: sparse: sparse: symbol 'nr_io_pics' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:48:26: sparse: sparse: symbol 'liointc_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:55:26: sparse: sparse: symbol 'pchlpc_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:61:26: sparse: sparse: symbol 'eiointc_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:62:26: sparse: sparse: symbol 'pchmsi_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:63:26: sparse: sparse: symbol 'pchpic_default' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:94:6: sparse: sparse: symbol 'register_default_pic' was not declared. Should it be static? >> arch/loongarch/kernel/legacy_boot.c:341:14: sparse: sparse: symbol 'bpi_init' was not declared. Should it be static? vim +/liointc_domain +39 arch/loongarch/kernel/legacy_boot.c 37 38 struct irq_domain *cpu_domain; > 39 struct irq_domain *liointc_domain; > 40 struct irq_domain *pch_lpc_domain; > 41 struct irq_domain *pch_msi_domain[MAX_IO_PICS]; > 42 struct irq_domain *pch_pic_domain[MAX_IO_PICS]; 43 44 char arcs_cmdline[COMMAND_LINE_SIZE]; > 45 int nr_io_pics; 46 int bpi_version; 47 > 48 struct acpi_madt_lio_pic liointc_default = { 49 .address = LOONGSON_REG_BASE + 0x1400, 50 .size = 256, 51 .cascade = {2, 3}, 52 .cascade_map = {0x00FFFFFF, 0xff000000}, 53 }; 54 > 55 struct acpi_madt_lpc_pic pchlpc_default = { 56 .address = LS7A_LPC_REG_BASE, 57 .size = SZ_4K, 58 .cascade = 19, 59 }; 60 > 61 struct acpi_madt_eio_pic eiointc_default[MAX_IO_PICS]; > 62 struct acpi_madt_msi_pic pchmsi_default[MAX_IO_PICS]; > 63 struct acpi_madt_bio_pic pchpic_default[MAX_IO_PICS]; 64 65 static int 66 acpi_parse_lapic(union acpi_subtable_headers *header, const unsigned long end) 67 { 68 struct acpi_madt_local_apic *processor = NULL; 69 70 processor = (struct acpi_madt_local_apic *)header; 71 if (BAD_MADT_ENTRY(processor, end)) 72 return -EINVAL; 73 74 acpi_table_print_madt_entry(&header->common); 75 set_processor_mask(processor->id, processor->lapic_flags); 76 77 return 0; 78 } 79 80 static int bad_pch_pic(unsigned long address) 81 { 82 if (nr_io_pics >= MAX_IO_PICS) { 83 pr_warn("WARNING: Max # of I/O PCH_PICs (%d) exceeded (found %d), skipping\n", 84 MAX_IO_PICS, nr_io_pics); 85 return 1; 86 } 87 if (!address) { 88 pr_warn("WARNING: Bogus (zero) I/O PCH_PIC address found in table, skipping!\n"); 89 return 1; 90 } 91 return 0; 92 } 93 > 94 void register_default_pic(int id, u32 address, u32 irq_base) 95 { 96 int idx, entries; 97 unsigned long addr; 98 99 if (bad_pch_pic(address)) 100 return; 101 102 idx = nr_io_pics; 103 104 pchpic_default[idx].address = address; 105 if (idx) 106 pchpic_default[idx].address |= nid_to_addrbase(id) | HT1LO_OFFSET; 107 pchpic_default[idx].id = id; 108 pchpic_default[idx].version = 0; 109 pchpic_default[idx].size = 0x1000; 110 pchpic_default[idx].gsi_base = irq_base; 111 112 msi_group[nr_io_pics].pci_segment = nr_io_pics; 113 pch_group[nr_io_pics].node = msi_group[nr_io_pics].node = id; 114 115 addr = pchpic_default[idx].address; 116 /* Read INT_ID.int_num */ 117 entries = (((unsigned long)ls7a_readq(addr) >> 48) & 0xff) + 1; 118 pchmsi_default[idx].msg_address = MSI_MSG_ADDRESS; 119 pchmsi_default[idx].start = entries; 120 pchmsi_default[idx].count = MSI_MSG_DEFAULT_COUNT; 121 122 eiointc_default[idx].cascade = 3; 123 eiointc_default[idx].node = id; 124 eiointc_default[idx].node_map = 1; 125 126 if (idx) { 127 eiointc_default[idx].cascade = 0x4; 128 eiointc_default[0].node_map = 0x1DF; 129 eiointc_default[idx].node_map = 0xFE20; 130 } 131 132 acpi_pchpic[idx] = &pchpic_default[idx]; 133 acpi_pchmsi[idx] = &pchmsi_default[idx]; 134 acpi_eiointc[idx] = &eiointc_default[idx]; 135 136 nr_io_pics++; 137 } 138 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 21426/30000] net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static?
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: 050383882de382969e4fb8362235749b232cccae [21426/30000] bpf: support BPF_PROG_QUERY for progs attached to sockmap config: x86_64-randconfig-123-20240317 (https://download.01.org/0day-ci/archive/20240317/202403171747.MBuYnaps-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403171747.MBuYnaps-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403171747.MBuYnaps-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static? vim +/sock_map_prog_lookup +1501 net/core/sock_map.c 1500 > 1501 int sock_map_prog_lookup(struct bpf_map *map, struct bpf_prog ***pprog, 1502 u32 which) 1503 { 1504 struct sk_psock_progs *progs = sock_map_progs(map); 1505 1506 if (!progs) 1507 return -EOPNOTSUPP; 1508 1509 switch (which) { 1510 case BPF_SK_MSG_VERDICT: 1511 *pprog = &progs->msg_parser; 1512 break; 1513 case BPF_SK_SKB_STREAM_PARSER: 1514 *pprog = &progs->skb_parser; 1515 break; 1516 case BPF_SK_SKB_STREAM_VERDICT: 1517 *pprog = &progs->skb_verdict; 1518 break; 1519 default: 1520 return -EOPNOTSUPP; 1521 } 1522 return 0; 1523 } 1524 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24824/30000] drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb'
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: 79b60243a9ff771b76add8e16cfe55cc4f5edef2 [24824/30000] ub: uburma add cmd create jfr implementation. config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240317/202403171618.niakwAg5-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403171618.niakwAg5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403171618.niakwAg5-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfr_event_cb +156 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfs_uobj *jfs_uobj; 147 148 if (event->element.jfs == NULL) 149 return; 150 151 jfs_uobj = (struct uburma_jfs_uobj *)event->element.jfs->jfs_cfg.jfs_context; 152 uburma_write_async_event(ctx, event->element.jfs->urma_jfs, event->event_type, 153 &jfs_uobj->async_event_list, &jfs_uobj->async_events_reported); 154 } 155 > 156 void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 157 { 158 struct uburma_jfr_uobj *jfr_uobj; 159 160 if (event->element.jfr == NULL) 161 return; 162 163 jfr_uobj = (struct uburma_jfr_uobj *)event->element.jfr->jfr_cfg.jfr_context; 164 uburma_write_async_event(ctx, event->element.jfr->urma_jfr, event->event_type, 165 &jfr_uobj->async_event_list, &jfr_uobj->async_events_reported); 166 } 167 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29325/30000] drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: 6b9faa4dfe7e99b19081b54504efce5f57b7abe4 [29325/30000] powercap: intel_rapl: Introduce RAPL TPMI interface driver config: x86_64-randconfig-122-20240317 (https://download.01.org/0day-ci/archive/20240317/202403171427.1vH4xGrU-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403171427.1vH4xGrU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403171427.1vH4xGrU-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned long long [usertype] *tpmi_rapl_regs @@ got void [noderef] __iomem * @@ drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: expected unsigned long long [usertype] *tpmi_rapl_regs drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: got void [noderef] __iomem * vim +141 drivers/powercap/intel_rapl_tpmi.c 132 133 static int parse_one_domain(struct tpmi_rapl_package *trp, u32 offset) 134 { 135 u8 tpmi_domain_version; 136 enum rapl_domain_type domain_type; 137 enum tpmi_rapl_domain_type tpmi_domain_type; 138 enum tpmi_rapl_register reg_index; 139 enum rapl_domain_reg_id reg_id; 140 int tpmi_domain_size, tpmi_domain_flags; > 141 u64 *tpmi_rapl_regs = trp->base + offset; 142 u64 tpmi_domain_header = readq((void __iomem *)tpmi_rapl_regs); 143 144 /* Domain Parent bits are ignored for now */ 145 tpmi_domain_version = tpmi_domain_header & 0xff; 146 tpmi_domain_type = tpmi_domain_header >> 8 & 0xff; 147 tpmi_domain_size = tpmi_domain_header >> 16 & 0xff; 148 tpmi_domain_flags = tpmi_domain_header >> 32 & 0xffff; 149 150 if (tpmi_domain_version != TPMI_RAPL_VERSION) { 151 pr_warn(FW_BUG "Unsupported version:%d\n", tpmi_domain_version); 152 return -ENODEV; 153 } 154 155 /* Domain size: in unit of 128 Bytes */ 156 if (tpmi_domain_size != 1) { 157 pr_warn(FW_BUG "Invalid Domain size %d\n", tpmi_domain_size); 158 return -EINVAL; 159 } 160 161 /* Unit register and Energy Status register are mandatory for each domain */ 162 if (!(tpmi_domain_flags & BIT(TPMI_RAPL_REG_UNIT)) || 163 !(tpmi_domain_flags & BIT(TPMI_RAPL_REG_ENERGY_STATUS))) { 164 pr_warn(FW_BUG "Invalid Domain flag 0x%x\n", tpmi_domain_flags); 165 return -EINVAL; 166 } 167 168 switch (tpmi_domain_type) { 169 case TPMI_RAPL_DOMAIN_PACKAGE: 170 domain_type = RAPL_DOMAIN_PACKAGE; 171 break; 172 case TPMI_RAPL_DOMAIN_SYSTEM: 173 domain_type = RAPL_DOMAIN_PLATFORM; 174 break; 175 case TPMI_RAPL_DOMAIN_MEMORY: 176 domain_type = RAPL_DOMAIN_DRAM; 177 break; 178 default: 179 pr_warn(FW_BUG "Unsupported Domain type %d\n", tpmi_domain_type); 180 return -EINVAL; 181 } 182 183 if (trp->priv.regs[domain_type][RAPL_DOMAIN_REG_UNIT]) { 184 pr_warn(FW_BUG "Duplicate Domain type %d\n", tpmi_domain_type); 185 return -EINVAL; 186 } 187 188 reg_index = TPMI_RAPL_REG_HEADER; 189 while (++reg_index != TPMI_RAPL_REG_MAX) { 190 if (!(tpmi_domain_flags & BIT(reg_index))) 191 continue; 192 193 switch (reg_index) { 194 case TPMI_RAPL_REG_UNIT: 195 reg_id = RAPL_DOMAIN_REG_UNIT; 196 break; 197 case TPMI_RAPL_REG_PL1: 198 reg_id = RAPL_DOMAIN_REG_LIMIT; 199 trp->priv.limits[domain_type] |= BIT(POWER_LIMIT1); 200 break; 201 case TPMI_RAPL_REG_PL2: 202 reg_id = RAPL_DOMAIN_REG_PL2; 203 trp->priv.limits[domain_type] |= BIT(POWER_LIMIT2); 204 break; 205 case TPMI_RAPL_REG_PL4: 206 reg_id = RAPL_DOMAIN_REG_PL4; 207 trp->priv.limits[domain_type] |= BIT(POWER_LIMIT4); 208 break; 209 case TPMI_RAPL_REG_ENERGY_STATUS: 210 reg_id = RAPL_DOMAIN_REG_STATUS; 211 break; 212 case TPMI_RAPL_REG_PERF_STATUS: 213 reg_id = RAPL_DOMAIN_REG_PERF; 214 break; 215 case TPMI_RAPL_REG_POWER_INFO: 216 reg_id = RAPL_DOMAIN_REG_INFO; 217 break; 218 default: 219 continue; 220 } 221 trp->priv.regs[domain_type][reg_id] = (u64)&tpmi_rapl_regs[reg_index]; 222 } 223 224 return 0; 225 } 226 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24823/30000] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb'
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: dd9641804ad19402838975c28003465d0b42042a [24823/30000] ub: uburma add cmd create/delete jfs implementation. config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240317/202403170825.fqJgay3X-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403170825.fqJgay3X-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403170825.fqJgay3X-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfs_event_cb +144 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfs_uobj *jfs_uobj; 147 148 if (event->element.jfs == NULL) 149 return; 150 151 jfs_uobj = (struct uburma_jfs_uobj *)event->element.jfs->jfs_cfg.jfs_context; 152 uburma_write_async_event(ctx, event->element.jfs->urma_jfs, event->event_type, 153 &jfs_uobj->async_event_list, &jfs_uobj->async_events_reported); 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 8e3c931720c17228aca23307a3580b068ef80099
by kernel test robot 17 Mar '24

17 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 8e3c931720c17228aca23307a3580b068ef80099 !5268 crypto: algif_aead - fix uninitialized ctx->init Warning reports: https://lore.kernel.org/oe-kbuild-all/202403170252.zy8ebb02-lkp@intel.com Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- x86_64-randconfig-161-20240303 `-- arch-x86-kvm-vmx.c-vmx_set_msr()-warn:inconsistent-indenting elapsed time: 727m configs tested: 11 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240316 gcc arm64 randconfig-002-20240316 gcc arm64 randconfig-003-20240316 gcc arm64 randconfig-004-20240316 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19590/21873] arch/x86/kvm/vmx.c:4410 vmx_set_msr() warn: inconsistent indenting
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8e3c931720c17228aca23307a3580b068ef80099 commit: 4c9a908c6bde35918222640d774f08f825abfa3f [19590/21873] KVM: x86/speculation: Disable Fill buffer clear within guests config: x86_64-randconfig-161-20240303 (https://download.01.org/0day-ci/archive/20240317/202403170252.zy8ebb02-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403170252.zy8ebb02-lkp@intel.com/ smatch warnings: arch/x86/kvm/vmx.c:4410 vmx_set_msr() warn: inconsistent indenting vim +4410 arch/x86/kvm/vmx.c cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4224 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4225 /* 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4226 * Writes msr value into into the appropriate "register". 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4227 * Returns 0 on success, non-0 otherwise. 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4228 * Assumes vcpu_load() was already called. 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4229 */ 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4230 static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4231 { a2fa3e9f52d875 drivers/kvm/vmx.c Gregory Haskins 2007-07-27 4232 struct vcpu_vmx *vmx = to_vmx(vcpu); 26bb0981b3ff00 arch/x86/kvm/vmx.c Avi Kivity 2009-09-07 4233 struct shared_msr_entry *msr; 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4234 int ret = 0; 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4235 u32 msr_index = msr_info->index; 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4236 u64 data = msr_info->data; 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4237 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4238 switch (msr_index) { 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4239 case MSR_EFER: 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4240 ret = kvm_set_msr_common(vcpu, msr_info); 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4241 break; 16175a796d0618 arch/x86/kvm/vmx.c Avi Kivity 2009-03-23 4242 #ifdef CONFIG_X86_64 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4243 case MSR_FS_BASE: 2fb92db1ec08f3 arch/x86/kvm/vmx.c Avi Kivity 2011-04-27 4244 vmx_segment_cache_clear(vmx); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4245 vmcs_writel(GUEST_FS_BASE, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4246 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4247 case MSR_GS_BASE: 2fb92db1ec08f3 arch/x86/kvm/vmx.c Avi Kivity 2011-04-27 4248 vmx_segment_cache_clear(vmx); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4249 vmcs_writel(GUEST_GS_BASE, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4250 break; 44ea2b1758d88a arch/x86/kvm/vmx.c Avi Kivity 2009-09-06 4251 case MSR_KERNEL_GS_BASE: 678e315e78a780 arch/x86/kvm/vmx.c Sean Christopherson 2018-07-23 4252 vmx_write_guest_kernel_gs_base(vmx, data); 44ea2b1758d88a arch/x86/kvm/vmx.c Avi Kivity 2009-09-06 4253 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4254 #endif 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4255 case MSR_IA32_SYSENTER_CS: 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4256 vmcs_write32(GUEST_SYSENTER_CS, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4257 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4258 case MSR_IA32_SYSENTER_EIP: f5b42c3324494e drivers/kvm/vmx.c Avi Kivity 2007-03-06 4259 vmcs_writel(GUEST_SYSENTER_EIP, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4260 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4261 case MSR_IA32_SYSENTER_ESP: f5b42c3324494e drivers/kvm/vmx.c Avi Kivity 2007-03-06 4262 vmcs_writel(GUEST_SYSENTER_ESP, data); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4263 break; 0dd376e7099757 arch/x86/kvm/vmx.c Liu, Jinsong 2014-02-24 4264 case MSR_IA32_BNDCFGS: 691bd4340bef49 arch/x86/kvm/vmx.c Haozhong Zhang 2017-07-04 4265 if (!kvm_mpx_supported() || d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4266 (!msr_info->host_initiated && d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4267 !guest_cpuid_has(vcpu, X86_FEATURE_MPX))) 93c4adc7afedf9 arch/x86/kvm/vmx.c Paolo Bonzini 2014-03-05 4268 return 1; fd8cb433734eeb arch/x86/kvm/vmx.c Yu Zhang 2017-08-24 4269 if (is_noncanonical_address(data & PAGE_MASK, vcpu) || 4531662d1abf6c arch/x86/kvm/vmx.c Jim Mattson 2017-05-23 4270 (data & MSR_IA32_BNDCFGS_RSVD)) 93c4adc7afedf9 arch/x86/kvm/vmx.c Paolo Bonzini 2014-03-05 4271 return 1; 0dd376e7099757 arch/x86/kvm/vmx.c Liu, Jinsong 2014-02-24 4272 vmcs_write64(GUEST_BNDCFGS, data); 0dd376e7099757 arch/x86/kvm/vmx.c Liu, Jinsong 2014-02-24 4273 break; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4274 case MSR_IA32_SPEC_CTRL: d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4275 if (!msr_info->host_initiated && d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4276 !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4277 return 1; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4278 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4279 /* The STIBP bit doesn't fault even if it's not advertised */ 9f65fb29374ee3 arch/x86/kvm/vmx.c Konrad Rzeszutek Wilk 2018-05-09 4280 if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD)) d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4281 return 1; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4282 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4283 vmx->spec_ctrl = data; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4284 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4285 if (!data) d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4286 break; d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4287 d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4288 /* d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4289 * For non-nested: d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4290 * When it's written (to non-zero) for the first time, pass d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4291 * it through. d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4292 * d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4293 * For nested: d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4294 * The handling of the MSR bitmap for L2 guests is done in d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4295 * nested_vmx_merge_msr_bitmap. We should not touch the d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4296 * vmcs02.msr_bitmap here since it gets completely overwritten d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4297 * in the merging. We update the vmcs01 here for L1 as well d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4298 * since it will end up touching the MSR anyway now. d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4299 */ d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4300 vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4301 MSR_IA32_SPEC_CTRL, d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4302 MSR_TYPE_RW); d28b387fb74da9 arch/x86/kvm/vmx.c KarimAllah Ahmed 2018-02-01 4303 break; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4304 case MSR_IA32_PRED_CMD: 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4305 if (!msr_info->host_initiated && 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4306 !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4307 return 1; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4308 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4309 if (data & ~PRED_CMD_IBPB) 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4310 return 1; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4311 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4312 if (!data) 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4313 break; 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4314 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4315 wrmsrl(MSR_IA32_PRED_CMD, PRED_CMD_IBPB); 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4316 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4317 /* 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4318 * For non-nested: 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4319 * When it's written (to non-zero) for the first time, pass 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4320 * it through. 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4321 * 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4322 * For nested: 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4323 * The handling of the MSR bitmap for L2 guests is done in 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4324 * nested_vmx_merge_msr_bitmap. We should not touch the 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4325 * vmcs02.msr_bitmap here since it gets completely overwritten 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4326 * in the merging. 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4327 */ 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4328 vmx_disable_intercept_for_msr(vmx->vmcs01.msr_bitmap, MSR_IA32_PRED_CMD, 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4329 MSR_TYPE_W); 15d45071523d89 arch/x86/kvm/vmx.c Ashok Raj 2018-02-01 4330 break; 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4331 case MSR_IA32_CR_PAT: 335ce4d43d2262 arch/x86/kvm/vmx.c Paolo Bonzini 2019-09-17 4332 if (!kvm_pat_valid(data)) 4566654bb9be9e arch/x86/kvm/vmx.c Nadav Amit 2014-09-18 4333 return 1; 368d6c8df82ddf arch/x86/kvm/vmx.c Sean Christopherson 2019-09-17 4334 368d6c8df82ddf arch/x86/kvm/vmx.c Sean Christopherson 2019-09-17 4335 if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) { 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4336 vmcs_write64(GUEST_IA32_PAT, data); 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4337 vcpu->arch.pat = data; 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4338 break; 468d472f3f6510 arch/x86/kvm/vmx.c Sheng Yang 2008-10-09 4339 } 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 4340 ret = kvm_set_msr_common(vcpu, msr_info); 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4341 break; ba904635d498fe arch/x86/kvm/vmx.c Will Auld 2012-11-29 4342 case MSR_IA32_TSC_ADJUST: ba904635d498fe arch/x86/kvm/vmx.c Will Auld 2012-11-29 4343 ret = kvm_set_msr_common(vcpu, msr_info); 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4344 break; c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4345 case MSR_IA32_MCG_EXT_CTL: c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4346 if ((!msr_info->host_initiated && c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4347 !(to_vmx(vcpu)->msr_ia32_feature_control & c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4348 FEATURE_CONTROL_LMCE)) || c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4349 (data & ~MCG_EXT_CTL_LMCE_EN)) c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4350 return 1; c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4351 vcpu->arch.mcg_ext_ctl = data; c45dcc71b794b5 arch/x86/kvm/vmx.c Ashok Raj 2016-06-22 4352 break; cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4353 case MSR_IA32_FEATURE_CONTROL: 37e4c997dadf71 arch/x86/kvm/vmx.c Haozhong Zhang 2016-06-22 4354 if (!vmx_feature_control_msr_valid(vcpu, data) || 3b84080b9512bc arch/x86/kvm/vmx.c Haozhong Zhang 2016-06-22 4355 (to_vmx(vcpu)->msr_ia32_feature_control & cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4356 FEATURE_CONTROL_LOCKED && !msr_info->host_initiated)) cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4357 return 1; 3b84080b9512bc arch/x86/kvm/vmx.c Haozhong Zhang 2016-06-22 4358 vmx->msr_ia32_feature_control = data; cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4359 if (msr_info->host_initiated && data == 0) cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4360 vmx_leave_nested(vcpu); cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4361 break; cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4362 case MSR_IA32_VMX_BASIC ... MSR_IA32_VMX_VMFUNC: 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4363 if (!msr_info->host_initiated) cae501397a25dc arch/x86/kvm/vmx.c Jan Kiszka 2014-01-04 4364 return 1; /* they are read-only */ 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4365 if (!nested_vmx_allowed(vcpu)) 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4366 return 1; 62cc6b9dc61eee arch/x86/kvm/vmx.c David Matlack 2016-11-29 4367 return vmx_set_vmx_msr(vcpu, msr_index, data); 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4368 case MSR_IA32_XSS: 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4369 if (!vmx_xsaves_supported() || 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4370 (!msr_info->host_initiated && 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4371 !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) && 08aca7450c7eaf arch/x86/kvm/vmx.c Wanpeng Li 2019-09-17 4372 guest_cpuid_has(vcpu, X86_FEATURE_XSAVES)))) 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4373 return 1; 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4374 /* 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4375 * The only supported bit as of Skylake is bit 8, but 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4376 * it is not supported on KVM. 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4377 */ 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4378 if (data != 0) 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4379 return 1; 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4380 vcpu->arch.ia32_xss = data; 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4381 if (vcpu->arch.ia32_xss != host_xss) 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4382 add_atomic_switch_msr(vmx, MSR_IA32_XSS, 989e3992d2eca3 arch/x86/kvm/vmx.c Konrad Rzeszutek Wilk 2018-06-20 4383 vcpu->arch.ia32_xss, host_xss, false); 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4384 else 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4385 clear_atomic_switch_msr(vmx, MSR_IA32_XSS); 203000993de509 arch/x86/kvm/vmx.c Wanpeng Li 2014-12-02 4386 break; 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4387 case MSR_TSC_AUX: d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4388 if (!msr_info->host_initiated && d6321d493319bf arch/x86/kvm/vmx.c Radim Krčmář 2017-08-05 4389 !guest_cpuid_has(vcpu, X86_FEATURE_RDTSCP)) 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4390 return 1; 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4391 /* Check reserved bit, higher 32 bits should be zero */ 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4392 if ((data >> 32) != 0) 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4393 return 1; 4e47c7a6d714cf arch/x86/kvm/vmx.c Sheng Yang 2009-12-18 4394 /* Otherwise falls through */ 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4395 default: 8b9cf98cc7ea73 drivers/kvm/vmx.c Rusty Russell 2007-07-30 4396 msr = find_msr_entry(vmx, msr_index); 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4397 if (msr) { 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4398 u64 old_msr_data = msr->data; 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4399 msr->data = data; 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4400 if (msr - vmx->guest_msrs < vmx->save_nmsrs) { 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4401 preempt_disable(); 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4402 ret = kvm_set_shared_msr(msr->index, msr->data, 9ee73970c03edb arch/x86/kvm/vmx.c Avi Kivity 2012-03-06 4403 msr->mask); 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4404 preempt_enable(); 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4405 if (ret) 8b3c3104c3f4f7 arch/x86/kvm/vmx.c Andy Honig 2014-08-27 4406 msr->data = old_msr_data; 2225fd56049643 arch/x86/kvm/vmx.c Avi Kivity 2012-04-18 4407 } 3bab1f5dda3443 drivers/kvm/vmx.c Avi Kivity 2006-12-29 4408 break; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4409 } 8fe8ab46be06fc arch/x86/kvm/vmx.c Will Auld 2012-11-29 @4410 ret = kvm_set_msr_common(vcpu, msr_info); 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4411 } 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4412 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4413 /* FB_CLEAR may have changed, also update the FB_CLEAR_DIS behavior */ 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4414 if (msr_index == MSR_IA32_ARCH_CAPABILITIES) 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4415 vmx_update_fb_clear_dis(vcpu, vmx); 4c9a908c6bde35 arch/x86/kvm/vmx.c Pawan Gupta 2022-07-06 4416 2cc51560aed0ed drivers/kvm/vmx.c Eddie Dong 2007-05-21 4417 return ret; 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4418 } 6aa8b732ca01c3 drivers/kvm/vmx.c Avi Kivity 2006-12-10 4419 :::::: The code at line 4410 was first introduced by commit :::::: 8fe8ab46be06fcd9abfe6fe9928fd95b54ab079a KVM: x86: Add code to track call origin for msr assignment :::::: TO: Will Auld <will.auld.intel(a)gmail.com> :::::: CC: Marcelo Tosatti <mtosatti(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 28517/30000] drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:7: warning: variable 'autoneg_changed' set but not used
by kernel test robot 17 Mar '24

