- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ceph: fix deadlock or deadcode of misusing dget()
by q00831684 14 Mar '24

14 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH OLK-6.6] ceph: fix deadlock or deadcode of misusing dget()
by q00831684 14 Mar '24

14 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2 0/2] Fix CVE-2022-48629 and CVE-2022-48630
by GUO Zihua 14 Mar '24

14 Mar '24

This patch set fixes CVE-2022-48629 and CVE-2022-48630 Brian Masney (1): crypto: qcom-rng - ensure buffer for generate is completely filled Ondrej Mosnacek (1): crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ drivers/crypto/qcom-rng.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-48629
by GUO Zihua 14 Mar '24

14 Mar '24

This patchset fixes CVE-2022-48629 Brian Masney (1): crypto: qcom-rng - ensure buffer for generate is completely filled Ondrej Mosnacek (1): crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ drivers/crypto/qcom-rng.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-5.10 22883/30000] mm/share_pool.c:2573:7: warning: no previous prototype for '__mg_sp_alloc_nodemask'
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9e82708a746dc5d4ec8995a3e6edace2cf23c6fd commit: 8deff3a60ce1a9dffb552210f065fc9ed6a55f84 [22883/30000] mm/sharepool: Add mg_sp_alloc_nodemask config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240314/202403141613.ZRlTvvlC-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403141613.ZRlTvvlC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403141613.ZRlTvvlC-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/share_pool.c:2573:7: warning: no previous prototype for '__mg_sp_alloc_nodemask' [-Wmissing-prototypes] 2573 | void *__mg_sp_alloc_nodemask(unsigned long size, unsigned long sp_flags, int spg_id, | ^~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3037:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3037 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3037:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3355:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3355 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4071:41: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4071 | HUGETLB_ALLOC_BUDDY | HUGETLB_ALLOC_NORECLAIM); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4071:41: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4071:63: error: 'HUGETLB_ALLOC_NORECLAIM' undeclared (first use in this function) 4071 | HUGETLB_ALLOC_BUDDY | HUGETLB_ALLOC_NORECLAIM); | ^~~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4079:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4079 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4099:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4099 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4121:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4121 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4123:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4123 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors vim +/__mg_sp_alloc_nodemask +2573 mm/share_pool.c 2572 > 2573 void *__mg_sp_alloc_nodemask(unsigned long size, unsigned long sp_flags, int spg_id, 2574 nodemask_t *nodemask) 2575 { 2576 struct sp_area *spa = NULL; 2577 int ret = 0; 2578 struct sp_alloc_context ac; 2579 2580 if (!sp_is_enabled()) 2581 return ERR_PTR(-EOPNOTSUPP); 2582 2583 ret = sp_alloc_prepare(size, sp_flags, spg_id, &ac); 2584 if (ret) 2585 return ERR_PTR(ret); 2586 2587 try_again: 2588 spa = sp_alloc_area(ac.size_aligned, ac.sp_flags, ac.spg, 2589 ac.type, current->tgid); 2590 if (IS_ERR(spa)) { 2591 pr_err_ratelimited("alloc spa failed in allocation(potential no enough virtual memory when -75): %ld\n", 2592 PTR_ERR(spa)); 2593 ret = PTR_ERR(spa); 2594 goto out; 2595 } 2596 2597 ret = sp_alloc_mmap_populate(spa, &ac, nodemask); 2598 if (ret && ac.state == ALLOC_RETRY) { 2599 /* 2600 * The mempolicy for shared memory is located at backend file, which varies 2601 * between normal pages and huge pages. So we should set the mbind policy again 2602 * when we retry using normal pages. 2603 */ 2604 ac.have_mbind = false; 2605 goto try_again; 2606 } 2607 2608 out: 2609 sp_alloc_finish(ret, spa, &ac); 2610 if (ret) 2611 return ERR_PTR(ret); 2612 else 2613 return (void *)(spa->va_start); 2614 } 2615 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 14902/30000] vmscan.c:undefined reference to `kernel_swap_enabled'
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9e82708a746dc5d4ec8995a3e6edace2cf23c6fd commit: 79c68ab3280fab8ace1b10bf8eadce508ee89c3c [14902/30000] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-004-20240314 (https://download.01.org/0day-ci/archive/20240314/202403141618.ndy1WEyB-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403141618.ndy1WEyB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403141618.ndy1WEyB-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/retpoline.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/retpoline.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions ld: mm/vmscan.o: in function `balance_pgdat': >> vmscan.c:(.text+0xc5bf): undefined reference to `kernel_swap_enabled' ld: mm/vmscan.o: in function `try_to_free_pages': >> (.text+0xda7f): undefined reference to `kernel_swap_enabled' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ceph: fix deadlock or deadcode of misusing dget()
by q00831684 14 Mar '24