17 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: a0c5bfdbc099daf30cbadb9657803f0cb3f89d0b [28517/30000] drivers: support for rnpm drivers from Mucse Technology N10/N400 config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240317/202403170117.xHb5kcbx-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240317/202403170117.xHb5kcbx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403170117.xHb5kcbx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:7: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:32: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2029:6: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2029 | u32 dma_ch; | ^ 3 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1003:6: warning: no previous prototype for function 'rnpm_setup_layer2_remapping' [-Wmissing-prototypes] 1003 | void rnpm_setup_layer2_remapping(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1003:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1003 | void rnpm_setup_layer2_remapping(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1027:6: warning: no previous prototype for function 'rnpm_setup_tuple5_remapping' [-Wmissing-prototypes] 1027 | void rnpm_setup_tuple5_remapping(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1027:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1027 | void rnpm_setup_tuple5_remapping(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1098:6: warning: no previous prototype for function 'rnpm_setup_tuple5_remapping_tcam' [-Wmissing-prototypes] 1098 | void rnpm_setup_tuple5_remapping_tcam(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1098:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1098 | void rnpm_setup_tuple5_remapping_tcam(struct rnpm_hw *hw, | ^ | static 3 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:6: warning: no previous prototype for function 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:5: warning: no previous prototype for function 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1957:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1957 | bool xdp_xmit = false; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:6: warning: no previous prototype for function 'rnpm_write_eitr' [-Wmissing-prototypes] 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:6: warning: variable 'packets' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2387:7: note: uninitialized use occurs here 2387 | if (!packets) | ^~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:2: note: remove the 'if' if its condition is always true 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 2382 | 2383 | packets = ring_container->total_packets; drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2374:37: note: initialize the variable 'packets' to silence this warning 2374 | unsigned int avg_wire_size, packets, bytes; | ^ | = 0 >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:6: warning: no previous prototype for function 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:6: warning: no previous prototype for function 'control_mac_rx' [-Wmissing-prototypes] 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:6: warning: no previous prototype for function 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:6: warning: no previous prototype for function 'rnpm_service_timer' [-Wmissing-prototypes] 5707 | void rnpm_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5707 | void rnpm_service_timer(struct timer_list *t) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:21: warning: no previous prototype for function 'wait_all_port_resetting' [-Wmissing-prototypes] 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:21: warning: no previous prototype for function 'clean_all_port_resetting' [-Wmissing-prototypes] 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6077:5: warning: no previous prototype for function 'rnpm_check_mc_addr' [-Wmissing-prototypes] 6077 | int rnpm_check_mc_addr(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6077:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6077 | int rnpm_check_mc_addr(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6103:6: warning: no previous prototype for function 'update_pf_vlan' [-Wmissing-prototypes] 6103 | void update_pf_vlan(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6103:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6103 | void update_pf_vlan(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6158:6: warning: no previous prototype for function 'rnpm_pf_service_task' [-Wmissing-prototypes] 6158 | void rnpm_pf_service_task(struct work_struct *work) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6158:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6158 | void rnpm_pf_service_task(struct work_struct *work) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7339:6: warning: no previous prototype for function 'rnpm_clear_udp_tunnel_port' [-Wmissing-prototypes] 7339 | void rnpm_clear_udp_tunnel_port(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7339:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 7339 | void rnpm_clear_udp_tunnel_port(struct rnpm_adapter *adapter) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7486:6: warning: no previous prototype for function 'rnpm_assign_netdev_ops' [-Wmissing-prototypes] 7486 | void rnpm_assign_netdev_ops(struct net_device *dev) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7486:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 7486 | void rnpm_assign_netdev_ops(struct net_device *dev) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7575:6: warning: no previous prototype for function 'rnpm_fix_queue_number' [-Wmissing-prototypes] 7575 | void rnpm_fix_queue_number(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7575:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 7575 | void rnpm_fix_queue_number(struct rnpm_hw *hw) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8443:5: warning: no previous prototype for function 'rnpm_can_rpu_start' [-Wmissing-prototypes] 8443 | int rnpm_can_rpu_start(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8443:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 8443 | int rnpm_can_rpu_start(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8762:18: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 8762 | struct rnpm_hw *hw; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:307:20: warning: unused function 'rnpm_irq_rearm_queues' [-Wunused-function] 307 | static inline void rnpm_irq_rearm_queues(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7516:29: warning: unused function 'rnpm_tso_features' [-Wunused-function] 7516 | static inline unsigned long rnpm_tso_features(void) | ^~~~~~~~~~~~~~~~~ 23 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:5: warning: no previous prototype for function 'rnpm_reset_pipeline_n10' [-Wmissing-prototypes] 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:503:6: warning: variable 'status' set but not used [-Wunused-but-set-variable] 503 | s32 status = 0; | ^ 2 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:24: warning: no previous prototype for function 'mbx_cookie_zalloc' [-Wmissing-prototypes] 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:5: warning: no previous prototype for function 'rnpm_mbx_write_posted_locked' [-Wmissing-prototypes] 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:6: warning: no previous prototype for function 'rnpm_link_stat_mark_disable' [-Wmissing-prototypes] 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:5: warning: no previous prototype for function 'rnpm_mbx_fw_post_req' [-Wmissing-prototypes] 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:5: warning: no previous prototype for function 'rnpm_fw_send_cmd_wait' [-Wmissing-prototypes] 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:5: warning: no previous prototype for function 'rnpm_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:5: warning: no previous prototype for function 'rnpm_mbx_pluginout_evt_en' [-Wmissing-prototypes] 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:5: warning: no previous prototype for function 'rnpm_fw_get_capablity' [-Wmissing-prototypes] 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1153:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1153 | int err; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1188:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1188 | int value; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:5: warning: no previous prototype for function 'rnpm_fw_reg_read' [-Wmissing-prototypes] 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1255:18: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 1255 | struct rnpm_hw *hw; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:5: warning: no previous prototype for function 'rnpm_get_port_stats2' [-Wmissing-prototypes] 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ | static >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1528:9: warning: variable 'err' is uninitialized when used here [-Wuninitialized] 1528 | return err ? -err : 0; | ^~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1509:9: note: initialize the variable 'err' to silence this warning 1509 | int err; | ^ | = 0 14 warnings generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:5: warning: no previous prototype for function 'rnpm_mbx_get_pn_sn' [-Wmissing-prototypes] 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ | static 1 warning generated. -- >> drivers/net/ethernet/mucse/rnpm/rnpm_ptp.c:91:6: warning: variable 'target' set but not used [-Wunused-but-set-variable] 91 | u32 target; | ^ >> drivers/net/ethernet/mucse/rnpm/rnpm_ptp.c:314:5: warning: no previous prototype for function 'rnpm_ptp_setup_ptp' [-Wmissing-prototypes] 314 | int rnpm_ptp_setup_ptp(struct rnpm_adapter *pf, u32 value) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ptp.c:314:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 314 | int rnpm_ptp_setup_ptp(struct rnpm_adapter *pf, u32 value) | ^ | static 2 warnings generated. .. vim +/autoneg_changed +1232 drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c 1217 1218 /** 1219 * rnpm_set_link_ksettings - Set Speed and Duplex 1220 * @netdev: network interface device structure 1221 * @ks: ethtool ksettings 1222 * 1223 * Set speed/duplex per media_types advertised/forced 1224 **/ 1225 static int rnpm_set_link_ksettings(struct net_device *netdev, 1226 const struct ethtool_link_ksettings *ks) 1227 { 1228 struct rnpm_adapter *adapter = netdev_priv(netdev); 1229 struct rnpm_hw *hw = &adapter->hw; 1230 struct ethtool_link_ksettings safe_ks; 1231 struct ethtool_link_ksettings copy_ks; > 1232 bool autoneg_changed = false, duplex_changed = false; 1233 int timeout = 50; 1234 int err = 0; 1235 u8 autoneg; 1236 u32 advertising_link_speed; 1237 1238 /* copy the ksettings to copy_ks to avoid modifying the origin */ 1239 memcpy(&copy_ks, ks, sizeof(struct ethtool_link_ksettings)); 1240 /* save autoneg out of ksettings */ 1241 autoneg = copy_ks.base.autoneg; 1242 rnpm_logd(LOG_ETHTOOL, 1243 "%s %s set link: speed=%d port=%d duplex=%d autoneg=%d ", 1244 __func__, netdev->name, copy_ks.base.speed, copy_ks.base.port, 1245 copy_ks.base.duplex, copy_ks.base.autoneg); 1246 rnpm_logd(LOG_ETHTOOL, "phy_address=%d mdix_ctrl=%d\n", 1247 copy_ks.base.phy_address, copy_ks.base.eth_tp_mdix_ctrl); 1248 /* get our own copy of the bits to check against */ 1249 memset(&safe_ks, 0, sizeof(struct ethtool_link_ksettings)); 1250 safe_ks.base.cmd = copy_ks.base.cmd; 1251 safe_ks.base.link_mode_masks_nwords = 1252 copy_ks.base.link_mode_masks_nwords; 1253 1254 if (rnpm_get_link_ksettings(netdev, &safe_ks)) { 1255 /* return err */ 1256 return 0; 1257 } 1258 1259 if (!adapter->pf_adapter->force_10g_1g_speed_ablity) { 1260 /* Checkout the media_type */ 1261 if (hw->phy.media_type != rnpm_media_type_fiber && 1262 hw->phy.media_type != rnpm_media_type_copper && 1263 hw->phy.media_type != rnpm_media_type_backplane && 1264 hw->phy.media_type != rnpm_media_type_cx4 && 1265 hw->phy.media_type != rnpm_media_type_da) 1266 return -EOPNOTSUPP; 1267 } 1268 1269 /* Get link modes supported by hardware and check against modes 1270 * requested by user. Return an error if unsupported mode was set. 1271 */ 1272 if (!bitmap_subset(copy_ks.link_modes.advertising, 1273 safe_ks.link_modes.supported, 1274 __ETHTOOL_LINK_MODE_MASK_NBITS)) 1275 return -EINVAL; 1276 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24813/30000] drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc'
by kernel test robot 16 Mar '24

16 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: ad84f0a92e3fe282d8280d8c45f8d5b8aab1a2b4 [24813/30000] ub: ubcore add event api and add jetty and event api impls to compile config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240316/202403162310.RbkbvVYd-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240316/202403162310.RbkbvVYd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403162310.RbkbvVYd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc' [-Wmissing-prototypes] 26 | int ubcore_rearm_jfc(struct ubcore_jfc *jfc, bool solicited_only) | ^~~~~~~~~~~~~~~~ vim +/ubcore_rearm_jfc +26 drivers/ub/urma/ubcore/ubcore_dp.c 25 > 26 int ubcore_rearm_jfc(struct ubcore_jfc *jfc, bool solicited_only) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] printk: avoid deadlock in panic
by Ye Weihua 16 Mar '24

16 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 7c2aff380e41 ([Backport] printk: Drop console_sem during panic) Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 87cd50ae6cd6..ffd7f90b8f02 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2609,12 +2609,12 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } -- 2.34.1

1 0

[PATCH OLK-5.10 0/3] Fix CVE-2024-26629
by Li Lingfeng 16 Mar '24

16 Mar '24

The third patch is fix patch. The first two patches are applied to reduce conflict. Chuck Lever (2): NFSD: Modernize nfsd4_release_lockowner() NFSD: Add documenting comment for nfsd4_release_lockowner() NeilBrown (1): nfsd: fix RELEASE_LOCKOWNER fs/nfsd/nfs4state.c | 65 +++++++++++++++++++++++++-------------------- 1 file changed, 36 insertions(+), 29 deletions(-) -- 2.31.1

2 4

[PATCH OLK-6.6] nfsd: fix RELEASE_LOCKOWNER
by Li Lingfeng 16 Mar '24

16 Mar '24

From: NeilBrown <neilb(a)suse.de> mainline inclusion from mainline-v6.8-rc2 commit edcf9725150e42beeca42d085149f4c88fa97afd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I98BN3 CVE: CVE-2024-26629 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep. First: harmful. As is documented in the kdoc comment for nfsd4_release_lockowner(), the test on so_count can transiently return a false positive resulting in a return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is clearly a protocol violation and with the Linux NFS client it can cause incorrect behaviour. If RELEASE_LOCKOWNER is sent while some other thread is still processing a LOCK request which failed because, at the time that request was received, the given owner held a conflicting lock, then the nfsd thread processing that LOCK request can hold a reference (conflock) to the lock owner that causes nfsd4_release_lockowner() to return an incorrect error. The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it never sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so it knows that the error is impossible. It assumes the lock owner was in fact released so it feels free to use the same lock owner identifier in some later locking request. When it does reuse a lock owner identifier for which a previous RELEASE failed, it will naturally use a lock_seqid of zero. However the server, which didn't release the lock owner, will expect a larger lock_seqid and so will respond with NFS4ERR_BAD_SEQID. So clearly it is harmful to allow a false positive, which testing so_count allows. The test is nonsense because ... well... it doesn't mean anything. so_count is the sum of three different counts. 1/ the set of states listed on so_stateids 2/ the set of active vfs locks owned by any of those states 3/ various transient counts such as for conflicting locks. When it is tested against '2' it is clear that one of these is the transient reference obtained by find_lockowner_str_locked(). It is not clear what the other one is expected to be. In practice, the count is often 2 because there is precisely one state on so_stateids. If there were more, this would fail. In my testing I see two circumstances when RELEASE_LOCKOWNER is called. In one case, CLOSE is called before RELEASE_LOCKOWNER. That results in all the lock states being removed, and so the lockowner being discarded (it is removed when there are no more references which usually happens when the lock state is discarded). When nfsd4_release_lockowner() finds that the lock owner doesn't exist, it returns success. The other case shows an so_count of '2' and precisely one state listed in so_stateid. It appears that the Linux client uses a separate lock owner for each file resulting in one lock state per lock owner, so this test on '2' is safe. For another client it might not be safe. So this patch changes check_for_locks() to use the (newish) find_any_file_locked() so that it doesn't take a reference on the nfs4_file and so never calls nfsd_file_put(), and so never sleeps. With this check is it safe to restore the use of check_for_locks() rather than testing so_count against the mysterious '2'. Fixes: ce3c4ad7f4ce ("NFSD: Fix possible sleep during nfsd4_release_lockowner()") Signed-off-by: NeilBrown <neilb(a)suse.de> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Cc: stable(a)vger.kernel.org # v6.2+ Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 529b3ed3b317..f4cccbf664ce 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -7890,14 +7890,16 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) { struct file_lock *fl; int status = false; - struct nfsd_file *nf = find_any_file(fp); + struct nfsd_file *nf; struct inode *inode; struct file_lock_context *flctx; + spin_lock(&fp->fi_lock); + nf = find_any_file_locked(fp); if (!nf) { /* Any valid lock stateid should have some sort of access */ WARN_ON_ONCE(1); - return status; + goto out; } inode = file_inode(nf->nf_file); @@ -7913,7 +7915,8 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) } spin_unlock(&flctx->flc_lock); } - nfsd_file_put(nf); +out: + spin_unlock(&fp->fi_lock); return status; } @@ -7923,10 +7926,8 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner) * @cstate: NFSv4 COMPOUND state * @u: RELEASE_LOCKOWNER arguments * - * The lockowner's so_count is bumped when a lock record is added - * or when copying a conflicting lock. The latter case is brief, - * but can lead to fleeting false positives when looking for - * locks-in-use. + * Check if theree are any locks still held and if not - free the lockowner + * and any lock state that is owned. * * Return values: * %nfs_ok: lockowner released or not found @@ -7962,10 +7963,13 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp, spin_unlock(&clp->cl_lock); return nfs_ok; } - if (atomic_read(&lo->lo_owner.so_count) != 2) { - spin_unlock(&clp->cl_lock); - nfs4_put_stateowner(&lo->lo_owner); - return nfserr_locks_held; + + list_for_each_entry(stp, &lo->lo_owner.so_stateids, st_perstateowner) { + if (check_for_locks(stp->st_stid.sc_file, lo)) { + spin_unlock(&clp->cl_lock); + nfs4_put_stateowner(&lo->lo_owner); + return nfserr_locks_held; + } } unhash_lockowner_locked(lo); while (!list_empty(&lo->lo_owner.so_stateids)) { -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] phonet/pep: refuse to enable an unbound pipe
by Dong Chenchen 16 Mar '24

16 Mar '24

From: Rémi Denis-Courmont <remi(a)remlab.net> stable inclusion from stable-v4.19.222 commit 982b6ba1ce626ef87e5c29f26f2401897554f235 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95RE9 CVE: CVE-2021-47086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 75a2f31520095600f650597c0ac41f48b5ba0068 upstream. This ioctl() implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur: 1) We'd send an pipe enablement request with an invalid source object. 2) Later socket calls could BUG on the socket unexpectedly being connected yet not bound to a valid object. Reported-by: syzbot+2dc91e7fc3dea88b1e8a(a)syzkaller.appspotmail.com Signed-off-by: Rémi Denis-Courmont <remi(a)remlab.net> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/phonet/pep.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/phonet/pep.c b/net/phonet/pep.c index 63d34e702df5..fe01cc788448 100644 --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -960,6 +960,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg) ret = -EBUSY; else if (sk->sk_state == TCP_ESTABLISHED) ret = -EISCONN; + else if (!pn->pn_sk.sobject) + ret = -EADDRNOTAVAIL; else ret = pep_sock_enable(sk, NULL, 0); release_sock(sk); -- 2.25.1

2 1

[PATCH OLK-5.10] net/smc: fix illegal rmb_desc access in SMC-D connection dump
by Dong Chenchen 16 Mar '24

16 Mar '24

From: Wen Gu <guwen(a)linux.alibaba.com> stable inclusion from stable-v5.10.209 commit 5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d category: bugfix bugzilla: 189676, https://gitee.com/src-openeuler/kernel/issues/I97NHS CVE: CVE-2024-26615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dbc153fd3c142909e564bb256da087e13fbf239c ] A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump. Fixes: 4b1b7d3b30a6 ("net/smc: add SMC-D diag support") Signed-off-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Dust Li <dust.li(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/smc/smc_diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c index 4dd4f9e694da..5fb64b66a319 100644 --- a/net/smc/smc_diag.c +++ b/net/smc/smc_diag.c @@ -164,7 +164,7 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, } if (smc->conn.lgr && smc->conn.lgr->is_smcd && (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) && - !list_empty(&smc->conn.lgr->list)) { + !list_empty(&smc->conn.lgr->list) && smc->conn.rmb_desc) { struct smc_connection *conn = &smc->conn; struct smcd_diag_dmbinfo dinfo; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/smc: fix illegal rmb_desc access in SMC-D connection dump
by Dong Chenchen 16 Mar '24

16 Mar '24

From: Wen Gu <guwen(a)linux.alibaba.com> stable inclusion from stable-v4.19.306 commit 27aea64838914c6122db5b8bd4bed865c9736f22 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NHS CVE: CVE-2024-26615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dbc153fd3c142909e564bb256da087e13fbf239c ] A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump. Fixes: 4b1b7d3b30a6 ("net/smc: add SMC-D diag support") Signed-off-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Dust Li <dust.li(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/smc/smc_diag.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/smc/smc_diag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c index dbf64a93d68a..d0b2f991a9e4 100644 --- a/net/smc/smc_diag.c +++ b/net/smc/smc_diag.c @@ -169,7 +169,7 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, } if (smc->conn.lgr && smc->conn.lgr->is_smcd && (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) && - !list_empty(&smc->conn.lgr->list)) { + !list_empty(&smc->conn.lgr->list) && smc->conn.rmb_desc) { struct smc_connection *conn = &smc->conn; struct smcd_diag_dmbinfo dinfo = { .linkid = *((u32 *)conn->lgr->id), -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] printk: avoid deadlock in panic
by Ye Weihua 16 Mar '24

16 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 06a14c5f9e7d (printk: Drop console_sem during panic) Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f52eceb3c48a..11ebe66c473a 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2426,7 +2426,7 @@ void console_unlock(void) static char text[LOG_LINE_MAX + PREFIX_MAX]; static int panic_console_dropped; unsigned long flags; - bool do_cond_resched, retry; + bool do_cond_resched, retry, locked = false; if (console_suspended) { up_console_sem(); @@ -2469,6 +2469,7 @@ void console_unlock(void) printk_safe_enter_irqsave(flags); raw_spin_lock(&logbuf_lock); + locked = true; if (console_seq < log_first_seq) { len = snprintf(text, sizeof(text), "** %llu printk messages dropped **\n", @@ -2520,6 +2521,7 @@ void console_unlock(void) } console_idx = log_next(console_idx); console_seq++; + locked = false; raw_spin_unlock(&logbuf_lock); /* @@ -2539,19 +2541,20 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } console_locked = 0; - raw_spin_unlock(&logbuf_lock); + if (likely(locked)) + raw_spin_unlock(&logbuf_lock); up_console_sem(); -- 2.34.1

2 1

[OLK-5.10 v2 PATCH] iomap: add support to track dirty state of sub pages
by Yu Kuai 16 Mar '24

16 Mar '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I93TU0 CVE: NA ------------------------------------------ commit 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads") replace the per-block structure buffer_head with the per-page structure iomap_page. However, iomap_page can't track the dirty state of sub pages, which will cause performance issue since sub pages will be writeback even if they are not dirty. For example, if block size is 4k and page size is 64k: dd if=/dev/zero of=testfile bs=4k count=16 oflag=sync With buffer_head implementation, the above dd cmd will writeback 4k in each round. However, with iomap_page implementation, the range of writeback in each round is from the start of the page to the end offset we just wrote. Thus add support to track dirty state in iomap_page. test environment: platform: arm64 pagesize: 64k blocksize: 4k test case: dd if=/dev/zero of=/mnt/testfile bs=1M count=128 fio --ioengine=sync --rw=randwrite --iodepth=64 --name=test \ --filename=/mnt/testfile --bs=4k --fsync=1 The test result is: xfs with patch: WRITE: bw=4609KiB/s (4720kB/s) xfs without patch WRITE: bw=2714KiB/s (2780kB/s) ext4: WRITE: bw=3840KiB/s (3932kB/s) Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- Changes in v2: - remove changes to iomap_page_mkwrite_actor(). fs/iomap/buffered-io.c | 83 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 67 insertions(+), 16 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index d9092aa5c3fb..25448d5827d2 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -25,13 +25,13 @@ /* * Structure allocated for each page or THP when block size < page size - * to track sub-page uptodate status and I/O completions. + * to track sub-page uptodate and dirty status and I/O completions. */ struct iomap_page { atomic_t read_bytes_pending; atomic_t write_bytes_pending; - spinlock_t uptodate_lock; - unsigned long uptodate[]; + spinlock_t state_lock; + unsigned long state[]; }; static inline struct iomap_page *to_iomap_page(struct page *page) @@ -59,11 +59,13 @@ iomap_page_create(struct inode *inode, struct page *page) if (iop || nr_blocks <= 1) return iop; - iop = kzalloc(struct_size(iop, uptodate, BITS_TO_LONGS(nr_blocks)), + iop = kzalloc(struct_size(iop, state, BITS_TO_LONGS(2 * nr_blocks)), GFP_NOFS | __GFP_NOFAIL); - spin_lock_init(&iop->uptodate_lock); + spin_lock_init(&iop->state_lock); if (PageUptodate(page)) - bitmap_fill(iop->uptodate, nr_blocks); + bitmap_set(iop->state, 0, nr_blocks); + if (PageDirty(page)) + bitmap_set(iop->state, nr_blocks, nr_blocks); attach_page_private(page, iop); return iop; } @@ -78,7 +80,7 @@ iomap_page_release(struct page *page) return; WARN_ON_ONCE(atomic_read(&iop->read_bytes_pending)); WARN_ON_ONCE(atomic_read(&iop->write_bytes_pending)); - WARN_ON_ONCE(bitmap_full(iop->uptodate, nr_blocks) != + WARN_ON_ONCE(bitmap_full(iop->state, nr_blocks) != PageUptodate(page)); kfree(iop); } @@ -109,7 +111,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* move forward for each leading block marked uptodate */ for (i = first; i <= last; i++) { - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) break; *pos += block_size; poff += block_size; @@ -119,7 +121,7 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, /* truncate len if we find any trailing uptodate block(s) */ for ( ; i <= last; i++) { - if (test_bit(i, iop->uptodate)) { + if (test_bit(i, iop->state)) { plen -= (last - i + 1) * block_size; last = i - 1; break; @@ -143,6 +145,53 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, *lenp = plen; } +static void +iomap_set_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (len) + iomap_set_page_dirty(page); + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + +static void +iomap_clear_range_dirty(struct page *page, unsigned int off, unsigned int len) +{ + struct inode *inode = page->mapping->host; + unsigned int nr_blocks = i_blocks_per_page(inode, page); + unsigned int first = off >> inode->i_blkbits; + unsigned int last = (off + len - 1) >> inode->i_blkbits; + unsigned long flags; + struct iomap_page *iop; + + if (PageError(page)) + return; + + if (!page_has_private(page)) + return; + + iop = to_iomap_page(page); + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_clear(iop->state, first + nr_blocks, last - first + 1); + spin_unlock_irqrestore(&iop->state_lock, flags); +} + static void iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) { @@ -152,11 +201,11 @@ iomap_iop_set_range_uptodate(struct page *page, unsigned off, unsigned len) unsigned last = (off + len - 1) >> inode->i_blkbits; unsigned long flags; - spin_lock_irqsave(&iop->uptodate_lock, flags); - bitmap_set(iop->uptodate, first, last - first + 1); - if (bitmap_full(iop->uptodate, i_blocks_per_page(inode, page))) + spin_lock_irqsave(&iop->state_lock, flags); + bitmap_set(iop->state, first, last - first + 1); + if (bitmap_full(iop->state, i_blocks_per_page(inode, page))) SetPageUptodate(page); - spin_unlock_irqrestore(&iop->uptodate_lock, flags); + spin_unlock_irqrestore(&iop->state_lock, flags); } static void @@ -451,7 +500,7 @@ iomap_is_partially_uptodate(struct page *page, unsigned long from, if (iop) { for (i = first; i <= last; i++) - if (!test_bit(i, iop->uptodate)) + if (!test_bit(i, iop->state)) return 0; return 1; } @@ -708,7 +757,7 @@ static size_t __iomap_write_end(struct inode *inode, loff_t pos, size_t len, if (unlikely(copied < len && !PageUptodate(page))) return 0; iomap_set_range_uptodate(page, offset_in_page(pos), len); - iomap_set_page_dirty(page); + iomap_set_range_dirty(page, offset_in_page(pos), len); return copied; } @@ -1407,6 +1456,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, { struct iomap_page *iop = iomap_page_create(inode, page); struct iomap_ioend *ioend, *next; + unsigned int nr_blocks = i_blocks_per_page(inode, page); unsigned len = i_blocksize(inode); u64 file_offset; /* file offset of page */ int error = 0, count = 0, i; @@ -1422,7 +1472,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, for (i = 0, file_offset = page_offset(page); i < (PAGE_SIZE >> inode->i_blkbits) && file_offset < end_offset; i++, file_offset += len) { - if (iop && !test_bit(i, iop->uptodate)) + if (iop && !test_bit(i + nr_blocks, iop->state)) continue; error = wpc->ops->map_blocks(wpc, inode, file_offset); @@ -1465,6 +1515,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, } } + iomap_clear_range_dirty(page, 0, PAGE_SIZE); set_page_writeback(page); unlock_page(page); -- 2.39.2

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix failure of LTP testcase af_alg05
by GUO Zihua 16 Mar '24

16 Mar '24

This patchset fixes the failure of af_alg05 cause by uninitialized crypto ctx. Herbert Xu (1): crypto: algif_aead - Only wake up when ctx->more is zero Ondrej Mosnacek (1): crypto: algif_aead - fix uninitialized ctx->init crypto/af_alg.c | 11 ++++++++--- crypto/algif_aead.c | 10 ++-------- crypto/algif_skcipher.c | 11 +++-------- include/crypto/if_alg.h | 4 +++- 4 files changed, 16 insertions(+), 20 deletions(-) -- 2.34.1

1 2

[PATCH openEuler-1.0-LTS] printk: avoid deadlock in panic
by Ye Weihua 16 Mar '24

16 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 06a14c5f9e7d (printk: Drop console_sem during panic) Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f52eceb3c48a..c164761da3ec 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2539,12 +2539,12 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } -- 2.34.1

2 1

[openeuler:OLK-5.10 24784/30000] drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap'
by kernel test robot 16 Mar '24

16 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: 7d130c6018dbfd09c6e1c5d91b347fdbf3924321 [24784/30000] ub: add mmap ops support in ubcore and uburma config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240316/202403161211.0W0M5B5E-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240316/202403161211.0W0M5B5E-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403161211.0W0M5B5E-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap' [-Wmissing-prototypes] 32 | int uburma_mmap(struct file *filp, struct vm_area_struct *vma) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c:64:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] 64 | void uburma_release_file(struct kref *ref) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c:81:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] 81 | int uburma_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: In function 'uburma_open': drivers/ub/urma/uburma/uburma_dev_ops.c:98:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] 98 | if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { | ^~ In file included from drivers/ub/urma/uburma/uburma_dev_ops.c:25: include/urma/ubcore_types.h:1589:14: note: 'dev_name' declared here 1589 | char dev_name[UBCORE_MAX_DEV_NAME]; | ^~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: At top level: drivers/ub/urma/uburma/uburma_dev_ops.c:134:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] 134 | int uburma_close(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~ vim +/uburma_mmap +32 drivers/ub/urma/uburma/uburma_dev_ops.c 31 > 32 int uburma_mmap(struct file *filp, struct vm_area_struct *vma) 33 { 34 struct uburma_file *file = filp->private_data; 35 struct uburma_device *ubu_dev; 36 struct ubcore_device *ubc_dev; 37 int srcu_idx; 38 int ret; 39 40 if (file == NULL || file->ucontext == NULL) { 41 uburma_log_err("can not find ucontext.\n"); 42 return -EINVAL; 43 } 44 45 ubu_dev = file->ubu_dev; 46 uburma_cmd_inc(ubu_dev); 47 48 srcu_idx = srcu_read_lock(&ubu_dev->ubc_dev_srcu); 49 ubc_dev = srcu_dereference(ubu_dev->ubc_dev, &ubu_dev->ubc_dev_srcu); 50 if (ubc_dev == NULL || ubc_dev->ops == NULL || ubc_dev->ops->mmap == NULL) { 51 uburma_log_err("can not find ubcore device.\n"); 52 ret = -ENODEV; 53 goto out; 54 } 55 56 ret = ubc_dev->ops->mmap(file->ucontext, vma); 57 58 out: 59 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 60 uburma_cmd_dec(ubu_dev); 61 return ret; 62 } 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] printk: avoid deadlock in panic
by Ye Weihua 16 Mar '24

16 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991OV -------------------------------- In the process of load testing against panic, a deadlock issue was discovered. The reason is that in the panic process, console_unlock doesn't handle the printk_context variable evenly, causing printk_context to overflow downwards, allowing vprintk_func to enter the nmi direct branch without disabling interrupt. Upon holding the logbuf_lock lock, an interrupt running wake_up_klogd_work_func was called, resulting in a deadlock. To avoid this issue, move printk_safe_ext_irqrestore after check abandon_console_lock_in_panic(). Fixes: 7c2aff380e41 ([Backport] printk: Drop console_sem during panic) Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/printk/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index 87cd50ae6cd6..ffd7f90b8f02 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -2609,12 +2609,12 @@ void console_unlock(void) return; } - printk_safe_exit_irqrestore(flags); - /* Allow panic_cpu to take over the consoles safely */ if (abandon_console_lock_in_panic()) break; + printk_safe_exit_irqrestore(flags); + if (do_cond_resched) cond_resched(); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto: algif_aead - fix uninitialized ctx->init
by GUO Zihua 16 Mar '24

16 Mar '24

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v5.9-rc1 commit 21dfbcd1f5cbff9cf2f9e7e43475aed8d072b0dd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I991GQ CVE: NA Reference: https://github.com/torvalds/linux/commit/21dfbcd1f5cbff9cf2f9e7e43475aed8d0… -------------------------------- In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is cleared by memset() after allocation, so add such memset() also to aead_accept_parent_nokey() so that the new "init" field is also initialized to zero. Without that the initial ctx->init checks might randomly return true and cause errors. While there, also remove the redundant zero assignments in both functions. Found via libkcapi testsuite. Cc: Stephan Mueller <smueller(a)chronox.de> Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when ctx->more is zero") Suggested-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- crypto/algif_aead.c | 6 ------ crypto/algif_skcipher.c | 7 +------ 2 files changed, 1 insertion(+), 12 deletions(-) diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c index c40a8c7ee8ae..3f20d3e4acfb 100644 --- a/crypto/algif_aead.c +++ b/crypto/algif_aead.c @@ -565,12 +565,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len = len; - ctx->used = 0; - atomic_set(&ctx->rcvused, 0); - ctx->more = 0; - ctx->merge = 0; - ctx->enc = 0; - ctx->aead_assoclen = 0; crypto_init_wait(&ctx->wait); ask->private = ctx; diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c index fe1f6b0f7c4c..94aeb8b946b0 100644 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@ -344,6 +344,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) ctx = sock_kmalloc(sk, len, GFP_KERNEL); if (!ctx) return -ENOMEM; + memset(ctx, 0, len); ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), GFP_KERNEL); @@ -351,16 +352,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) sock_kfree_s(sk, ctx, len); return -ENOMEM; } - memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); INIT_LIST_HEAD(&ctx->tsgl_list); ctx->len = len; - ctx->used = 0; - atomic_set(&ctx->rcvused, 0); - ctx->more = 0; - ctx->merge = 0; - ctx->enc = 0; crypto_init_wait(&ctx->wait); ask->private = ctx; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] llc: call sock_orphan() at release time
by Liu Jian 16 Mar '24