14 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: 189667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH OLK-5.10] ceph: fix deadlock or deadcode of misusing dget()
by q00831684 14 Mar '24

14 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: 189667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ceph: fix deadlock or deadcode of misusing dget()
by q00831684 14 Mar '24

14 Mar '24

From: Xiubo Li <xiubli(a)redhat.com> mainline inclusion from mainline-v6.8-rc1 commit b493ad718b1f0357394d2cdecbf00a44a36fa085 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I96G92 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it. Link: https://lore.kernel.org/r/20231116081919.GZ1957730@ZenIV Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Xiubo Li <xiubli(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ceph/caps.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 4c0b220e20ba..1cc433de4200 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -4174,12 +4174,14 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, struct inode *dir, int mds, int drop, int unless) { - struct dentry *parent = NULL; struct ceph_mds_request_release *rel = *p; struct ceph_dentry_info *di = ceph_dentry(dentry); int force = 0; int ret; + /* This shouldn't happen */ + BUG_ON(!dir); + /* * force an record for the directory caps if we have a dentry lease. * this is racy (can't take i_ceph_lock and d_lock together), but it @@ -4189,14 +4191,9 @@ int ceph_encode_dentry_release(void **p, struct dentry *dentry, spin_lock(&dentry->d_lock); if (di->lease_session && di->lease_session->s_mds == mds) force = 1; - if (!dir) { - parent = dget(dentry->d_parent); - dir = d_inode(parent); - } spin_unlock(&dentry->d_lock); ret = ceph_encode_inode_release(p, dir, mds, drop, unless, force); - dput(parent); spin_lock(&dentry->d_lock); if (ret && di->lease_session && di->lease_session->s_mds == mds) { -- 2.39.2

2 1

[openeuler:OLK-5.10 27244/30000] kernel/sched/core.c:9634:4: warning: format specifies type 'unsigned long long' but the argument has type 'int'
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9e82708a746dc5d4ec8995a3e6edace2cf23c6fd commit: 00d37128abe2687fac974c5d21aa67fac6518c7c [27244/30000] sched: Introduce smart grid scheduling strategy for cfs config: x86_64-buildonly-randconfig-001-20240314 (https://download.01.org/0day-ci/archive/20240314/202403141540.Qo9LqVrW-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403141540.Qo9LqVrW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403141540.Qo9LqVrW-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/core.c:13: kernel/sched/sched.h:1837:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1837 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:2746:6: warning: no previous prototype for function 'sched_set_stop_task' [-Wmissing-prototypes] 2746 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ kernel/sched/core.c:2746:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2746 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ | static kernel/sched/core.c:4121:10: warning: cast from 'void (*)(struct callback_head *)' to 'void (*)(struct rq *)' converts to incompatible function type [-Wcast-function-type-strict] 4121 | func = (void (*)(struct rq *))head->func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:9530:5: warning: no previous prototype for function 'tg_set_dynamic_affinity_mode' [-Wmissing-prototypes] 9530 | int tg_set_dynamic_affinity_mode(struct task_group *tg, u64 mode) | ^ kernel/sched/core.c:9530:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 9530 | int tg_set_dynamic_affinity_mode(struct task_group *tg, u64 mode) | ^ | static kernel/sched/core.c:9567:5: warning: no previous prototype for function 'tg_set_affinity_period' [-Wmissing-prototypes] 9567 | int tg_set_affinity_period(struct task_group *tg, u64 period_ms) | ^ kernel/sched/core.c:9567:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 9567 | int tg_set_affinity_period(struct task_group *tg, u64 period_ms) | ^ | static kernel/sched/core.c:9578:5: warning: no previous prototype for function 'tg_get_affinity_period' [-Wmissing-prototypes] 9578 | u64 tg_get_affinity_period(struct task_group *tg) | ^ kernel/sched/core.c:9578:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 9578 | u64 tg_get_affinity_period(struct task_group *tg) | ^ | static >> kernel/sched/core.c:9634:4: warning: format specifies type 'unsigned long long' but the argument has type 'int' [-Wformat] 9632 | seq_printf(sf, "sd_level %d, cpu list %*pbl, stay_cnt %llu\n", | ~~~~ | %d 9633 | i, cpumask_pr_args(ad->domains[i]), 9634 | schedstat_val(ad->stay_cnt[i])); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/stats.h:72:32: note: expanded from macro 'schedstat_val' 72 | # define schedstat_val(var) 0 | ^ 7 warnings generated. vim +9634 kernel/sched/core.c 9619 9620 static int cpu_affinity_stat_show(struct seq_file *sf, void *v) 9621 { 9622 struct task_group *tg = css_tg(seq_css(sf)); 9623 struct auto_affinity *auto_affi = tg->auto_affinity; 9624 struct affinity_domain *ad = &auto_affi->ad; 9625 int i; 9626 9627 seq_printf(sf, "period_active %d\n", auto_affi->period_active); 9628 seq_printf(sf, "dcount %d\n", ad->dcount); 9629 seq_printf(sf, "domain_mask 0x%x\n", ad->domain_mask); 9630 seq_printf(sf, "curr_level %d\n", ad->curr_level); 9631 for (i = 0; i < ad->dcount; i++) 9632 seq_printf(sf, "sd_level %d, cpu list %*pbl, stay_cnt %llu\n", 9633 i, cpumask_pr_args(ad->domains[i]), > 9634 schedstat_val(ad->stay_cnt[i])); 9635 9636 return 0; 9637 } 9638 #endif /* CONFIG_QOS_SCHED_SMART_GRID */ 9639 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 6/6] Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
by Baogen Shang 14 Mar '24