16 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.307 commit 6b950c712a9a05cdda4aea7fcb2848766576c11b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GXM CVE: CVE-2024-26625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit aa2b2eb3934859904c287bf5434647ba72e14c1c ] syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are missing a sock_orphan(), we need to perform a full audit. In net-next, I plan to clear sock->sk from sock_orphan() and amend Eric patch to add a warning. [1] BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline] BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline] BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 Read of size 8 at addr ffff88802f4fc880 by task ksoftirqd/1/27 CPU: 1 PID: 27 Comm: ksoftirqd/1 Not tainted 6.8.0-rc1-syzkaller-00049-g6098d87eaf31 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 list_empty include/linux/list.h:373 [inline] waitqueue_active include/linux/wait.h:127 [inline] sock_def_write_space_wfree net/core/sock.c:3384 [inline] sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080 skb_release_all net/core/skbuff.c:1092 [inline] napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404 e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline] e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x956/0xe90 net/core/dev.c:6778 __do_softirq+0x21a/0x8de kernel/softirq.c:553 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> Allocated by task 5167: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:314 [inline] __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 0: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kmem_cache_free+0x129/0x350 mm/slub.c:4363 i_callback+0x43/0x70 fs/inode.c:249 rcu_do_batch kernel/rcu/tree.c:2158 [inline] rcu_core+0x819/0x1680 kernel/rcu/tree.c:2433 __do_softirq+0x21a/0x8de kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 __kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:586 __call_rcu_common.constprop.0+0x9a/0x7b0 kernel/rcu/tree.c:2683 destroy_inode+0x129/0x1b0 fs/inode.c:315 iput_final fs/inode.c:1739 [inline] iput.part.0+0x560/0x7b0 fs/inode.c:1765 iput+0x5c/0x80 fs/inode.c:1755 dentry_unlink_inode+0x292/0x430 fs/dcache.c:400 __dentry_kill+0x1ca/0x5f0 fs/dcache.c:603 dput.part.0+0x4ac/0x9a0 fs/dcache.c:845 dput+0x1f/0x30 fs/dcache.c:835 __fput+0x3b9/0xb70 fs/file_table.c:384 task_work_run+0x14d/0x240 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa8a/0x2ad0 kernel/exit.c:871 do_group_exit+0xd4/0x2a0 kernel/exit.c:1020 __do_sys_exit_group kernel/exit.c:1031 [inline] __se_sys_exit_group kernel/exit.c:1029 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b The buggy address belongs to the object at ffff88802f4fc800 which belongs to the cache sock_inode_cache of size 1408 The buggy address is located 128 bytes inside of freed 1408-byte region [ffff88802f4fc800, ffff88802f4fcd80) The buggy address belongs to the physical page: page:ffffea0000bd3e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f4f8 head:ffffea0000bd3e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888013b06b40 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 4956, tgid 4956 (sshd), ts 31423924727, free_ts 0 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0xcc/0x3a0 mm/slub.c:2407 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3625 __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x379/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b page_owner free stack trace missing Memory state around the buggy address: ffff88802f4fc780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802f4fc800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802f4fc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802f4fc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802f4fc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 43815482370c ("net: sock_def_readable() and friends RCU conversion") Reported-and-tested-by: syzbot+32b89eaa102b372ff76d(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Eric Biggers <ebiggers(a)google.com> Cc: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240126165532.3396702-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index d23cd51efc5f..91ee9928d56f 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -219,6 +219,8 @@ static int llc_ui_release(struct socket *sock) if (llc->dev) dev_put(llc->dev); sock_put(sk); + sock_orphan(sk); + sock->sk = NULL; llc_sk_free(sk); out: return 0; -- 2.34.1

2 1

[PATCH OLK-5.10] llc: call sock_orphan() at release time
by Liu Jian 16 Mar '24

16 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit d0b5b1f12429df3cd9751ab8b2f53729b77733b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GXM CVE: CVE-2024-26625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit aa2b2eb3934859904c287bf5434647ba72e14c1c ] syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are missing a sock_orphan(), we need to perform a full audit. In net-next, I plan to clear sock->sk from sock_orphan() and amend Eric patch to add a warning. [1] BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline] BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline] BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 Read of size 8 at addr ffff88802f4fc880 by task ksoftirqd/1/27 CPU: 1 PID: 27 Comm: ksoftirqd/1 Not tainted 6.8.0-rc1-syzkaller-00049-g6098d87eaf31 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 list_empty include/linux/list.h:373 [inline] waitqueue_active include/linux/wait.h:127 [inline] sock_def_write_space_wfree net/core/sock.c:3384 [inline] sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080 skb_release_all net/core/skbuff.c:1092 [inline] napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404 e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline] e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x956/0xe90 net/core/dev.c:6778 __do_softirq+0x21a/0x8de kernel/softirq.c:553 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> Allocated by task 5167: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:314 [inline] __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 0: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kmem_cache_free+0x129/0x350 mm/slub.c:4363 i_callback+0x43/0x70 fs/inode.c:249 rcu_do_batch kernel/rcu/tree.c:2158 [inline] rcu_core+0x819/0x1680 kernel/rcu/tree.c:2433 __do_softirq+0x21a/0x8de kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 __kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:586 __call_rcu_common.constprop.0+0x9a/0x7b0 kernel/rcu/tree.c:2683 destroy_inode+0x129/0x1b0 fs/inode.c:315 iput_final fs/inode.c:1739 [inline] iput.part.0+0x560/0x7b0 fs/inode.c:1765 iput+0x5c/0x80 fs/inode.c:1755 dentry_unlink_inode+0x292/0x430 fs/dcache.c:400 __dentry_kill+0x1ca/0x5f0 fs/dcache.c:603 dput.part.0+0x4ac/0x9a0 fs/dcache.c:845 dput+0x1f/0x30 fs/dcache.c:835 __fput+0x3b9/0xb70 fs/file_table.c:384 task_work_run+0x14d/0x240 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa8a/0x2ad0 kernel/exit.c:871 do_group_exit+0xd4/0x2a0 kernel/exit.c:1020 __do_sys_exit_group kernel/exit.c:1031 [inline] __se_sys_exit_group kernel/exit.c:1029 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b The buggy address belongs to the object at ffff88802f4fc800 which belongs to the cache sock_inode_cache of size 1408 The buggy address is located 128 bytes inside of freed 1408-byte region [ffff88802f4fc800, ffff88802f4fcd80) The buggy address belongs to the physical page: page:ffffea0000bd3e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f4f8 head:ffffea0000bd3e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888013b06b40 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 4956, tgid 4956 (sshd), ts 31423924727, free_ts 0 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0xcc/0x3a0 mm/slub.c:2407 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3625 __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x379/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b page_owner free stack trace missing Memory state around the buggy address: ffff88802f4fc780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802f4fc800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802f4fc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802f4fc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802f4fc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 43815482370c ("net: sock_def_readable() and friends RCU conversion") Reported-and-tested-by: syzbot+32b89eaa102b372ff76d(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Eric Biggers <ebiggers(a)google.com> Cc: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240126165532.3396702-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index 01e26698285a..90a32864401c 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -227,6 +227,8 @@ static int llc_ui_release(struct socket *sock) if (llc->dev) dev_put(llc->dev); sock_put(sk); + sock_orphan(sk); + sock->sk = NULL; llc_sk_free(sk); out: return 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] llc: call sock_orphan() at release time
by Liu Jian 16 Mar '24

16 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.8-rc3 commit aa2b2eb3934859904c287bf5434647ba72e14c1c category: S419 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GXM CVE: CVE-2024-26625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- [ Upstream commit aa2b2eb3934859904c287bf5434647ba72e14c1c ] syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are missing a sock_orphan(), we need to perform a full audit. In net-next, I plan to clear sock->sk from sock_orphan() and amend Eric patch to add a warning. [1] BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] BUG: KASAN: slab-use-after-free in waitqueue_active include/linux/wait.h:127 [inline] BUG: KASAN: slab-use-after-free in sock_def_write_space_wfree net/core/sock.c:3384 [inline] BUG: KASAN: slab-use-after-free in sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 Read of size 8 at addr ffff88802f4fc880 by task ksoftirqd/1/27 CPU: 1 PID: 27 Comm: ksoftirqd/1 Not tainted 6.8.0-rc1-syzkaller-00049-g6098d87eaf31 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 list_empty include/linux/list.h:373 [inline] waitqueue_active include/linux/wait.h:127 [inline] sock_def_write_space_wfree net/core/sock.c:3384 [inline] sock_wfree+0x9a8/0x9d0 net/core/sock.c:2468 skb_release_head_state+0xa3/0x2b0 net/core/skbuff.c:1080 skb_release_all net/core/skbuff.c:1092 [inline] napi_consume_skb+0x119/0x2b0 net/core/skbuff.c:1404 e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1970 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3860 [inline] e1000_clean+0x4a1/0x26e0 drivers/net/ethernet/intel/e1000/e1000_main.c:3801 __napi_poll.constprop.0+0xb4/0x540 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x956/0xe90 net/core/dev.c:6778 __do_softirq+0x21a/0x8de kernel/softirq.c:553 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x660/0xa10 kernel/smpboot.c:164 kthread+0x2c6/0x3a0 kernel/kthread.c:388 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 </TASK> Allocated by task 5167: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:314 [inline] __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_lru+0x142/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 0: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x121/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kmem_cache_free+0x129/0x350 mm/slub.c:4363 i_callback+0x43/0x70 fs/inode.c:249 rcu_do_batch kernel/rcu/tree.c:2158 [inline] rcu_core+0x819/0x1680 kernel/rcu/tree.c:2433 __do_softirq+0x21a/0x8de kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 __kasan_record_aux_stack+0xba/0x100 mm/kasan/generic.c:586 __call_rcu_common.constprop.0+0x9a/0x7b0 kernel/rcu/tree.c:2683 destroy_inode+0x129/0x1b0 fs/inode.c:315 iput_final fs/inode.c:1739 [inline] iput.part.0+0x560/0x7b0 fs/inode.c:1765 iput+0x5c/0x80 fs/inode.c:1755 dentry_unlink_inode+0x292/0x430 fs/dcache.c:400 __dentry_kill+0x1ca/0x5f0 fs/dcache.c:603 dput.part.0+0x4ac/0x9a0 fs/dcache.c:845 dput+0x1f/0x30 fs/dcache.c:835 __fput+0x3b9/0xb70 fs/file_table.c:384 task_work_run+0x14d/0x240 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa8a/0x2ad0 kernel/exit.c:871 do_group_exit+0xd4/0x2a0 kernel/exit.c:1020 __do_sys_exit_group kernel/exit.c:1031 [inline] __se_sys_exit_group kernel/exit.c:1029 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b The buggy address belongs to the object at ffff88802f4fc800 which belongs to the cache sock_inode_cache of size 1408 The buggy address is located 128 bytes inside of freed 1408-byte region [ffff88802f4fc800, ffff88802f4fcd80) The buggy address belongs to the physical page: page:ffffea0000bd3e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2f4f8 head:ffffea0000bd3e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888013b06b40 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 4956, tgid 4956 (sshd), ts 31423924727, free_ts 0 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0xcc/0x3a0 mm/slub.c:2407 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3625 __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x379/0x6f0 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3019 [inline] sock_alloc_inode+0x25/0x1c0 net/socket.c:308 alloc_inode+0x5d/0x220 fs/inode.c:260 new_inode_pseudo+0x16/0x80 fs/inode.c:1005 sock_alloc+0x40/0x270 net/socket.c:634 __sock_create+0xbc/0x800 net/socket.c:1535 sock_create net/socket.c:1622 [inline] __sys_socket_create net/socket.c:1659 [inline] __sys_socket+0x14c/0x260 net/socket.c:1706 __do_sys_socket net/socket.c:1720 [inline] __se_sys_socket net/socket.c:1718 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1718 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd3/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b page_owner free stack trace missing Memory state around the buggy address: ffff88802f4fc780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802f4fc800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802f4fc880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802f4fc900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802f4fc980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 43815482370c ("net: sock_def_readable() and friends RCU conversion") Reported-and-tested-by: syzbot+32b89eaa102b372ff76d(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Eric Biggers <ebiggers(a)google.com> Cc: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://lore.kernel.org/r/20240126165532.3396702-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/llc/af_llc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index d23cd51efc5f..91ee9928d56f 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -219,6 +219,8 @@ static int llc_ui_release(struct socket *sock) if (llc->dev) dev_put(llc->dev); sock_put(sk); + sock_orphan(sk); + sock->sk = NULL; llc_sk_free(sk); out: return 0; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION c0f28264ce70e762ccdf396767a85688e6ed4810
by kernel test robot 16 Mar '24

16 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: c0f28264ce70e762ccdf396767a85688e6ed4810 !5220 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-002-20240315 | `-- drivers-edac-skx_common.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-buildonly-randconfig-003-20240315 |-- drivers-gpu-drm-nouveau-include-nvkm-core-os.h:warning:reg-may-be-used-uninitialized `-- drivers-gpu-drm-nouveau-nvkm-engine-fifo-dmanv40.c:warning:ctx-may-be-used-uninitialized clang_recent_errors |-- x86_64-buildonly-randconfig-006-20240315 | |-- net-appletalk-sysctl_net_atalk.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-can-j1939-main.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-randconfig-r111-20240313 |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-usertype-val32-got-restricted-__be32-userty |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-in_buf |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-struct-sss_tool_ffm_record_info-ffm_ |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-out_buf |-- drivers-net-ethernet-3snic-sssnic-hw-sss_adapter_mgmt.c:sparse:sparse:symbol-g_chip_list-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_common.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-gfp-got-unsigned-int-flag |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_export.c:sparse:sparse:dubious:x-y |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_export.c:sparse:sparse:symbol-sss_rx_buf_size_level-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwdev_mgmt_channel.c:sparse:sparse:symbol-g_mgmt_event_handler-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-desc-got-restricted-__be64-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:sparse:sparse:symbol-sss_adm_msg_read-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:sparse:sparse:symbol-sss_adm_msg_write-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_msg_paddr-got-restricted-__be64-usert |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_wb_reply_paddr-got-restricted-__be64- |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-next_elem_paddr-got-restricted-__be64-us |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:sparse:sparse:symbol-sss_destroy_adm_msg-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_aeq.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_aeq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-init_val-got-restricted-__be32-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_api.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_api.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-val-got-restricted-__be32-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-init_val-got-restricted-__be32-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:sparse:sparse:symbol-sss_ceq_intr_handle-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ceq.c:sparse:sparse:symbol-sss_init_ceqe_desc-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-unsigned-char-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-char-usertype-db_base-got-unsigned-char-noderef-usertype- |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__iomem-db_base-got-void-noderef-__iomem |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_ctrlq_init.c:sparse:sparse:symbol-sss_deinit_ctrlq-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_eq.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_init.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_init.c:sparse:sparse:incompatible-types-in-conditional-expression-(different-address-spaces): |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-unsigned-char-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-val-got-restricted-__be32-usertype |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_mbx_init.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-usertype-data-got-unsigned-char-noderef-usertype-_ |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_global.c:sparse:sparse:symbol-g_uld_mutex-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_probe.c:sparse:sparse:symbol-sss_attach_uld_driver-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-hw-sss_wq.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t |-- drivers-net-ethernet-3snic-sssnic-hw-sss_wq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-net-ethernet-3snic-sssnic-include-hw-sss_hw_common.h:sparse:sparse:cast-to-restricted-__be32 |-- drivers-net-ethernet-3snic-sssnic-include-hw-sss_hw_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype |-- drivers-net-ethernet-3snic-sssnic-nic-.-tool-sss_tool_nic_qp_info.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression |-- drivers-net-ethernet-3snic-sssnic-nic-.-tool-sss_tool_nic_qp_info.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-hw_pi-got-restricted-__be16-usert |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_api.c:sparse:sparse:symbol-sss_nic_finish_loop_test-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ethtool_stats.o:warning:objtool:sss_nic_get_sset_count:can-t-find-switch-jump-table |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-rq_db_addr-got-unsigned-char-us |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-sq_db_addr-got-unsigned-char-us |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.h:sparse:sparse:cast-removes-address-space-__iomem-of-expression |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_io.h:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-unsigned-long-long-usertype |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:sparse:sparse:symbol-g_nic_uld_info-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:sparse:sparse:symbol-get_nic_uld_info-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:sparse:sparse:symbol-sss_nic_port_module_cable_plug-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:sparse:sparse:symbol-sss_nic_port_module_cable_unplug-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.c:sparse:sparse:symbol-sss_nic_port_module_link_err-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_main.o:warning:objtool:sss_nic_event:can-t-find-switch-jump-table |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:sparse:sparse:symbol-sss_nic_ndo_set_vf_link_state-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:sparse:sparse:symbol-sss_nic_ndo_vlan_rx_add_vid-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops.c:sparse:sparse:symbol-sss_nic_ndo_vlan_rx_kill_vid-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops_api.c:sparse:sparse:cast-to-restricted-__be16 |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops_api.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_netdev_ops_api.c:sparse:sparse:restricted-__be32-degrades-to-integer |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-dport-got-restricted-__be16-usertype-pdst |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-sport-got-restricted-__be16-usertype-psrc |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:sparse:sparse:restricted-__be32-degrades-to-integer |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:sparse:sparse:symbol-sss_nic_flush_rx_flow_rule-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:sparse:sparse:symbol-sss_nic_flush_tcam_list-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_ntuple.c:sparse:sparse:symbol-sss_nic_flush_tcam_node_list-was-not-declared.-Should-it-be-static |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rss.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rss_cfg.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-ctx-got-restricted-__be32-usertype |-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_rss_cfg.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype `-- drivers-net-ethernet-3snic-sssnic-nic-sss_nic_tx.c:sparse:sparse:restricted-__be16-degrades-to-integer elapsed time: 731m configs tested: 35 configs skipped: 145 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240315 gcc arm64 randconfig-002-20240315 gcc arm64 randconfig-003-20240315 gcc arm64 randconfig-004-20240315 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240315 gcc x86_64 buildonly-randconfig-002-20240315 gcc x86_64 buildonly-randconfig-003-20240315 gcc x86_64 buildonly-randconfig-004-20240315 gcc x86_64 buildonly-randconfig-005-20240315 clang x86_64 buildonly-randconfig-006-20240315 clang x86_64 defconfig gcc x86_64 randconfig-001-20240315 gcc x86_64 randconfig-002-20240315 clang x86_64 randconfig-003-20240315 gcc x86_64 randconfig-004-20240315 clang x86_64 randconfig-005-20240315 gcc x86_64 randconfig-006-20240315 gcc x86_64 randconfig-011-20240315 clang x86_64 randconfig-012-20240315 gcc x86_64 randconfig-013-20240315 gcc x86_64 randconfig-014-20240315 gcc x86_64 randconfig-015-20240315 clang x86_64 randconfig-016-20240315 clang x86_64 randconfig-071-20240315 clang x86_64 randconfig-072-20240315 clang x86_64 randconfig-073-20240315 gcc x86_64 randconfig-074-20240315 gcc x86_64 randconfig-075-20240315 clang x86_64 randconfig-076-20240315 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21121/21871] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:5: sparse: sparse: symbol 'sss_attach_uld_driver' was not declared. Should it be static?
by kernel test robot 16 Mar '24