14 Mar '24

From: Tobias Heider <me(a)tobhe.de> stable inclusion from stable-v5.10.188 commit c377451012cec94f01b6c698409fec865e55dd3f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ] Fixes a bug where on the M1 mac mini initramfs-tools fails to include the necessary firmware into the initrd. Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") Signed-off-by: Tobias Heider <me(a)tobhe.de> Reviewed-by: Michael Chan <michael.chan(a)broadcom.com> Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/tg3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 9eb716acac04..39bef1809a97 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem(a)redhat.com) and Jeff Garzik (jgarzik@pobox MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); MODULE_LICENSE("GPL"); MODULE_FIRMWARE(FIRMWARE_TG3); +MODULE_FIRMWARE(FIRMWARE_TG357766); MODULE_FIRMWARE(FIRMWARE_TG3TSO); MODULE_FIRMWARE(FIRMWARE_TG3TSO5); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
by Baogen Shang 14 Mar '24

14 Mar '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v5.10.184 commit 3f6dfff5fe416bda6469cf235eaa9c54fee2a0bc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1eb4ef12591348c440ac9d6efcf7521e73cf2b10 ] As per the new udp tunnel framework, drivers which need to know the details of a port entry (i.e. port type) when it gets deleted should use the .set_port / .unset_port callbacks. Implementing the current .udp_tunnel_sync callback would mean that the deleted tunnel port entry would be all zeros. This used to work on older firmware because it would not check the input when deleting a tunnel port. With newer firmware, the delete will now fail and subsequent tunnel port allocation will fail as a result. Fixes: 442a35a5a7aa ("bnxt: convert to new udp_tunnel_nic infra") Reviewed-by: Kalesh Anakkur Purayil <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 ++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 4db84ed9d698..3dc826353b02 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -12099,26 +12099,37 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp) #endif /* CONFIG_RFS_ACCEL */ -static int bnxt_udp_tunnel_sync(struct net_device *netdev, unsigned int table) +static int bnxt_udp_tunnel_set_port(struct net_device *netdev, unsigned int table, + unsigned int entry, struct udp_tunnel_info *ti) { struct bnxt *bp = netdev_priv(netdev); - struct udp_tunnel_info ti; unsigned int cmd; - udp_tunnel_nic_get_port(netdev, table, 0, &ti); - if (ti.type == UDP_TUNNEL_TYPE_VXLAN) + if (ti->type == UDP_TUNNEL_TYPE_VXLAN) cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN; else cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE; - if (ti.port) - return bnxt_hwrm_tunnel_dst_port_alloc(bp, ti.port, cmd); + return bnxt_hwrm_tunnel_dst_port_alloc(bp, ti->port, cmd); +} + +static int bnxt_udp_tunnel_unset_port(struct net_device *netdev, unsigned int table, + unsigned int entry, struct udp_tunnel_info *ti) +{ + struct bnxt *bp = netdev_priv(netdev); + unsigned int cmd; + + if (ti->type == UDP_TUNNEL_TYPE_VXLAN) + cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN; + else + cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE; return bnxt_hwrm_tunnel_dst_port_free(bp, cmd); } static const struct udp_tunnel_nic_info bnxt_udp_tunnels = { - .sync_table = bnxt_udp_tunnel_sync, + .set_port = bnxt_udp_tunnel_set_port, + .unset_port = bnxt_udp_tunnel_unset_port, .flags = UDP_TUNNEL_NIC_INFO_MAY_SLEEP | UDP_TUNNEL_NIC_INFO_OPEN_ONLY, .tables = { -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] bnxt_en: Query default VLAN before VNIC setup on a VF
by Baogen Shang 14 Mar '24