16 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c0f28264ce70e762ccdf396767a85688e6ed4810 commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [21121/21871] Net: ethernet: Support 3snic 3s9xx network card config: x86_64-randconfig-r111-20240313 (https://download.01.org/0day-ci/archive/20240316/202403160328.U3VDCuIj-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240316/202403160328.U3VDCuIj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403160328.U3VDCuIj-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:65:5: sparse: sparse: symbol 'rx_buff_size' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: sparse: sparse: symbol 'sss_nic_port_module_cable_plug' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: sparse: sparse: symbol 'sss_nic_port_module_cable_unplug' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: sparse: sparse: symbol 'sss_nic_port_module_link_err' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1020:21: sparse: sparse: symbol 'g_nic_uld_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:21: sparse: sparse: symbol 'get_nic_uld_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: warning: no previous prototype for function 'sss_nic_port_module_cable_plug' [-Wmissing-prototypes] 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: warning: no previous prototype for function 'sss_nic_port_module_cable_unplug' [-Wmissing-prototypes] 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: warning: no previous prototype for function 'sss_nic_port_module_link_err' [-Wmissing-prototypes] 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:22: warning: no previous prototype for function 'get_nic_uld_info' [-Wmissing-prototypes] 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^ | static 4 warnings generated. >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.o: warning: objtool: sss_nic_event()+0x1bd: can't find switch jump table -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:44:5: sparse: sparse: symbol 'sss_nic_get_sset_count' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:62:6: sparse: sparse: symbol 'sss_nic_get_ethtool_stats' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:78:6: sparse: sparse: symbol 'sss_nic_get_strings' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:98:5: sparse: sparse: symbol 'sss_nic_get_link_ksettings' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:120:5: sparse: sparse: symbol 'sss_nic_set_link_ksettings' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:44:5: warning: no previous prototype for function 'sss_nic_get_sset_count' [-Wmissing-prototypes] 44 | int sss_nic_get_sset_count(struct net_device *netdev, int settings) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:44:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 44 | int sss_nic_get_sset_count(struct net_device *netdev, int settings) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:62:6: warning: no previous prototype for function 'sss_nic_get_ethtool_stats' [-Wmissing-prototypes] 62 | void sss_nic_get_ethtool_stats(struct net_device *netdev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | void sss_nic_get_ethtool_stats(struct net_device *netdev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:78:6: warning: no previous prototype for function 'sss_nic_get_strings' [-Wmissing-prototypes] 78 | void sss_nic_get_strings(struct net_device *netdev, u32 stringset, u8 *buf) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:78:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 78 | void sss_nic_get_strings(struct net_device *netdev, u32 stringset, u8 *buf) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:98:5: warning: no previous prototype for function 'sss_nic_get_link_ksettings' [-Wmissing-prototypes] 98 | int sss_nic_get_link_ksettings(struct net_device *net_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:98:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 98 | int sss_nic_get_link_ksettings(struct net_device *net_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:120:5: warning: no previous prototype for function 'sss_nic_set_link_ksettings' [-Wmissing-prototypes] 120 | int sss_nic_set_link_ksettings(struct net_device *netdev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:120:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 120 | int sss_nic_set_link_ksettings(struct net_device *netdev, | ^ | static 5 warnings generated. >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.o: warning: objtool: sss_nic_get_sset_count()+0x4a: can't find switch jump table -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: warning: no previous prototype for function 'sss_nic_port_module_cable_plug' [-Wmissing-prototypes] 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: warning: no previous prototype for function 'sss_nic_port_module_cable_unplug' [-Wmissing-prototypes] 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: warning: no previous prototype for function 'sss_nic_port_module_link_err' [-Wmissing-prototypes] 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:22: warning: no previous prototype for function 'get_nic_uld_info' [-Wmissing-prototypes] 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^ | static 4 warnings generated. >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.o: warning: objtool: sss_nic_event()+0x1bd: can't find switch jump table -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:44:5: warning: no previous prototype for function 'sss_nic_get_sset_count' [-Wmissing-prototypes] 44 | int sss_nic_get_sset_count(struct net_device *netdev, int settings) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:44:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 44 | int sss_nic_get_sset_count(struct net_device *netdev, int settings) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:62:6: warning: no previous prototype for function 'sss_nic_get_ethtool_stats' [-Wmissing-prototypes] 62 | void sss_nic_get_ethtool_stats(struct net_device *netdev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | void sss_nic_get_ethtool_stats(struct net_device *netdev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:78:6: warning: no previous prototype for function 'sss_nic_get_strings' [-Wmissing-prototypes] 78 | void sss_nic_get_strings(struct net_device *netdev, u32 stringset, u8 *buf) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:78:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 78 | void sss_nic_get_strings(struct net_device *netdev, u32 stringset, u8 *buf) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:98:5: warning: no previous prototype for function 'sss_nic_get_link_ksettings' [-Wmissing-prototypes] 98 | int sss_nic_get_link_ksettings(struct net_device *net_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:98:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 98 | int sss_nic_get_link_ksettings(struct net_device *net_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:120:5: warning: no previous prototype for function 'sss_nic_set_link_ksettings' [-Wmissing-prototypes] 120 | int sss_nic_set_link_ksettings(struct net_device *netdev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.c:120:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 120 | int sss_nic_set_link_ksettings(struct net_device *netdev, | ^ | static 5 warnings generated. >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats.o: warning: objtool: sss_nic_get_sset_count()+0x4a: can't find switch jump table sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:5: sparse: sparse: symbol 'sss_attach_uld_driver' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:5: warning: no previous prototype for function 'sss_attach_uld_driver' [-Wmissing-prototypes] 276 | int sss_attach_uld_driver(struct sss_pci_adapter *adapter, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 276 | int sss_attach_uld_driver(struct sss_pci_adapter *adapter, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:548:5: warning: no previous prototype for function 'sss_pci_probe' [-Wmissing-prototypes] 548 | int sss_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:548:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 548 | int sss_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ^ | static 2 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:35:14: sparse: sparse: symbol 'g_uld_mutex' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:37:6: warning: no previous prototype for function 'sss_init_uld_lock' [-Wmissing-prototypes] 37 | void sss_init_uld_lock(void) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:37:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 37 | void sss_init_uld_lock(void) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:42:6: warning: no previous prototype for function 'sss_lock_uld' [-Wmissing-prototypes] 42 | void sss_lock_uld(void) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:42:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 42 | void sss_lock_uld(void) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:47:6: warning: no previous prototype for function 'sss_unlock_uld' [-Wmissing-prototypes] 47 | void sss_unlock_uld(void) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:47:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 47 | void sss_unlock_uld(void) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:52:14: warning: no previous prototype for function 'sss_get_uld_names' [-Wmissing-prototypes] 52 | const char **sss_get_uld_names(void) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:52:7: note: declare 'static' if the function is not intended to be used outside of this translation unit 52 | const char **sss_get_uld_names(void) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:57:22: warning: no previous prototype for function 'sss_get_uld_info' [-Wmissing-prototypes] 57 | struct sss_uld_info *sss_get_uld_info(void) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:57:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 57 | struct sss_uld_info *sss_get_uld_info(void) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:62:6: warning: no previous prototype for function 'sss_attach_is_enable' [-Wmissing-prototypes] 62 | bool sss_attach_is_enable(void) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_global.c:62:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 62 | bool sss_attach_is_enable(void) | ^ | static 6 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_export.c:38:11: sparse: sparse: symbol 'sss_rx_buf_size_level' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_export.c:137:15: sparse: sparse: dubious: !x & y -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_mgmt_channel.c:286:29: sparse: sparse: symbol 'g_mgmt_event_handler' was not declared. Should it be static? -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:311:54: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned char [usertype] *db_base @@ got unsigned char [noderef] [usertype] __iomem *db_base @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:311:54: sparse: expected unsigned char [usertype] *db_base drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:311:54: sparse: got unsigned char [noderef] [usertype] __iomem *db_base >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:320:31: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:320:31: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:320:31: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:533:12: sparse: sparse: context imbalance in 'sss_ctrlq_msg_lock' - different lock contexts for basic block drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq.c:547:13: sparse: sparse: context imbalance in 'sss_ctrlq_msg_unlock' - unexpected unlock -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:327:41: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem **db_base @@ got void [noderef] __iomem * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:327:41: sparse: expected void [noderef] __iomem **db_base drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:327:41: sparse: got void [noderef] __iomem * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:277:5: warning: no previous prototype for function 'sss_reinit_ctrlq_ctx' [-Wmissing-prototypes] 277 | int sss_reinit_ctrlq_ctx(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:277:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 277 | int sss_reinit_ctrlq_ctx(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:367:6: warning: no previous prototype for function 'sss_deinit_ctrlq' [-Wmissing-prototypes] 367 | void sss_deinit_ctrlq(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sss_deinit_ctrlq(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:501:5: warning: no previous prototype for function 'sss_init_ctrlq_channel' [-Wmissing-prototypes] 501 | int sss_init_ctrlq_channel(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:501:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 501 | int sss_init_ctrlq_channel(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:538:6: warning: no previous prototype for function 'sss_deinit_ctrlq_channel' [-Wmissing-prototypes] 538 | void sss_deinit_ctrlq_channel(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:538:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 538 | void sss_deinit_ctrlq_channel(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:547:6: warning: no previous prototype for function 'sss_ctrlq_flush_sync_cmd' [-Wmissing-prototypes] 547 | void sss_ctrlq_flush_sync_cmd(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:547:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 547 | void sss_ctrlq_flush_sync_cmd(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:573:5: warning: no previous prototype for function 'sss_wait_ctrlq_stop' [-Wmissing-prototypes] 573 | int sss_wait_ctrlq_stop(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_init.c:573:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 573 | int sss_wait_ctrlq_stop(struct sss_hwdev *hwdev) | ^ | static 6 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:30: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:30: sparse: expected unsigned int val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:30: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:73: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:73: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:294:73: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:312:30: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:312:30: sparse: expected unsigned int val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:312:30: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:313:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:313:67: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:313:67: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx.c:364:19: sparse: sparse: cast to restricted __be64 -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:346:24: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [usertype] *data @@ got unsigned char [noderef] [usertype] __iomem * @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:346:24: sparse: expected unsigned char [usertype] *data drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:346:24: sparse: got unsigned char [noderef] [usertype] __iomem * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c: note: in included file (through include/linux/bitops.h, include/linux/kernel.h, include/linux/list.h, ...): arch/x86/include/asm/bitops.h:111:37: sparse: sparse: cast truncates bits from constant value (ffffff7f becomes 7f) drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:252:5: warning: no previous prototype for function 'sss_init_func_mbx_msg' [-Wmissing-prototypes] 252 | int sss_init_func_mbx_msg(void *hwdev, u16 func_num) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:252:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 252 | int sss_init_func_mbx_msg(void *hwdev, u16 func_num) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:401:5: warning: no previous prototype for function 'sss_hwif_init_mbx' [-Wmissing-prototypes] 401 | int sss_hwif_init_mbx(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:401:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 401 | int sss_hwif_init_mbx(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:449:6: warning: no previous prototype for function 'sss_hwif_deinit_mbx' [-Wmissing-prototypes] 449 | void sss_hwif_deinit_mbx(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:449:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 449 | void sss_hwif_deinit_mbx(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:872:6: warning: no previous prototype for function 'sss_recv_mbx_aeq_handler' [-Wmissing-prototypes] 872 | void sss_recv_mbx_aeq_handler(void *handle, u8 *header, u8 size) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_mbx_init.c:872:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 872 | void sss_recv_mbx_aeq_handler(void *handle, u8 *header, u8 size) | ^ | static 4 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:213:31: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:275:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:275:20: sparse: expected unsigned long long [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:275:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:328:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] desc @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:328:20: sparse: expected unsigned long long [usertype] desc drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:328:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:368:20: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:372:25: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:409:23: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:500:9: sparse: sparse: context imbalance in 'sss_adm_msg_lock' - wrong count at exit drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:509:28: sparse: sparse: context imbalance in 'sss_adm_msg_unlock' - unexpected unlock drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:545:5: warning: no previous prototype for function 'sss_adm_msg_write' [-Wmissing-prototypes] 545 | int sss_adm_msg_write(struct sss_adm_msg *adm_msg, u8 node_id, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:545:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 545 | int sss_adm_msg_write(struct sss_adm_msg *adm_msg, u8 node_id, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:551:5: warning: no previous prototype for function 'sss_adm_msg_read' [-Wmissing-prototypes] 551 | int sss_adm_msg_read(struct sss_adm_msg *adm_msg, u8 node_id, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:551:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 551 | int sss_adm_msg_read(struct sss_adm_msg *adm_msg, u8 node_id, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:597:5: warning: no previous prototype for function 'sss_adm_msg_read_ack' [-Wmissing-prototypes] 597 | int sss_adm_msg_read_ack(void *hwdev, u8 dest, const void *cmd, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:597:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 597 | int sss_adm_msg_read_ack(void *hwdev, u8 dest, const void *cmd, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:618:5: warning: no previous prototype for function 'sss_adm_msg_write_nack' [-Wmissing-prototypes] 618 | int sss_adm_msg_write_nack(void *hwdev, u8 dest, const void *cmd, u16 size) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:618:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 618 | int sss_adm_msg_write_nack(void *hwdev, u8 dest, const void *cmd, u16 size) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:682:5: warning: no previous prototype for function 'sss_sync_send_adm_msg' [-Wmissing-prototypes] 682 | int sss_sync_send_adm_msg(void *hwdev, u8 mod, u16 cmd, void *buf_in, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:682:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 682 | int sss_sync_send_adm_msg(void *hwdev, u8 mod, u16 cmd, void *buf_in, | ^ | static 5 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:272:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_msg_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:272:34: sparse: expected unsigned long long [usertype] hw_msg_paddr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:272:34: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:288:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_wb_reply_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:288:38: sparse: expected unsigned long long [usertype] hw_wb_reply_paddr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:288:38: sparse: got restricted __be64 [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:310:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_msg_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:310:33: sparse: expected unsigned long long [usertype] hw_msg_paddr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:310:33: sparse: got restricted __be64 [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:328:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_wb_reply_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:328:38: sparse: expected unsigned long long [usertype] hw_wb_reply_paddr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:328:38: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:391:50: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_elem_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:391:50: sparse: expected unsigned long long [usertype] next_elem_paddr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:391:50: sparse: got restricted __be64 [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:400:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_elem_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:400:31: sparse: expected unsigned long long [usertype] next_elem_paddr drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:400:31: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:463:45: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:463:45: sparse: expected unsigned int flag drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:463:45: sparse: got restricted gfp_t >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:580:6: sparse: sparse: symbol 'sss_destroy_adm_msg' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:580:6: warning: no previous prototype for function 'sss_destroy_adm_msg' [-Wmissing-prototypes] 580 | void sss_destroy_adm_msg(struct sss_adm_msg *adm_msg) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:580:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 580 | void sss_destroy_adm_msg(struct sss_adm_msg *adm_msg) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:689:5: warning: no previous prototype for function 'sss_hwif_init_adm' [-Wmissing-prototypes] 689 | int sss_hwif_init_adm(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:689:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 689 | int sss_hwif_init_adm(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:738:6: warning: no previous prototype for function 'sss_hwif_deinit_adm' [-Wmissing-prototypes] 738 | void sss_hwif_deinit_adm(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:738:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 738 | void sss_hwif_deinit_adm(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:752:6: warning: no previous prototype for function 'sss_complete_adm_event' [-Wmissing-prototypes] 752 | void sss_complete_adm_event(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:752:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 752 | void sss_complete_adm_event(struct sss_hwdev *hwdev) | ^ | static 4 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:311:32: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:309:54: sparse: sparse: incompatible types in conditional expression (different address spaces): drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:309:54: sparse: void [noderef] __iomem * drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_init.c:309:54: sparse: unsigned char [usertype] * -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:31:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:34:24: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:24: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:24: sparse: expected unsigned int val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:41:24: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:24: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:24: sparse: expected unsigned int val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_api.c:44:24: sparse: got restricted __be32 [usertype] -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_eq.c:138:67: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_eq.c:138:67: sparse: expected unsigned int flag drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_eq.c:138:67: sparse: got restricted gfp_t -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_aeq.c:153:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] init_val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_aeq.c:153:18: sparse: expected unsigned int [usertype] init_val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_aeq.c:153:18: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_aeq.c:238:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_aeq.c:408:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_aeq.c: note: in included file (through drivers/net/ethernet/3snic/sssnic/hw/include/sss_hwdev.h): >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:99:26: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:99:26: sparse: sparse: cast to restricted __be32 -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_common.c:30:14: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] gfp @@ got unsigned int flag @@ drivers/net/ethernet/3snic/sssnic/hw/sss_common.c:30:14: sparse: expected restricted gfp_t [usertype] gfp drivers/net/ethernet/3snic/sssnic/hw/sss_common.c:30:14: sparse: got unsigned int flag drivers/net/ethernet/3snic/sssnic/hw/sss_common.c:42:14: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] gfp @@ got unsigned int flag @@ drivers/net/ethernet/3snic/sssnic/hw/sss_common.c:42:14: sparse: expected restricted gfp_t [usertype] gfp drivers/net/ethernet/3snic/sssnic/hw/sss_common.c:42:14: sparse: got unsigned int flag -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_wq.c:48:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_wq.c:48:36: sparse: expected unsigned long long [usertype] drivers/net/ethernet/3snic/sssnic/hw/sss_wq.c:48:36: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_wq.c:72:68: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/3snic/sssnic/hw/sss_wq.c:72:68: sparse: expected unsigned int flag drivers/net/ethernet/3snic/sssnic/hw/sss_wq.c:72:68: sparse: got restricted gfp_t -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:102:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] init_val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:102:18: sparse: expected unsigned int [usertype] init_val drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:102:18: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:95:6: sparse: sparse: symbol 'sss_init_ceqe_desc' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:130:13: sparse: sparse: symbol 'sss_ceq_intr_handle' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:174:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:377:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:95:6: warning: no previous prototype for function 'sss_init_ceqe_desc' [-Wmissing-prototypes] 95 | void sss_init_ceqe_desc(void *data) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:95:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 95 | void sss_init_ceqe_desc(void *data) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:130:13: warning: no previous prototype for function 'sss_ceq_intr_handle' [-Wmissing-prototypes] 130 | irqreturn_t sss_ceq_intr_handle(int irq, void *data) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ceq.c:130:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 130 | irqreturn_t sss_ceq_intr_handle(int irq, void *data) | ^ | static 2 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c:64:1: sparse: sparse: symbol 'g_chip_list' was not declared. Should it be static? -- drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:80:6: sparse: sparse: symbol 'sss_tool_free_in_buf' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:91:6: sparse: sparse: symbol 'sss_tool_free_out_buf' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:104:5: sparse: sparse: symbol 'sss_tool_alloc_in_buf' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:146:5: sparse: sparse: symbol 'sss_tool_alloc_out_buf' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:189:42: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:189:42: sparse: expected void [noderef] __user *to drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:189:42: sparse: got void *out_buf drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:194:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:194:34: sparse: expected void [noderef] __user *to drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:194:34: sparse: got void *out_buf drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:182:5: sparse: sparse: symbol 'sss_tool_copy_to_user' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:211:45: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void *in_buf @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:211:45: sparse: expected void const [noderef] __user *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:211:45: sparse: got void *in_buf drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:238:36: sparse: sparse: symbol 'g_deal_msg_handle' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:318:40: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:318:40: sparse: expected void const [noderef] __user *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:318:40: sparse: got void * >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:380:42: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got struct sss_tool_ffm_record_info *ffm_rd @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:380:42: sparse: expected void [noderef] __user *to drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:380:42: sparse: got struct sss_tool_ffm_record_info *ffm_rd drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:416:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:416:37: sparse: expected void const [noderef] __user *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:416:37: sparse: got void * drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:80:6: warning: no previous prototype for function 'sss_tool_free_in_buf' [-Wmissing-prototypes] 80 | void sss_tool_free_in_buf(void *hwdev, const struct sss_tool_msg *tool_msg, void *in_buf) | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:80:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 80 | void sss_tool_free_in_buf(void *hwdev, const struct sss_tool_msg *tool_msg, void *in_buf) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:91:6: warning: no previous prototype for function 'sss_tool_free_out_buf' [-Wmissing-prototypes] 91 | void sss_tool_free_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:91:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 91 | void sss_tool_free_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:104:5: warning: no previous prototype for function 'sss_tool_alloc_in_buf' [-Wmissing-prototypes] 104 | int sss_tool_alloc_in_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:104:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 104 | int sss_tool_alloc_in_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:146:5: warning: no previous prototype for function 'sss_tool_alloc_out_buf' [-Wmissing-prototypes] 146 | int sss_tool_alloc_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:146:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 146 | int sss_tool_alloc_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:182:5: warning: no previous prototype for function 'sss_tool_copy_to_user' [-Wmissing-prototypes] 182 | int sss_tool_copy_to_user(struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:182:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 182 | int sss_tool_copy_to_user(struct sss_tool_msg *tool_msg, | ^ | static 5 warnings generated. -- drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:498:5: sparse: sparse: symbol 'sss_tool_send_clp_msg' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:604:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:604:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:604:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:606:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:606:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:606:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:588:5: sparse: sparse: symbol 'sss_tool_adm_csr_rd32' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:635:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:635:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:635:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:637:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [assigned] [usertype] val32 @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:637:28: sparse: expected unsigned int [assigned] [usertype] val32 drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:637:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:621:5: sparse: sparse: symbol 'sss_tool_adm_csr_wr32' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:704:35: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:704:35: sparse: expected void const [noderef] __user *from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:704:35: sparse: got void * drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:498:5: warning: no previous prototype for function 'sss_tool_send_clp_msg' [-Wmissing-prototypes] 498 | int sss_tool_send_clp_msg(struct sss_hwdev *hwdev, u8 mod, u16 cmd, const void *buf_in, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:498:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 498 | int sss_tool_send_clp_msg(struct sss_hwdev *hwdev, u8 mod, u16 cmd, const void *buf_in, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:588:5: warning: no previous prototype for function 'sss_tool_adm_csr_rd32' [-Wmissing-prototypes] 588 | int sss_tool_adm_csr_rd32(struct sss_hwdev *hwdev, u8 dest, u32 addr, u32 *val) | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:588:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 588 | int sss_tool_adm_csr_rd32(struct sss_hwdev *hwdev, u8 dest, u32 addr, u32 *val) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:621:5: warning: no previous prototype for function 'sss_tool_adm_csr_wr32' [-Wmissing-prototypes] 621 | int sss_tool_adm_csr_wr32(struct sss_hwdev *hwdev, u8 dest, u32 addr, u32 val) | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_chip.c:621:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 621 | int sss_tool_adm_csr_wr32(struct sss_hwdev *hwdev, u8 dest, u32 addr, u32 val) | ^ | static 3 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: sparse: sparse: symbol 'sss_nic_port_module_cable_plug' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: sparse: sparse: symbol 'sss_nic_port_module_cable_unplug' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: sparse: sparse: symbol 'sss_nic_port_module_link_err' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1020:21: sparse: sparse: symbol 'g_nic_uld_info' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:21: sparse: sparse: symbol 'get_nic_uld_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: warning: no previous prototype for function 'sss_nic_port_module_cable_plug' [-Wmissing-prototypes] 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: warning: no previous prototype for function 'sss_nic_port_module_cable_unplug' [-Wmissing-prototypes] 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: warning: no previous prototype for function 'sss_nic_port_module_link_err' [-Wmissing-prototypes] 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:22: warning: no previous prototype for function 'get_nic_uld_info' [-Wmissing-prototypes] 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^ | static 4 warnings generated. drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.o: warning: objtool: sss_nic_event()+0x1bd: can't find switch jump table -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c:710:9: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/3snic/sssnic/nic/sss_nic_tx.c: note: in included file: >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: got unsigned long long [usertype] * -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx.c: note: in included file: >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: got unsigned long long [usertype] * >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: got unsigned long long [usertype] * -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c: note: in included file: >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.h:103:37: sparse: got unsigned long long [usertype] * drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:179:6: warning: no previous prototype for function 'sss_nic_rq_watchdog_handler' [-Wmissing-prototypes] 179 | void sss_nic_rq_watchdog_handler(struct work_struct *work) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rx_reset.c:179:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 179 | void sss_nic_rq_watchdog_handler(struct work_struct *work) | ^ | static 1 warning generated. -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss.c:276:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss.c:276:41: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss.c:276:41: sparse: got restricted __be32 [usertype] -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:87:17: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:100:17: sparse: sparse: restricted __be32 degrades to integer >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:135:39: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dport:16 @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:135:39: sparse: expected unsigned int [usertype] dport:16 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:135:39: sparse: got restricted __be16 [usertype] pdst >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:138:39: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] sport:16 @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:138:39: sparse: expected unsigned int [usertype] sport:16 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:138:39: sparse: got restricted __be16 [usertype] psrc drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:271:39: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dport:16 @@ got restricted __be16 [usertype] pdst @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:271:39: sparse: expected unsigned int [usertype] dport:16 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:271:39: sparse: got restricted __be16 [usertype] pdst drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:274:39: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] sport:16 @@ got restricted __be16 [usertype] psrc @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:274:39: sparse: expected unsigned int [usertype] sport:16 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:274:39: sparse: got restricted __be16 [usertype] psrc >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:350:6: sparse: sparse: symbol 'sss_nic_flush_tcam_list' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:366:6: sparse: sparse: symbol 'sss_nic_flush_tcam_node_list' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:382:6: sparse: sparse: symbol 'sss_nic_flush_rx_flow_rule' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:350:6: warning: no previous prototype for function 'sss_nic_flush_tcam_list' [-Wmissing-prototypes] 350 | void sss_nic_flush_tcam_list(struct sss_nic_tcam_info *tcam_info) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:350:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 350 | void sss_nic_flush_tcam_list(struct sss_nic_tcam_info *tcam_info) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:366:6: warning: no previous prototype for function 'sss_nic_flush_tcam_node_list' [-Wmissing-prototypes] 366 | void sss_nic_flush_tcam_node_list(struct sss_nic_tcam_info *tcam_info) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:366:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 366 | void sss_nic_flush_tcam_node_list(struct sss_nic_tcam_info *tcam_info) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:382:6: warning: no previous prototype for function 'sss_nic_flush_rx_flow_rule' [-Wmissing-prototypes] 382 | void sss_nic_flush_rx_flow_rule(struct sss_nic_rx_rule *rx_flow_rule) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:382:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 382 | void sss_nic_flush_rx_flow_rule(struct sss_nic_rx_rule *rx_flow_rule) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:397:6: warning: no previous prototype for function 'sss_nic_flush_tcam' [-Wmissing-prototypes] 397 | void sss_nic_flush_tcam(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:397:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 397 | void sss_nic_flush_tcam(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:797:5: warning: no previous prototype for function 'sss_nic_ethtool_update_flow' [-Wmissing-prototypes] 797 | int sss_nic_ethtool_update_flow(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:797:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 797 | int sss_nic_ethtool_update_flow(struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:842:5: warning: no previous prototype for function 'sss_nic_ethtool_delete_flow' [-Wmissing-prototypes] 842 | int sss_nic_ethtool_delete_flow(struct sss_nic_dev *nic_dev, u32 location) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:842:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 842 | int sss_nic_ethtool_delete_flow(struct sss_nic_dev *nic_dev, u32 location) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:864:5: warning: no previous prototype for function 'sss_nic_ethtool_get_flow' [-Wmissing-prototypes] 864 | int sss_nic_ethtool_get_flow(const struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:864:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 864 | int sss_nic_ethtool_get_flow(const struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:887:5: warning: no previous prototype for function 'sss_nic_ethtool_get_all_flows' [-Wmissing-prototypes] 887 | int sss_nic_ethtool_get_all_flows(const struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:887:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 887 | int sss_nic_ethtool_get_all_flows(const struct sss_nic_dev *nic_dev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:905:6: warning: no previous prototype for function 'sss_nic_validate_channel_setting_in_ntuple' [-Wmissing-prototypes] 905 | bool sss_nic_validate_channel_setting_in_ntuple(const struct sss_nic_dev *nic_dev, u32 q_num) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:905:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 905 | bool sss_nic_validate_channel_setting_in_ntuple(const struct sss_nic_dev *nic_dev, u32 q_num) | ^ | static 9 warnings generated. -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_api.c:644:5: sparse: sparse: symbol 'sss_nic_finish_loop_test' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_api.c:644:5: warning: no previous prototype for function 'sss_nic_finish_loop_test' [-Wmissing-prototypes] 644 | int sss_nic_finish_loop_test(struct sss_nic_dev *nic_dev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_api.c:644:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 644 | int sss_nic_finish_loop_test(struct sss_nic_dev *nic_dev, | ^ | static 1 warning generated. -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:297:5: sparse: sparse: symbol 'sss_nic_ndo_vlan_rx_add_vid' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:318:5: sparse: sparse: symbol 'sss_nic_ndo_vlan_rx_kill_vid' was not declared. Should it be static? >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:506:5: sparse: sparse: symbol 'sss_nic_ndo_set_vf_link_state' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:297:5: warning: no previous prototype for function 'sss_nic_ndo_vlan_rx_add_vid' [-Wmissing-prototypes] 297 | int sss_nic_ndo_vlan_rx_add_vid(struct net_device *netdev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:297:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 297 | int sss_nic_ndo_vlan_rx_add_vid(struct net_device *netdev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:318:5: warning: no previous prototype for function 'sss_nic_ndo_vlan_rx_kill_vid' [-Wmissing-prototypes] 318 | int sss_nic_ndo_vlan_rx_kill_vid(struct net_device *netdev, | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:318:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 318 | int sss_nic_ndo_vlan_rx_kill_vid(struct net_device *netdev, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:506:5: warning: no previous prototype for function 'sss_nic_ndo_set_vf_link_state' [-Wmissing-prototypes] 506 | int sss_nic_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:506:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 506 | int sss_nic_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:787:6: warning: no previous prototype for function 'sss_nic_set_netdev_ops' [-Wmissing-prototypes] 787 | void sss_nic_set_netdev_ops(struct sss_nic_dev *nic_dev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:787:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 787 | void sss_nic_set_netdev_ops(struct sss_nic_dev *nic_dev) | ^ | static drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:795:6: warning: no previous prototype for function 'sss_nic_is_netdev_ops_match' [-Wmissing-prototypes] 795 | bool sss_nic_is_netdev_ops_match(const struct net_device *netdev) | ^ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:795:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 795 | bool sss_nic_is_netdev_ops_match(const struct net_device *netdev) | ^ | static 5 warnings generated. -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_cfg.c: note: in included file (through drivers/net/ethernet/3snic/sssnic/include/sss_hw.h): >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_vf_cfg.c: note: in included file (through drivers/net/ethernet/3snic/sssnic/include/sss_hw.h): >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss_cfg.c:109:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss_cfg.c:109:31: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss_cfg.c:109:31: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss_cfg.c:160:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ctx @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss_cfg.c:160:26: sparse: expected unsigned int [usertype] ctx drivers/net/ethernet/3snic/sssnic/nic/sss_nic_rss_cfg.c:160:26: sparse: got restricted __be32 [usertype] -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:31: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *sq_db_addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:28: sparse: expected unsigned char [noderef] [usertype] __iomem *sq_db_addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:400:28: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:31: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *rq_db_addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:28: sparse: expected unsigned char [noderef] [usertype] __iomem *rq_db_addr drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c:408:28: sparse: got unsigned char [usertype] * drivers/net/ethernet/3snic/sssnic/nic/sss_nic_io.c: note: in included file (through drivers/net/ethernet/3snic/sssnic/include/sss_hw.h): >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/3snic/sssnic/include/hw/sss_hw_common.h:77:22: sparse: got restricted __be32 [usertype] -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:689:33: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:692:38: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:728:37: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:729:37: sparse: sparse: restricted __be32 degrades to integer >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:741:37: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:741:37: sparse: sparse: cast to restricted __be16 -- >> drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:71:39: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:88:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] hw_pi @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:88:24: sparse: expected unsigned short [usertype] hw_pi drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:88:24: sparse: got restricted __be16 [usertype] drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:137:5: sparse: sparse: symbol 'sss_tool_get_tx_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:163:5: sparse: sparse: symbol 'sss_tool_get_tx_wqe_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:182:5: sparse: sparse: symbol 'sss_tool_get_rx_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:223:5: sparse: sparse: symbol 'sss_tool_get_rx_wqe_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:242:5: sparse: sparse: symbol 'sss_tool_get_rx_cqe_info' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:280:5: sparse: sparse: symbol 'sss_tool_get_q_num' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:304:5: sparse: sparse: symbol 'sss_tool_get_inter_num' was not declared. Should it be static? drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:137:5: warning: no previous prototype for function 'sss_tool_get_tx_info' [-Wmissing-prototypes] 137 | int sss_tool_get_tx_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:137:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 137 | int sss_tool_get_tx_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:163:5: warning: no previous prototype for function 'sss_tool_get_tx_wqe_info' [-Wmissing-prototypes] 163 | int sss_tool_get_tx_wqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:163:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 163 | int sss_tool_get_tx_wqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:182:5: warning: no previous prototype for function 'sss_tool_get_rx_info' [-Wmissing-prototypes] 182 | int sss_tool_get_rx_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:182:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 182 | int sss_tool_get_rx_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:223:5: warning: no previous prototype for function 'sss_tool_get_rx_wqe_info' [-Wmissing-prototypes] 223 | int sss_tool_get_rx_wqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:223:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 223 | int sss_tool_get_rx_wqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:242:5: warning: no previous prototype for function 'sss_tool_get_rx_cqe_info' [-Wmissing-prototypes] 242 | int sss_tool_get_rx_cqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:242:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 242 | int sss_tool_get_rx_cqe_info(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:280:5: warning: no previous prototype for function 'sss_tool_get_q_num' [-Wmissing-prototypes] 280 | int sss_tool_get_q_num(struct sss_nic_dev *nic_dev, const void *in_buf, u32 in_len, | ^ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:280:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 280 | int sss_tool_get_q_num(struct sss_nic_dev *nic_dev, const void *in_buf, u32 in_len, | ^ | static drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:304:5: warning: no previous prototype for function 'sss_tool_get_inter_num' [-Wmissing-prototypes] 304 | int sss_tool_get_inter_num(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ drivers/net/ethernet/3snic/sssnic/nic/./tool/sss_tool_nic_qp_info.c:304:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 304 | int sss_tool_get_inter_num(struct sss_nic_dev *nic_dev, const void *in_buf, | ^ | static 7 warnings generated. vim +/sss_attach_uld_driver +276 drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c 275 > 276 int sss_attach_uld_driver(struct sss_pci_adapter *adapter, 277 enum sss_service_type type, const struct sss_uld_info *uld_info) 278 { 279 int ret = 0; 280 void *uld = NULL; 281 const char **name = sss_get_uld_names(); 282 struct pci_dev *pdev = adapter->pcidev; 283 284 mutex_lock(&adapter->uld_attach_mutex); 285 286 if (adapter->uld_dev[type]) { 287 sdk_err(&pdev->dev, "Fail to attach pci dev, driver %s\n", name[type]); 288 mutex_unlock(&adapter->uld_attach_mutex); 289 return 0; 290 } 291 292 ret = uld_info->probe(&adapter->hal_dev, &uld, adapter->uld_dev_name[type]); 293 if (ret != 0) { 294 sdk_err(&pdev->dev, "Fail to probe for driver %s\n", name[type]); 295 mutex_unlock(&adapter->uld_attach_mutex); 296 return ret; 297 } 298 299 adapter->uld_dev[type] = uld; 300 set_bit(type, &adapter->uld_attach_state); 301 mutex_unlock(&adapter->uld_attach_mutex); 302 303 sdk_info(&pdev->dev, "Success to attach %s driver\n", name[type]); 304 305 return 0; 306 } 307 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 24783/30000] drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file'
by kernel test robot 16 Mar '24