14 Mar '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v5.10.184 commit deead0d8729f33f47cbedd0010a7e0e381527f9b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a9e4f501bc6ff1b6ecb60df54fbf2b54db43bfe ] We need to call bnxt_hwrm_func_qcfg() on a VF to query the default VLAN that may be setup by the PF. If a default VLAN is enabled, the VF cannot support VLAN acceleration on the receive side and the VNIC must be setup to strip out the default VLAN tag. If a default VLAN is not enabled, the VF can support VLAN acceleration on the receive side. The VNIC should be set up to strip or not strip the VLAN based on the RX VLAN acceleration setting. Without this call to determine the default VLAN before calling bnxt_setup_vnic(), the VNIC may not be set up correctly. For example, bnxt_setup_vnic() may set up to strip the VLAN tag based on stale default VLAN information. If RX VLAN acceleration is not enabled, the VLAN tag will be incorrectly stripped and the RX data path will not work correctly. Fixes: cf6645f8ebc6 ("bnxt_en: Add function for VF driver to query default VLAN.") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index b818d5f342d5..4db84ed9d698 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -8336,6 +8336,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init) goto err_out; } + if (BNXT_VF(bp)) + bnxt_hwrm_func_qcfg(bp); + rc = bnxt_setup_vnic(bp, 0); if (rc) goto err_out; -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] bnxt_en: Don't issue AP reset during ethtool's reset operation
by Baogen Shang 14 Mar '24

14 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.184 commit 84dbd27ad5dace21830c67d01470e9121a044b22 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1d997801c7cc6a7f542e46d5a6bf16f893ad3fe9 ] Only older NIC controller's firmware uses the PROC AP reset type. Firmware on 5731X/5741X and newer chips does not support this reset type. When bnxt_reset() issues a series of resets, this PROC AP reset may actually fail on these newer chips because the firmware is not ready to accept this unsupported command yet. Avoid this unnecessary error by skipping this reset type on chips that don't support it. Fixes: 7a13240e3718 ("bnxt_en: fix ethtool_reset_flags ABI violations") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c index d90b7b85c052..310c1d72205f 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -3446,7 +3446,7 @@ static int bnxt_reset(struct net_device *dev, u32 *flags) } } - if (req & BNXT_FW_RESET_AP) { + if (!BNXT_CHIP_P4_PLUS(bp) && (req & BNXT_FW_RESET_AP)) { /* This feature is not supported in older firmware versions */ if (bp->hwrm_spec_code >= 0x10803) { if (!bnxt_firmware_reset_ap(dev)) { -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] net: bcmgenet: Restore phy_stop() depending upon suspend/close
by Baogen Shang 14 Mar '24

14 Mar '24

From: Florian Fainelli <f.fainelli(a)gmail.com> stable inclusion from stable-v5.10.181 commit 43f6575004e0bbe0acc5d7a1955f326b22f38121 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 225c657945c4a6307741cb3cc89467eadcc26e9b ] Removing the phy_stop() from bcmgenet_netif_stop() ended up causing warnings from the PHY library that phy_start() is called from the RUNNING state since we are no longer stopping the PHY state machine during bcmgenet_suspend(). Restore the call to phy_stop() but make it conditional on being called from the close or suspend path. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Fixes: 93e0401e0fc0 ("net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()") Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Link: https://lore.kernel.org/r/20230515025608.2587012-1-f.fainelli@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 52c93701a9e4..f198144a7ce1 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3393,7 +3393,7 @@ static int bcmgenet_open(struct net_device *dev) return ret; } -static void bcmgenet_netif_stop(struct net_device *dev) +static void bcmgenet_netif_stop(struct net_device *dev, bool stop_phy) { struct bcmgenet_priv *priv = netdev_priv(dev); @@ -3408,6 +3408,8 @@ static void bcmgenet_netif_stop(struct net_device *dev) /* Disable MAC transmit. TX DMA disabled must be done before this */ umac_enable_set(priv, CMD_TX_EN, false); + if (stop_phy) + phy_stop(dev->phydev); bcmgenet_disable_rx_napi(priv); bcmgenet_intr_disable(priv); @@ -3433,7 +3435,7 @@ static int bcmgenet_close(struct net_device *dev) netif_dbg(priv, ifdown, dev, "bcmgenet_close\n"); - bcmgenet_netif_stop(dev); + bcmgenet_netif_stop(dev, false); /* Really kill the PHY state machine and disconnect from it */ phy_disconnect(dev->phydev); @@ -4235,7 +4237,7 @@ static int bcmgenet_suspend(struct device *d) netif_device_detach(dev); - bcmgenet_netif_stop(dev); + bcmgenet_netif_stop(dev, true); if (!device_may_wakeup(d)) phy_suspend(dev->phydev); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
by Baogen Shang 14 Mar '24

14 Mar '24

From: Florian Fainelli <f.fainelli(a)gmail.com> stable inclusion from stable-v5.10.181 commit e92727ed9e8b6798efc1e7ae44bbe7c44c453670 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ] The call to phy_stop() races with the later call to phy_disconnect(), resulting in concurrent phy_suspend() calls being run from different CPUs. The final call to phy_disconnect() ensures that the PHY is stopped and suspended, too. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 6ee6c34f28f2..52c93701a9e4 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3408,7 +3408,6 @@ static void bcmgenet_netif_stop(struct net_device *dev) /* Disable MAC transmit. TX DMA disabled must be done before this */ umac_enable_set(priv, CMD_TX_EN, false); - phy_stop(dev->phydev); bcmgenet_disable_rx_napi(priv); bcmgenet_intr_disable(priv); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] Upgrade driver for Broadcom NIC BCM57414
by Baogen Shang 14 Mar '24

14 Mar '24

From: Dapeng Yu <dapeng.yu(a)windriver.com> Upgrade driver for Broadcom NIC BCM57414 Florian Fainelli (2): net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close Somnath Kotur (2): bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks Sreekanth Reddy (1): bnxt_en: Don't issue AP reset during ethtool's reset operation Tobias Heider (1): Add MODULE_FIRMWARE() for FIRMWARE_TG357766. drivers/net/ethernet/broadcom/bnxt/bnxt.c | 28 ++++++++++++++----- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 9 +++--- drivers/net/ethernet/broadcom/tg3.c | 1 + 4 files changed, 28 insertions(+), 12 deletions(-) -- 2.43.0