16 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: cd637a6dded9c0dce5f8d79898bb25be2edb927a [24783/30000] ub: uburma support open/release file ops config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240316/202403160056.fe8TqdpG-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240316/202403160056.fe8TqdpG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403160056.fe8TqdpG-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] 32 | void uburma_release_file(struct kref *ref) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_dev_ops.c:49:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] 49 | int uburma_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: In function 'uburma_open': >> drivers/ub/urma/uburma/uburma_dev_ops.c:66:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] 66 | if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { | ^~ In file included from drivers/ub/urma/uburma/uburma_dev_ops.c:25: include/urma/ubcore_types.h:1589:14: note: 'dev_name' declared here 1589 | char dev_name[UBCORE_MAX_DEV_NAME]; | ^~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: At top level: >> drivers/ub/urma/uburma/uburma_dev_ops.c:102:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] 102 | int uburma_close(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~ vim +/uburma_release_file +32 drivers/ub/urma/uburma/uburma_dev_ops.c 31 > 32 void uburma_release_file(struct kref *ref) 33 { 34 struct uburma_file *file = container_of(ref, struct uburma_file, ref); 35 int srcu_idx; 36 37 srcu_idx = srcu_read_lock(&file->ubu_dev->ubc_dev_srcu); 38 srcu_dereference(file->ubu_dev->ubc_dev, &file->ubu_dev->ubc_dev_srcu); 39 40 srcu_read_unlock(&file->ubu_dev->ubc_dev_srcu, srcu_idx); 41 42 if (atomic_dec_and_test(&file->ubu_dev->refcnt)) 43 complete(&file->ubu_dev->comp); 44 45 kobject_put(&file->ubu_dev->kobj); 46 kfree(file); 47 } 48 > 49 int uburma_open(struct inode *inode, struct file *filp) 50 { 51 struct uburma_device *ubu_dev; 52 struct ubcore_device *ubc_dev; 53 struct uburma_file *file; 54 int srcu_idx; 55 int ret; 56 57 ubu_dev = container_of(inode->i_cdev, struct uburma_device, cdev); 58 if (!atomic_inc_not_zero(&ubu_dev->refcnt)) { 59 uburma_log_err("device was not ready.\n"); 60 return -ENXIO; 61 } 62 63 srcu_idx = srcu_read_lock(&ubu_dev->ubc_dev_srcu); 64 mutex_lock(&ubu_dev->lists_mutex); 65 ubc_dev = srcu_dereference(ubu_dev->ubc_dev, &ubu_dev->ubc_dev_srcu); > 66 if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { 67 uburma_log_err("can not find ubcore device.\n"); 68 ret = EIO; 69 goto err; 70 } 71 72 file = kzalloc(sizeof(struct uburma_file), GFP_KERNEL); 73 if (!file) { 74 ret = -ENOMEM; 75 uburma_log_err("can not alloc memory.\n"); 76 goto err; 77 } 78 79 file->ubu_dev = ubu_dev; 80 file->ucontext = NULL; 81 kref_init(&file->ref); 82 mutex_init(&file->mutex); 83 filp->private_data = file; 84 85 list_add_tail(&file->list, &ubu_dev->uburma_file_list); 86 kobject_get(&ubu_dev->kobj); // Increase reference count for file. 87 88 mutex_unlock(&ubu_dev->lists_mutex); 89 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 90 91 uburma_log_info("device: %s open succeed.\n", ubc_dev->dev_name); 92 return nonseekable_open(inode, filp); 93 94 err: 95 mutex_unlock(&ubu_dev->lists_mutex); 96 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 97 if (atomic_dec_and_test(&ubu_dev->refcnt)) 98 complete(&ubu_dev->comp); 99 return ret; 100 } 101 > 102 int uburma_close(struct inode *inode, struct file *filp) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29991/30000] drivers/net/ethernet/yusur/k2/ys_k2_tx.c:137:18: warning: variable 'clean_tail_ptr' set but not used
by kernel test robot 15 Mar '24

15 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 32bb7b0a7c87769858fbb9d60574b830383c28f7 commit: c92533ad657c0a5d1a7a6355ef2c357cbb91d5c0 [29991/30000] drivers: initial support for KPU FLEXFLOW-2100P driver from Yusur Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240315/202403152311.T6JFVh2t-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240315/202403152311.T6JFVh2t-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403152311.T6JFVh2t-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/yusur/k2/ys_k2_tx.c:137:18: warning: variable 'clean_tail_ptr' set but not used [-Wunused-but-set-variable] 137 | u32 desc_index, clean_tail_ptr; | ^ 1 warning generated. -- >> drivers/net/ethernet/yusur/k2/../platform/ys_intr.c:113:40: warning: overlapping comparisons always evaluate to false [-Wtautological-overlap-compare] 113 | if (sub->irq_type < YS_IRQ_TYPE_QUEUE && | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~ 114 | sub->irq_type > YS_IRQ_TYPE_HW_PRIVATE) { | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +/clean_tail_ptr +137 drivers/net/ethernet/yusur/k2/ys_k2_tx.c 130 131 netdev_tx_t ysk2_start_xmit(struct sk_buff *skb, struct net_device *ndev) 132 { 133 struct ys_ndev_priv *ndev_priv = netdev_priv(ndev); 134 struct skb_shared_info *shinfo = skb_shinfo(skb); 135 struct ysk2_port *k2port = ndev_priv->adp_priv; 136 struct ysk2_desc_ring *tx_ring; > 137 u32 desc_index, clean_tail_ptr; 138 struct ysk2_tx_info *tx_info; 139 struct ysk2_desc *tx_desc; 140 bool stop_queue; 141 u16 txq_index; 142 143 if (unlikely(!(ndev->flags & IFF_UP))) 144 goto tx_drop; 145 146 txq_index = skb_get_queue_mapping(skb); 147 tx_ring = k2port->qps[txq_index].tx_ring; 148 149 clean_tail_ptr = READ_ONCE(tx_ring->ring.clean_tail_ptr); 150 151 desc_index = tx_ring->ring.head_ptr & tx_ring->ring.size_mask; 152 153 tx_desc = (struct ysk2_desc *)(tx_ring->ring.buf + 154 desc_index * tx_ring->ring.stride); 155 156 tx_info = &tx_ring->tx_info[desc_index]; 157 158 /* too many frags or very short data portion; linearize */ 159 if (shinfo->nr_frags > tx_ring->tx_max_sg_frags || 160 (skb->data_len && skb->data_len < 32)) { 161 if (skb_linearize(skb)) 162 goto tx_drop_count; 163 } 164 165 /* Refresh the cache through streaming mapping */ 166 if (ysk2_map_skb(&tx_ring->ring, tx_info, tx_desc, skb)) 167 goto tx_drop_count; 168 169 /* count packet */ 170 tx_ring->packets++; 171 tx_ring->bytes += skb->len; 172 173 /* enqueue */ 174 tx_ring->ring.head_ptr++; 175 176 skb_tx_timestamp(skb); 177 178 /* if the tx_ring is full now, stop the tx queue */ 179 stop_queue = ysk2_is_ring_full(&tx_ring->ring); 180 if (unlikely(stop_queue)) { 181 ys_net_debug("TX ring %d full\n", txq_index); 182 netif_tx_stop_queue(tx_ring->tx_queue); 183 } 184 185 /* enqueue on NIC */ 186 if (unlikely(!netdev_xmit_more() || stop_queue)) 187 ysk2_write_head_ptr(&tx_ring->ring); 188 189 /* check if queue restarted */ 190 if (unlikely(stop_queue)) { 191 clean_tail_ptr = READ_ONCE(tx_ring->ring.clean_tail_ptr); 192 193 if (unlikely(!ysk2_is_ring_full(&tx_ring->ring))) 194 netif_tx_wake_queue(tx_ring->tx_queue); 195 } 196 197 return NETDEV_TX_OK; 198 199 tx_drop_count: 200 tx_ring->dropped_packets++; 201 tx_drop: 202 dev_kfree_skb_any(skb); 203 return NETDEV_TX_OK; 204 } 205 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 32bb7b0a7c87769858fbb9d60574b830383c28f7
by kernel test robot 15 Mar '24

15 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 32bb7b0a7c87769858fbb9d60574b830383c28f7 !3297 [OLK-5.10] Add drivers support for Mucse Network Adapter(N10/N400) Warning reports: https://lore.kernel.org/oe-kbuild-all/202403151200.4Ra2tgj2-lkp@intel.com Warning: (recently discovered and may have been fixed) drivers/ub/urma/ubcore/ubcore_umem.c:227:21: warning: no previous prototype for 'ubcore_umem_get' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_umem.c:245:6: warning: no previous prototype for 'ubcore_umem_release' [-Wmissing-prototypes] Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_get `-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_release clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode `-- x86_64-randconfig-011-20240315 `-- kernel-rcu-tree.o:warning:objtool:__call_rcu_nocb_wake:unreachable-instruction elapsed time: 722m configs tested: 28 configs skipped: 145 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240315 gcc arm64 randconfig-002-20240315 gcc arm64 randconfig-003-20240315 gcc arm64 randconfig-004-20240315 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240315 gcc x86_64 buildonly-randconfig-002-20240315 gcc x86_64 buildonly-randconfig-003-20240315 gcc x86_64 buildonly-randconfig-004-20240315 gcc x86_64 buildonly-randconfig-005-20240315 clang x86_64 buildonly-randconfig-006-20240315 clang x86_64 defconfig gcc x86_64 randconfig-001-20240315 gcc x86_64 randconfig-002-20240315 clang x86_64 randconfig-003-20240315 gcc x86_64 randconfig-004-20240315 clang x86_64 randconfig-005-20240315 gcc x86_64 randconfig-006-20240315 gcc x86_64 randconfig-011-20240315 clang x86_64 randconfig-012-20240315 gcc x86_64 randconfig-013-20240315 gcc x86_64 randconfig-014-20240315 gcc x86_64 randconfig-015-20240315 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 22a313585b0ee196eb843e8b7182402b92d12ce6
by kernel test robot 15 Mar '24

15 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 22a313585b0ee196eb843e8b7182402b92d12ce6 !5180 RDMA/hns: Support hns RoCE Bonding Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240315 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- loongarch-allmodconfig |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-allyesconfig |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true elapsed time: 734m configs tested: 40 configs skipped: 140 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240315 gcc arm64 randconfig-002-20240315 gcc arm64 randconfig-003-20240315 gcc arm64 randconfig-004-20240315 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240315 gcc loongarch randconfig-002-20240315 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240315 gcc x86_64 buildonly-randconfig-002-20240315 gcc x86_64 buildonly-randconfig-003-20240315 gcc x86_64 buildonly-randconfig-004-20240315 gcc x86_64 buildonly-randconfig-005-20240315 clang x86_64 buildonly-randconfig-006-20240315 clang x86_64 defconfig gcc x86_64 randconfig-001-20240315 gcc x86_64 randconfig-002-20240315 clang x86_64 randconfig-003-20240315 gcc x86_64 randconfig-004-20240315 clang x86_64 randconfig-005-20240315 gcc x86_64 randconfig-006-20240315 gcc x86_64 randconfig-011-20240315 clang x86_64 randconfig-012-20240315 gcc x86_64 randconfig-013-20240315 gcc x86_64 randconfig-014-20240315 gcc x86_64 randconfig-015-20240315 clang x86_64 randconfig-016-20240315 clang x86_64 randconfig-071-20240315 clang x86_64 randconfig-072-20240315 clang x86_64 randconfig-073-20240315 gcc x86_64 randconfig-074-20240315 gcc x86_64 randconfig-075-20240315 clang x86_64 randconfig-076-20240315 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] CVE-2024-26627
by Li Nan 15 Mar '24

15 Mar '24

Ming Lei (2): scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler scsi: core: Move scsi_host_busy() out of host lock if it is for per-command drivers/scsi/scsi_priv.h | 2 +- drivers/scsi/scsi_error.c | 9 +++++---- drivers/scsi/scsi_lib.c | 4 +++- 3 files changed, 9 insertions(+), 6 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/2] CVE-2024-26627
by Li Nan 15 Mar '24

15 Mar '24

Ming Lei (2): scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler scsi: core: Move scsi_host_busy() out of host lock if it is for per-command drivers/scsi/scsi_priv.h | 2 +- drivers/scsi/scsi_error.c | 9 +++++---- drivers/scsi/scsi_lib.c | 4 +++- 3 files changed, 9 insertions(+), 6 deletions(-) -- 2.39.2

2 7

[PATCH OLK-5.10 0/2] CVE-2024-26627
by Li Nan 15 Mar '24

15 Mar '24

Ming Lei (2): scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler scsi: core: Move scsi_host_busy() out of host lock if it is for per-command drivers/scsi/scsi_priv.h | 2 +- drivers/scsi/scsi_error.c | 9 +++++---- drivers/scsi/scsi_lib.c | 4 +++- 3 files changed, 9 insertions(+), 6 deletions(-) -- 2.39.2

1 0

[PATCH openEuler-1.0-LTS] tomoyo: fix UAF write bug in tomoyo_write_control()
by felix 15 Mar '24

15 Mar '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.212 commit a23ac1788e2c828c097119e9a3178f0b7e503fee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF CVE: CVE-2024-26622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream. Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji… Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") Cc: <stable(a)vger.kernel.org> # Linux 3.1+ Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: security/tomoyo/common.c Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/tomoyo/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index e6970a69c20c..cf3f90ed7838 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2586,7 +2586,7 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, { int error = buffer_len; size_t avail_len = buffer_len; - char *cp0 = head->write_buf; + char *cp0; int idx; if (!head->write) return -ENOSYS; @@ -2594,6 +2594,7 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, return -EFAULT; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; + cp0 = head->write_buf; head->read_user_buf_avail = 0; idx = tomoyo_read_lock(); /* Read a line and dispatch it to the policy handler. */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tomoyo: fix UAF write bug in tomoyo_write_control()
by felix 15 Mar '24

15 Mar '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.212 commit a23ac1788e2c828c097119e9a3178f0b7e503fee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF CVE: CVE-2024-26622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream. Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji… Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") Cc: <stable(a)vger.kernel.org> # Linux 3.1+ Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/tomoyo/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index 4bee32bfe16d..6235c3be832a 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2657,13 +2657,14 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, { int error = buffer_len; size_t avail_len = buffer_len; - char *cp0 = head->write_buf; + char *cp0; int idx; if (!head->write) return -EINVAL; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; + cp0 = head->write_buf; head->read_user_buf_avail = 0; idx = tomoyo_read_lock(); /* Read a line and dispatch it to the policy handler. */ -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 20704/21867] kernel/sched/grid/qos.c:84:26: error: no member named 'v' in 'struct mempolicy'
by kernel test robot 15 Mar '24

15 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 200e028b39abd7f9d901a50673f9a5f54d3eeb1e commit: ce35ded5d5774f055f6850b15032066ff4936414 [20704/21867] sched: smart grid: init sched_grid_qos structure on QOS purpose config: x86_64-randconfig-r111-20240313 (https://download.01.org/0day-ci/archive/20240315/202403151634.PfWUhfUu-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240315/202403151634.PfWUhfUu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403151634.PfWUhfUu-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/grid/qos.c:84:13: sparse: sparse: using member 'v' in incomplete struct mempolicy kernel/sched/grid/qos.c:91:9: sparse: sparse: using member 'v' in incomplete struct mempolicy kernel/sched/grid/qos.c:95:16: sparse: sparse: no member 'il_prev' in struct task_struct kernel/sched/grid/qos.c:97:19: sparse: sparse: no member 'il_prev' in struct task_struct In file included from kernel/sched/grid/qos.c:20: In file included from include/linux/mempolicy.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/grid/qos.c:84:26: error: no member named 'v' in 'struct mempolicy' 84 | if (nodes_equal(policy->v.nodes, *preferred_nmask)) | ~~~~~~ ^ include/linux/nodemask.h:202:20: note: expanded from macro 'nodes_equal' 202 | __nodes_equal(&(src1), &(src2), MAX_NUMNODES) | ^~~~ kernel/sched/grid/qos.c:91:27: error: no member named 'v' in 'struct mempolicy' 91 | nodes_and(nmask, policy->v.nodes, *preferred_nmask); | ~~~~~~ ^ include/linux/nodemask.h:162:26: note: expanded from macro 'nodes_and' 162 | __nodes_and(&(dst), &(src1), &(src2), MAX_NUMNODES) | ^~~~ >> kernel/sched/grid/qos.c:95:26: error: no member named 'il_prev' in 'struct task_struct' 95 | next = next_node_in(me->il_prev, nmask); | ~~ ^ include/linux/nodemask.h:278:46: note: expanded from macro 'next_node_in' 278 | #define next_node_in(n, src) __next_node_in((n), &(src)) | ^ kernel/sched/grid/qos.c:97:7: error: no member named 'il_prev' in 'struct task_struct' 97 | me->il_prev = next; | ~~ ^ 1 warning and 4 errors generated. -- In file included from kernel/sched/grid/qos.c:20: In file included from include/linux/mempolicy.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/grid/qos.c:84:26: error: no member named 'v' in 'struct mempolicy' 84 | if (nodes_equal(policy->v.nodes, *preferred_nmask)) | ~~~~~~ ^ include/linux/nodemask.h:202:20: note: expanded from macro 'nodes_equal' 202 | __nodes_equal(&(src1), &(src2), MAX_NUMNODES) | ^~~~ kernel/sched/grid/qos.c:91:27: error: no member named 'v' in 'struct mempolicy' 91 | nodes_and(nmask, policy->v.nodes, *preferred_nmask); | ~~~~~~ ^ include/linux/nodemask.h:162:26: note: expanded from macro 'nodes_and' 162 | __nodes_and(&(dst), &(src1), &(src2), MAX_NUMNODES) | ^~~~ >> kernel/sched/grid/qos.c:95:26: error: no member named 'il_prev' in 'struct task_struct' 95 | next = next_node_in(me->il_prev, nmask); | ~~ ^ include/linux/nodemask.h:278:46: note: expanded from macro 'next_node_in' 278 | #define next_node_in(n, src) __next_node_in((n), &(src)) | ^ kernel/sched/grid/qos.c:97:7: error: no member named 'il_prev' in 'struct task_struct' 97 | me->il_prev = next; | ~~ ^ 1 warning and 4 errors generated. vim +84 kernel/sched/grid/qos.c 68 69 /* dynamic select a more appropriate preferred interleave nid for process */ 70 int sched_grid_preferred_interleave_nid(struct mempolicy *policy) 71 { 72 nodemask_t nmask; 73 unsigned int next; 74 struct task_struct *me = current; 75 nodemask_t *preferred_nmask = NULL; 76 77 if (likely(me->grid_qos)) 78 preferred_nmask = 79 &me->grid_qos->affinity.mem_preferred_node_mask; 80 81 if (!preferred_nmask || !policy) 82 return NUMA_NO_NODE; 83 > 84 if (nodes_equal(policy->v.nodes, *preferred_nmask)) 85 return NUMA_NO_NODE; 86 /* 87 * We perceive the actual consumption of memory bandwidth 88 * in each node and post a preferred interleave nid in 89 * more appropriate range. 90 */ > 91 nodes_and(nmask, policy->v.nodes, *preferred_nmask); 92 if (nodes_empty(nmask)) 93 return NUMA_NO_NODE; 94 > 95 next = next_node_in(me->il_prev, nmask); 96 if (next < MAX_NUMNODES) 97 me->il_prev = next; 98 return next; 99 } 100 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] tomoyo: fix UAF write bug in tomoyo_write_control()
by felix 15 Mar '24

15 Mar '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.212 commit a23ac1788e2c828c097119e9a3178f0b7e503fee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF CVE: CVE-2024-26622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream. Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji… Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") Cc: <stable(a)vger.kernel.org> # Linux 3.1+ Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/tomoyo/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index 4bee32bfe16d..6235c3be832a 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2657,13 +2657,14 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, { int error = buffer_len; size_t avail_len = buffer_len; - char *cp0 = head->write_buf; + char *cp0; int idx; if (!head->write) return -EINVAL; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; + cp0 = head->write_buf; head->read_user_buf_avail = 0; idx = tomoyo_read_lock(); /* Read a line and dispatch it to the policy handler. */ -- 2.34.1

2 1

[PATCH OLK-5.10] tomoyo: fix UAF write bug in tomoyo_write_control()
by felix 15 Mar '24

15 Mar '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.212 commit a23ac1788e2c828c097119e9a3178f0b7e503fee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF CVE: CVE-2024-26622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream. Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji… Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") Cc: <stable(a)vger.kernel.org> # Linux 3.1+ Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/tomoyo/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index 4bee32bfe16d..6235c3be832a 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2657,13 +2657,14 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, { int error = buffer_len; size_t avail_len = buffer_len; - char *cp0 = head->write_buf; + char *cp0; int idx; if (!head->write) return -EINVAL; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; + cp0 = head->write_buf; head->read_user_buf_avail = 0; idx = tomoyo_read_lock(); /* Read a line and dispatch it to the policy handler. */ -- 2.34.1

2 1

[PATCH OLK-6.6] tomoyo: fix UAF write bug in tomoyo_write_control()
by felix 15 Mar '24

15 Mar '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v6.8-rc7 commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF CVE: CVE-2024-26622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji… Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") Cc: <stable(a)vger.kernel.org> # Linux 3.1+ Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/tomoyo/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index 57ee70ae50f2..ea3140d510ec 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2649,13 +2649,14 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, { int error = buffer_len; size_t avail_len = buffer_len; - char *cp0 = head->write_buf; + char *cp0; int idx; if (!head->write) return -EINVAL; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; + cp0 = head->write_buf; head->read_user_buf_avail = 0; idx = tomoyo_read_lock(); /* Read a line and dispatch it to the policy handler. */ -- 2.34.1

2 1

[PATCH] tomoyo: fix UAF write bug in tomoyo_write_control()
by felix 15 Mar '24

15 Mar '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v6.8-rc7 commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF CVE: CVE-2024-26622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji… Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") Cc: <stable(a)vger.kernel.org> # Linux 3.1+ Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/tomoyo/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index 57ee70ae50f2..ea3140d510ec 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2649,13 +2649,14 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, { int error = buffer_len; size_t avail_len = buffer_len; - char *cp0 = head->write_buf; + char *cp0; int idx; if (!head->write) return -EINVAL; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; + cp0 = head->write_buf; head->read_user_buf_avail = 0; idx = tomoyo_read_lock(); /* Read a line and dispatch it to the policy handler. */ -- 2.34.1

1 0

[PATCH OLK-5.10] serial: imx: fix tx statemachine deadlock
by felix 15 Mar '24

15 Mar '24

From: Paul Geurts <paul_geurts(a)live.nl> stable inclusion from stable-v5.10.209 commit 6e04a9d30509fb53ba6df5d655ed61d607a7cfda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEE CVE: CVE-2023-52456 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 78d60dae9a0c9f09aa3d6477c94047df2fe6f7b0 ] When using the serial port as RS485 port, the tx statemachine is used to control the RTS pin to drive the RS485 transceiver TX_EN pin. When the TTY port is closed in the middle of a transmission (for instance during userland application crash), imx_uart_shutdown disables the interface and disables the Transmission Complete interrupt. afer that, imx_uart_stop_tx bails on an incomplete transmission, to be retriggered by the TC interrupt. This interrupt is disabled and therefore the tx statemachine never transitions out of SEND. The statemachine is in deadlock now, and the TX_EN remains low, making the interface useless. imx_uart_stop_tx now checks for incomplete transmission AND whether TC interrupts are enabled before bailing to be retriggered. This makes sure the state machine handling is reached, and is properly set to WAIT_AFTER_SEND. Fixes: cb1a60923609 ("serial: imx: implement rts delaying for rs485") Signed-off-by: Paul Geurts <paul_geurts(a)live.nl> Tested-by: Rasmus Villemoes <rasmus.villemoes(a)prevas.dk> Tested-by: Eberhard Stoll <eberhard.stoll(a)gmx.de> Link: https://lore.kernel.org/r/AM0PR09MB26758F651BC1B742EB45775995B8A@AM0PR09MB2… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/tty/serial/imx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c index da63ef345e81..6a7add3ac4d5 100644 --- a/drivers/tty/serial/imx.c +++ b/drivers/tty/serial/imx.c @@ -461,13 +461,13 @@ static void imx_uart_stop_tx(struct uart_port *port) ucr1 = imx_uart_readl(sport, UCR1); imx_uart_writel(sport, ucr1 & ~UCR1_TRDYEN, UCR1); + ucr4 = imx_uart_readl(sport, UCR4); usr2 = imx_uart_readl(sport, USR2); - if (!(usr2 & USR2_TXDC)) { + if ((!(usr2 & USR2_TXDC)) && (ucr4 & UCR4_TCEN)) { /* The shifter is still busy, so retry once TC triggers */ return; } - ucr4 = imx_uart_readl(sport, UCR4); ucr4 &= ~UCR4_TCEN; imx_uart_writel(sport, ucr4, UCR4); -- 2.34.1

2 2

[PATCH] tomoyo: fix UAF write bug in tomoyo_write_control()
by felix 15 Mar '24

15 Mar '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.212 commit a23ac1788e2c828c097119e9a3178f0b7e503fee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95LPF CVE: CVE-2024-26622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815 upstream. Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and double-free problems. Reported-by: Sam Sun <samsun1006219(a)gmail.com> Closes: https://lkml.kernel.org/r/CAEkJfYNDspuGxYx5kym8Lvp--D36CMDUErg4rxfWFJuPbbji… Fixes: bd03a3e4c9a9 ("TOMOYO: Add policy namespace support.") Cc: <stable(a)vger.kernel.org> # Linux 3.1+ Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/tomoyo/common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c index 4bee32bfe16d..6235c3be832a 100644 --- a/security/tomoyo/common.c +++ b/security/tomoyo/common.c @@ -2657,13 +2657,14 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, { int error = buffer_len; size_t avail_len = buffer_len; - char *cp0 = head->write_buf; + char *cp0; int idx; if (!head->write) return -EINVAL; if (mutex_lock_interruptible(&head->io_sem)) return -EINTR; + cp0 = head->write_buf; head->read_user_buf_avail = 0; idx = tomoyo_read_lock(); /* Read a line and dispatch it to the policy handler. */ -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 0/3] jfs: fix two cve issue
by Long Li 15 Mar '24

15 Mar '24

This patch set fix two cve issue. Dongliang Mu (1): JFS: fix memleak in jfs_mount Edward Adam Davis (2): jfs: fix uaf in jfs_evict_inode jfs: fix array-index-out-of-bounds in diNewExt fs/jfs/jfs_imap.c | 3 +++ fs/jfs/jfs_mount.c | 57 ++++++++++++++++++++-------------------------- 2 files changed, 28 insertions(+), 32 deletions(-) -- 2.31.1

2 4

[PATCH OLK-6.6] f2fs: fix to tag gcing flag on page during block migration
by Yifan Qiao 15 Mar '24

15 Mar '24

From: Chao Yu <chao(a)kernel.org> mainline inclusion from mainline-v6.8-rc1 commit 4961acdd65c956e97c1a000c82d91a8c1cdbe44b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96GPF CVE: CVE-2023-52588 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It needs to add missing gcing flag on page during block migration, in order to garantee migrated data be persisted during checkpoint, otherwise out-of-order persistency between data and node may cause data corruption after SPOR. Similar issue was fixed by commit 2d1fe8a86bf5 ("f2fs: fix to tag gcing flag on page during file defragment"). Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/compress.c | 4 +++- fs/f2fs/file.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c index 7514661bbfbb..372616ca8fb5 100644 --- a/fs/f2fs/compress.c +++ b/fs/f2fs/compress.c @@ -1029,8 +1029,10 @@ static void set_cluster_dirty(struct compress_ctx *cc) int i; for (i = 0; i < cc->cluster_size; i++) - if (cc->rpages[i]) + if (cc->rpages[i]) { set_page_dirty(cc->rpages[i]); + set_page_private_gcing(cc->rpages[i]); + } } static int prepare_compress_overwrite(struct compress_ctx *cc, diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index a06f03d23762..d6962f4ccad3 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -1317,6 +1317,7 @@ static int __clone_blkaddrs(struct inode *src_inode, struct inode *dst_inode, } memcpy_page(pdst, 0, psrc, 0, PAGE_SIZE); set_page_dirty(pdst); + set_page_private_gcing(pdst); f2fs_put_page(pdst, 1); f2fs_put_page(psrc, 1); @@ -4054,6 +4055,7 @@ static int redirty_blocks(struct inode *inode, pgoff_t page_idx, int len) f2fs_bug_on(F2FS_I_SB(inode), !page); set_page_dirty(page); + set_page_private_gcing(page); f2fs_put_page(page, 1); f2fs_put_page(page, 0); } -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned
by Yifan Qiao 15 Mar '24

15 Mar '24

From: Qu Wenruo <wqu(a)suse.com> mainline inclusion from mainline-v6.8-rc2 commit f546c4282673497a06ecb6190b50ae7f6c85b02f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NHF CVE: CVE-2024-26616 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [BUG] There is a bug report that, on a ext4-converted btrfs, scrub leads to various problems, including: - "unable to find chunk map" errors BTRFS info (device vdb): scrub: started on devid 1 BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 4096 BTRFS critical (device vdb): unable to find chunk map for logical 2214744064 length 45056 This would lead to unrepariable errors. - Use-after-free KASAN reports: ================================================================== BUG: KASAN: slab-use-after-free in __blk_rq_map_sg+0x18f/0x7c0 Read of size 8 at addr ffff8881013c9040 by task btrfs/909 CPU: 0 PID: 909 Comm: btrfs Not tainted 6.7.0-x64v3-dbg #11 c50636e9419a8354555555245df535e380563b2b Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 2023.11-2 12/24/2023 Call Trace: <TASK> dump_stack_lvl+0x43/0x60 print_report+0xcf/0x640 kasan_report+0xa6/0xd0 __blk_rq_map_sg+0x18f/0x7c0 virtblk_prep_rq.isra.0+0x215/0x6a0 [virtio_blk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] virtio_queue_rqs+0xc4/0x310 [virtio_blk 19a65eeee9ae6fcf02edfad39bb9ddee07dcdaff] blk_mq_flush_plug_list.part.0+0x780/0x860 __blk_flush_plug+0x1ba/0x220 blk_finish_plug+0x3b/0x60 submit_initial_group_read+0x10a/0x290 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] flush_scrub_stripes+0x38e/0x430 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrub_stripe+0x82a/0xae0 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrub_chunk+0x178/0x200 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] scrub_enumerate_chunks+0x4bc/0xa30 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] btrfs_scrub_dev+0x398/0x810 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] btrfs_ioctl+0x4b9/0x3020 [btrfs e57987a360bed82fe8756dcd3e0de5406ccfe965] __x64_sys_ioctl+0xbd/0x100 do_syscall_64+0x5d/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7f47e5e0952b - Crash, mostly due to above use-after-free [CAUSE] The converted fs has the following data chunk layout: item 2 key (FIRST_CHUNK_TREE CHUNK_ITEM 2214658048) itemoff 16025 itemsize 80 length 86016 owner 2 stripe_len 65536 type DATA|single For above logical bytenr 2214744064, it's at the chunk end (2214658048 + 86016 = 2214744064). This means btrfs_submit_bio() would split the bio, and trigger endio function for both of the two halves. However scrub_submit_initial_read() would only expect the endio function to be called once, not any more. This means the first endio function would already free the bbio::bio, leaving the bvec freed, thus the 2nd endio call would lead to use-after-free. [FIX] - Make sure scrub_read_endio() only updates bits in its range Since we may read less than 64K at the end of the chunk, we should not touch the bits beyond chunk boundary. - Make sure scrub_submit_initial_read() only to read the chunk range This is done by calculating the real number of sectors we need to read, and add sector-by-sector to the bio. Thankfully the scrub read repair path won't need extra fixes: - scrub_stripe_submit_repair_read() With above fixes, we won't update error bit for range beyond chunk, thus scrub_stripe_submit_repair_read() should never submit any read beyond the chunk. Reported-by: Rongrong <i(a)rong.moe> Fixes: e02ee89baa66 ("btrfs: scrub: switch scrub_simple_mirror() to scrub_stripe infrastructure") Tested-by: Rongrong <i(a)rong.moe> Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/scrub.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c index 4445a52a0707..12147d0f2805 100644 --- a/fs/btrfs/scrub.c +++ b/fs/btrfs/scrub.c @@ -1099,12 +1099,22 @@ static void scrub_stripe_read_repair_worker(struct work_struct *work) static void scrub_read_endio(struct btrfs_bio *bbio) { struct scrub_stripe *stripe = bbio->private; + struct bio_vec *bvec; + int sector_nr = calc_sector_number(stripe, bio_first_bvec_all(&bbio->bio)); + int num_sectors; + u32 bio_size = 0; + int i; + + ASSERT(sector_nr < stripe->nr_sectors); + bio_for_each_bvec_all(bvec, &bbio->bio, i) + bio_size += bvec->bv_len; + num_sectors = bio_size >> stripe->bg->fs_info->sectorsize_bits; if (bbio->bio.bi_status) { - bitmap_set(&stripe->io_error_bitmap, 0, stripe->nr_sectors); - bitmap_set(&stripe->error_bitmap, 0, stripe->nr_sectors); + bitmap_set(&stripe->io_error_bitmap, sector_nr, num_sectors); + bitmap_set(&stripe->error_bitmap, sector_nr, num_sectors); } else { - bitmap_clear(&stripe->io_error_bitmap, 0, stripe->nr_sectors); + bitmap_clear(&stripe->io_error_bitmap, sector_nr, num_sectors); } bio_put(&bbio->bio); if (atomic_dec_and_test(&stripe->pending_io)) { @@ -1640,6 +1650,9 @@ static void scrub_submit_initial_read(struct scrub_ctx *sctx, { struct btrfs_fs_info *fs_info = sctx->fs_info; struct btrfs_bio *bbio; + unsigned int nr_sectors = min_t(u64, BTRFS_STRIPE_LEN, stripe->bg->start + + stripe->bg->length - stripe->logical) >> + fs_info->sectorsize_bits; int mirror = stripe->mirror_num; ASSERT(stripe->bg); @@ -1649,14 +1662,16 @@ static void scrub_submit_initial_read(struct scrub_ctx *sctx, bbio = btrfs_bio_alloc(SCRUB_STRIPE_PAGES, REQ_OP_READ, fs_info, scrub_read_endio, stripe); - /* Read the whole stripe. */ bbio->bio.bi_iter.bi_sector = stripe->logical >> SECTOR_SHIFT; - for (int i = 0; i < BTRFS_STRIPE_LEN >> PAGE_SHIFT; i++) { + /* Read the whole range inside the chunk boundary. */ + for (unsigned int cur = 0; cur < nr_sectors; cur++) { + struct page *page = scrub_stripe_get_page(stripe, cur); + unsigned int pgoff = scrub_stripe_get_page_offset(stripe, cur); int ret; - ret = bio_add_page(&bbio->bio, stripe->pages[i], PAGE_SIZE, 0); + ret = bio_add_page(&bbio->bio, page, fs_info->sectorsize, pgoff); /* We should have allocated enough bio vectors. */ - ASSERT(ret == PAGE_SIZE); + ASSERT(ret == fs_info->sectorsize); } atomic_inc(&stripe->pending_io); -- 2.39.2

2 1

[PATCH OLK-6.6] mm: cachestat: fix folio read-after-free in cache walk
by Jinjiang Tu 15 Mar '24

15 Mar '24

From: Nhat Pham <nphamcs(a)gmail.com> stable inclusion from stable-v6.6.21 commit ba60fdf75e89ea762bb617be578dc47f27655117 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I98BXJ CVE: CVE-2024-26630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a75cb05d53f4a6823a32deb078de1366954a804 upstream. In cachestat, we access the folio from the page cache's xarray to compute its page offset, and check for its dirty and writeback flags. However, we do not hold a reference to the folio before performing these actions, which means the folio can concurrently be released and reused as another folio/page/slab. Get around this altogether by just using xarray's existing machinery for the folio page offsets and dirty/writeback states. This changes behavior for tmpfs files to now always report zeroes in their dirty and writeback counters. This is okay as tmpfs doesn't follow conventional writeback cache behavior: its pages get "cleaned" during swapout, after which they're no longer resident etc. Link: https://lkml.kernel.org/r/20240220153409.GA216065@cmpxchg.org Fixes: cf264e1329fb ("cachestat: implement cachestat syscall") Reported-by: Jann Horn <jannh(a)google.com> Suggested-by: Matthew Wilcox <willy(a)infradead.org> Signed-off-by: Nhat Pham <nphamcs(a)gmail.com> Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Tested-by: Jann Horn <jannh(a)google.com> Cc: <stable(a)vger.kernel.org> [6.4+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/filemap.c | 51 ++++++++++++++++++++++++++------------------------- 1 file changed, 26 insertions(+), 25 deletions(-) diff --git a/mm/filemap.c b/mm/filemap.c index d2aad2ff2892..0ee7db4b22f4 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -4139,28 +4139,40 @@ static void filemap_cachestat(struct address_space *mapping, rcu_read_lock(); xas_for_each(&xas, folio, last_index) { + int order; unsigned long nr_pages; pgoff_t folio_first_index, folio_last_index; + /* + * Don't deref the folio. It is not pinned, and might + * get freed (and reused) underneath us. + * + * We *could* pin it, but that would be expensive for + * what should be a fast and lightweight syscall. + * + * Instead, derive all information of interest from + * the rcu-protected xarray. + */ + if (xas_retry(&xas, folio)) continue; + order = xa_get_order(xas.xa, xas.xa_index); + nr_pages = 1 << order; + folio_first_index = round_down(xas.xa_index, 1 << order); + folio_last_index = folio_first_index + nr_pages - 1; + + /* Folios might straddle the range boundaries, only count covered pages */ + if (folio_first_index < first_index) + nr_pages -= first_index - folio_first_index; + + if (folio_last_index > last_index) + nr_pages -= folio_last_index - last_index; + if (xa_is_value(folio)) { /* page is evicted */ void *shadow = (void *)folio; bool workingset; /* not used */ - int order = xa_get_order(xas.xa, xas.xa_index); - - nr_pages = 1 << order; - folio_first_index = round_down(xas.xa_index, 1 << order); - folio_last_index = folio_first_index + nr_pages - 1; - - /* Folios might straddle the range boundaries, only count covered pages */ - if (folio_first_index < first_index) - nr_pages -= first_index - folio_first_index; - - if (folio_last_index > last_index) - nr_pages -= folio_last_index - last_index; cs->nr_evicted += nr_pages; @@ -4178,24 +4190,13 @@ static void filemap_cachestat(struct address_space *mapping, goto resched; } - nr_pages = folio_nr_pages(folio); - folio_first_index = folio_pgoff(folio); - folio_last_index = folio_first_index + nr_pages - 1; - - /* Folios might straddle the range boundaries, only count covered pages */ - if (folio_first_index < first_index) - nr_pages -= first_index - folio_first_index; - - if (folio_last_index > last_index) - nr_pages -= folio_last_index - last_index; - /* page is in cache */ cs->nr_cache += nr_pages; - if (folio_test_dirty(folio)) + if (xas_get_mark(&xas, PAGECACHE_TAG_DIRTY)) cs->nr_dirty += nr_pages; - if (folio_test_writeback(folio)) + if (xas_get_mark(&xas, PAGECACHE_TAG_WRITEBACK)) cs->nr_writeback += nr_pages; resched: -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] jfs: fix two cve issue
by Long Li 15 Mar '24

15 Mar '24

This patch set fix two cve issue. Dongliang Mu (1): JFS: fix memleak in jfs_mount Edward Adam Davis (2): jfs: fix uaf in jfs_evict_inode jfs: fix array-index-out-of-bounds in diNewExt fs/jfs/jfs_imap.c | 3 +++ fs/jfs/jfs_mount.c | 57 ++++++++++++++++++++-------------------------- 2 files changed, 28 insertions(+), 32 deletions(-) -- 2.31.1

2 4

[PATCH openEuler-1.0-LTS] ceph: fix deadlock or deadcode of misusing dget()
by Yifan Qiao 15 Mar '24

15 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 CVE: CVE-2023-52583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH OLK-5.10] ceph: fix deadlock or deadcode of misusing dget()
by Yifan Qiao 15 Mar '24

15 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 CVE: CVE-2023-52583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH OLK-6.6] ceph: fix deadlock or deadcode of misusing dget()
by Yifan Qiao 15 Mar '24

15 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 CVE: CVE-2023-52583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Revert two stable patches to keep binary compatible
by Jialin Zhang 15 Mar '24

15 Mar '24

Jialin Zhang (2): Revert "media: dvb: symbol fixup for dvb_attach()" Revert "modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules" drivers/media/dvb-frontends/ascot2e.c | 2 +- drivers/media/dvb-frontends/atbm8830.c | 2 +- drivers/media/dvb-frontends/au8522_dig.c | 2 +- drivers/media/dvb-frontends/bcm3510.c | 2 +- drivers/media/dvb-frontends/cx22700.c | 2 +- drivers/media/dvb-frontends/cx22702.c | 2 +- drivers/media/dvb-frontends/cx24110.c | 2 +- drivers/media/dvb-frontends/cx24113.c | 2 +- drivers/media/dvb-frontends/cx24116.c | 2 +- drivers/media/dvb-frontends/cx24120.c | 2 +- drivers/media/dvb-frontends/cx24123.c | 2 +- drivers/media/dvb-frontends/cxd2820r_core.c | 2 +- drivers/media/dvb-frontends/cxd2841er.c | 4 ++-- drivers/media/dvb-frontends/cxd2880/cxd2880_top.c | 2 +- drivers/media/dvb-frontends/dib0070.c | 2 +- drivers/media/dvb-frontends/dib0090.c | 4 ++-- drivers/media/dvb-frontends/dib3000mb.c | 2 +- drivers/media/dvb-frontends/dib3000mc.c | 2 +- drivers/media/dvb-frontends/dib7000m.c | 2 +- drivers/media/dvb-frontends/dib7000p.c | 2 +- drivers/media/dvb-frontends/dib8000.c | 2 +- drivers/media/dvb-frontends/dib9000.c | 2 +- drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 +- drivers/media/dvb-frontends/drxd_hard.c | 2 +- drivers/media/dvb-frontends/drxk_hard.c | 2 +- drivers/media/dvb-frontends/ds3000.c | 2 +- drivers/media/dvb-frontends/dvb-pll.c | 2 +- drivers/media/dvb-frontends/ec100.c | 2 +- drivers/media/dvb-frontends/helene.c | 4 ++-- drivers/media/dvb-frontends/horus3a.c | 2 +- drivers/media/dvb-frontends/isl6405.c | 2 +- drivers/media/dvb-frontends/isl6421.c | 2 +- drivers/media/dvb-frontends/isl6423.c | 2 +- drivers/media/dvb-frontends/itd1000.c | 2 +- drivers/media/dvb-frontends/ix2505v.c | 2 +- drivers/media/dvb-frontends/l64781.c | 2 +- drivers/media/dvb-frontends/lg2160.c | 2 +- drivers/media/dvb-frontends/lgdt3305.c | 2 +- drivers/media/dvb-frontends/lgdt3306a.c | 2 +- drivers/media/dvb-frontends/lgdt330x.c | 2 +- drivers/media/dvb-frontends/lgs8gxx.c | 2 +- drivers/media/dvb-frontends/lnbh25.c | 2 +- drivers/media/dvb-frontends/lnbp21.c | 4 ++-- drivers/media/dvb-frontends/lnbp22.c | 2 +- drivers/media/dvb-frontends/m88ds3103.c | 2 +- drivers/media/dvb-frontends/m88rs2000.c | 2 +- drivers/media/dvb-frontends/mb86a16.c | 2 +- drivers/media/dvb-frontends/mb86a20s.c | 2 +- drivers/media/dvb-frontends/mt312.c | 2 +- drivers/media/dvb-frontends/mt352.c | 2 +- drivers/media/dvb-frontends/nxt200x.c | 2 +- drivers/media/dvb-frontends/nxt6000.c | 2 +- drivers/media/dvb-frontends/or51132.c | 2 +- drivers/media/dvb-frontends/or51211.c | 2 +- drivers/media/dvb-frontends/s5h1409.c | 2 +- drivers/media/dvb-frontends/s5h1411.c | 2 +- drivers/media/dvb-frontends/s5h1420.c | 2 +- drivers/media/dvb-frontends/s5h1432.c | 2 +- drivers/media/dvb-frontends/s921.c | 2 +- drivers/media/dvb-frontends/si21xx.c | 2 +- drivers/media/dvb-frontends/sp887x.c | 2 +- drivers/media/dvb-frontends/stb0899_drv.c | 2 +- drivers/media/dvb-frontends/stb6000.c | 2 +- drivers/media/dvb-frontends/stb6100.c | 2 +- drivers/media/dvb-frontends/stv0288.c | 2 +- drivers/media/dvb-frontends/stv0297.c | 2 +- drivers/media/dvb-frontends/stv0299.c | 2 +- drivers/media/dvb-frontends/stv0367.c | 6 +++--- drivers/media/dvb-frontends/stv0900_core.c | 2 +- drivers/media/dvb-frontends/stv090x.c | 2 +- drivers/media/dvb-frontends/stv6110.c | 2 +- drivers/media/dvb-frontends/stv6110x.c | 2 +- drivers/media/dvb-frontends/tda10021.c | 2 +- drivers/media/dvb-frontends/tda10023.c | 2 +- drivers/media/dvb-frontends/tda10048.c | 2 +- drivers/media/dvb-frontends/tda1004x.c | 4 ++-- drivers/media/dvb-frontends/tda10086.c | 2 +- drivers/media/dvb-frontends/tda665x.c | 2 +- drivers/media/dvb-frontends/tda8083.c | 2 +- drivers/media/dvb-frontends/tda8261.c | 2 +- drivers/media/dvb-frontends/tda826x.c | 2 +- drivers/media/dvb-frontends/ts2020.c | 2 +- drivers/media/dvb-frontends/tua6100.c | 2 +- drivers/media/dvb-frontends/ves1820.c | 2 +- drivers/media/dvb-frontends/ves1x93.c | 2 +- drivers/media/dvb-frontends/zl10036.c | 2 +- drivers/media/dvb-frontends/zl10039.c | 2 +- drivers/media/dvb-frontends/zl10353.c | 2 +- drivers/media/pci/bt8xx/dst.c | 2 +- drivers/media/pci/bt8xx/dst_ca.c | 2 +- drivers/media/pci/ddbridge/ddbridge-dummy-fe.c | 2 +- drivers/media/tuners/fc0011.c | 2 +- drivers/media/tuners/fc0012.c | 2 +- drivers/media/tuners/fc0013.c | 2 +- drivers/media/tuners/max2165.c | 2 +- drivers/media/tuners/mc44s803.c | 2 +- drivers/media/tuners/mt2060.c | 2 +- drivers/media/tuners/mt2131.c | 2 +- drivers/media/tuners/mt2266.c | 2 +- drivers/media/tuners/mxl5005s.c | 2 +- drivers/media/tuners/qt1010.c | 2 +- drivers/media/tuners/tda18218.c | 2 +- drivers/media/tuners/xc4000.c | 2 +- drivers/media/tuners/xc5000.c | 2 +- kernel/module.c | 15 ++------------- 105 files changed, 113 insertions(+), 124 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] powerpc/lib: Validate size for vector operations
by Zhu Wang 15 Mar '24

15 Mar '24

From: Naveen N Rao <naveen(a)kernel.org> mainline inclusion from mainline-v6.8-rc1 commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G83 CVE: CVE-2023-52606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr(). Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption. Signed-off-by: Naveen N Rao <naveen(a)kernel.org> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Build-tested-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- arch/powerpc/lib/sstep.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c index d81568f783e5..6c8531928274 100644 --- a/arch/powerpc/lib/sstep.c +++ b/arch/powerpc/lib/sstep.c @@ -473,6 +473,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -523,6 +525,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -567,6 +571,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u = {}; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ @@ -594,6 +601,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ -- 2.34.1

2 1

[PATCH OLK-5.10] powerpc/lib: Validate size for vector operations
by Zhu Wang 15 Mar '24

15 Mar '24

From: Naveen N Rao <naveen(a)kernel.org> mainline inclusion from mainline-v6.8-rc1 commit 8f9abaa6d7de0a70fc68acaedce290c1f96e2e59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G83 CVE: CVE-2023-52606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is determined separately in analyse_instr(). Add a check to validate the assumption on the maximum size of the operations, so as to prevent any unintended kernel stack corruption. Signed-off-by: Naveen N Rao <naveen(a)kernel.org> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Build-tested-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231123071705.397625-1-naveen@kernel.org Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- arch/powerpc/lib/sstep.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c index d81568f783e5..6c8531928274 100644 --- a/arch/powerpc/lib/sstep.c +++ b/arch/powerpc/lib/sstep.c @@ -473,6 +473,8 @@ static int do_fp_load(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -523,6 +525,8 @@ static int do_fp_store(struct instruction_op *op, unsigned long ea, } u; nb = GETSIZE(op->type); + if (nb > sizeof(u)) + return -EINVAL; if (!address_ok(regs, ea, nb)) return -EFAULT; rn = op->reg; @@ -567,6 +571,9 @@ static nokprobe_inline int do_vec_load(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u = {}; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ @@ -594,6 +601,9 @@ static nokprobe_inline int do_vec_store(int rn, unsigned long ea, u8 b[sizeof(__vector128)]; } u; + if (size > sizeof(u)) + return -EINVAL; + if (!address_ok(regs, ea & ~0xfUL, 16)) return -EFAULT; /* align to multiple of size */ -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: fix deadlock or deadcode of misusing dget()
by q00831684 15 Mar '24

15 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 CVE: CVE-2023-52583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ceph: fix deadlock or deadcode of misusing dget()
by q00831684 15 Mar '24

15 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 CVE: CVE-2023-52583 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1