1 0

[openeuler:OLK-5.10 333/30000] crypto/asymmetric_keys/pgp_public_key.c:35:27: error: field has incomplete type 'struct pgp_parse_context'
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9e82708a746dc5d4ec8995a3e6edace2cf23c6fd commit: c283657144c1475e571f0c1f34477af1f682a12f [333/30000] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-buildonly-randconfig-003-20240314 (https://download.01.org/0day-ci/archive/20240314/202403141305.rj6VMLiN-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403141305.rj6VMLiN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403141305.rj6VMLiN-lkp@intel.com/ All error/warnings (new ones prefixed by >>): >> crypto/asymmetric_keys/pgp_public_key.c:35:27: error: field has incomplete type 'struct pgp_parse_context' 35 | struct pgp_parse_context pgp; | ^ crypto/asymmetric_keys/pgp_public_key.c:35:9: note: forward declaration of 'struct pgp_parse_context' 35 | struct pgp_parse_context pgp; | ^ >> crypto/asymmetric_keys/pgp_public_key.c:48:18: warning: declaration of 'struct pgp_parse_pubkey' will not be visible outside of this function [-Wvisibility] 48 | struct pgp_parse_pubkey *pgp, | ^ >> crypto/asymmetric_keys/pgp_public_key.c:63:10: error: incomplete definition of type 'struct pgp_parse_pubkey' 63 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:85:25: error: incomplete definition of type 'struct pgp_parse_pubkey' 85 | digest_putc(digest, pgp->version); | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:87:11: error: incomplete definition of type 'struct pgp_parse_pubkey' 87 | a32 = pgp->creation_time; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:93:9: error: incomplete definition of type 'struct pgp_parse_pubkey' 93 | if (pgp->version < PGP_KEY_VERSION_4) { | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:96:10: error: incomplete definition of type 'struct pgp_parse_pubkey' 96 | if (pgp->expires_at) | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:97:14: error: incomplete definition of type 'struct pgp_parse_pubkey' 97 | a16 = (pgp->expires_at - pgp->creation_time) / 86400UL; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:97:32: error: incomplete definition of type 'struct pgp_parse_pubkey' 97 | a16 = (pgp->expires_at - pgp->creation_time) / 86400UL; | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:104:25: error: incomplete definition of type 'struct pgp_parse_pubkey' 104 | digest_putc(digest, pgp->pubkey_algo); | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:48:18: note: forward declaration of 'struct pgp_parse_pubkey' 48 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:121:16: warning: declaration of 'struct pgp_parse_pubkey' will not be visible outside of this function [-Wvisibility] 121 | struct pgp_parse_pubkey *pgp, | ^ crypto/asymmetric_keys/pgp_public_key.c:132:30: error: incomplete definition of type 'struct pgp_parse_pubkey' 132 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ~~~^ crypto/asymmetric_keys/pgp_public_key.c:121:16: note: forward declaration of 'struct pgp_parse_pubkey' 121 | struct pgp_parse_pubkey *pgp, | ^ >> crypto/asymmetric_keys/pgp_public_key.c:148:36: error: incompatible pointer types passing 'struct pgp_parse_pubkey *' to parameter of type 'struct pgp_parse_pubkey *' [-Werror,-Wincompatible-pointer-types] 148 | ret = pgp_calc_pkey_keyid(digest, pgp, pub); | ^~~ crypto/asymmetric_keys/pgp_public_key.c:48:36: note: passing argument to parameter 'pgp' here 48 | struct pgp_parse_pubkey *pgp, | ^ >> crypto/asymmetric_keys/pgp_public_key.c:201:26: error: variable has incomplete type 'struct pgp_parse_pubkey' 201 | struct pgp_parse_pubkey pgp; | ^ crypto/asymmetric_keys/pgp_public_key.c:201:9: note: forward declaration of 'struct pgp_parse_pubkey' 201 | struct pgp_parse_pubkey pgp; | ^ >> crypto/asymmetric_keys/pgp_public_key.c:224:8: error: implicit declaration of function 'pgp_parse_public_key' [-Werror,-Wimplicit-function-declaration] 224 | ret = pgp_parse_public_key(&data, &datalen, &pgp); | ^ crypto/asymmetric_keys/pgp_public_key.c:224:8: note: did you mean 'pgp_process_public_key'? crypto/asymmetric_keys/pgp_public_key.c:192:12: note: 'pgp_process_public_key' declared here 192 | static int pgp_process_public_key(struct pgp_parse_context *context, | ^ >> crypto/asymmetric_keys/pgp_public_key.c:310:8: error: implicit declaration of function 'pgp_parse_packets' [-Werror,-Wimplicit-function-declaration] 310 | ret = pgp_parse_packets(prep->data, prep->datalen, &ctx.pgp); | ^ 2 warnings and 14 errors generated. -- >> crypto/asymmetric_keys/pgp_preload.c:23:27: error: field has incomplete type 'struct pgp_parse_context' 23 | struct pgp_parse_context pgp; | ^ crypto/asymmetric_keys/pgp_preload.c:23:9: note: forward declaration of 'struct pgp_parse_context' 23 | struct pgp_parse_context pgp; | ^ >> crypto/asymmetric_keys/pgp_preload.c:110:8: error: implicit declaration of function 'pgp_parse_packets' [-Werror,-Wimplicit-function-declaration] 110 | ret = pgp_parse_packets(pgpdata, pgpdatalen, &ctx.pgp); | ^ 2 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +35 crypto/asymmetric_keys/pgp_public_key.c 4006f47d4e2171 Roberto Sassu 2021-03-03 33 4006f47d4e2171 Roberto Sassu 2021-03-03 34 struct pgp_key_data_parse_context { 4006f47d4e2171 Roberto Sassu 2021-03-03 @35 struct pgp_parse_context pgp; 4006f47d4e2171 Roberto Sassu 2021-03-03 36 struct public_key *pub; 4006f47d4e2171 Roberto Sassu 2021-03-03 37 unsigned char *raw_fingerprint; 4006f47d4e2171 Roberto Sassu 2021-03-03 38 char *fingerprint; a98cb7a4b757b7 David Howells 2021-03-03 39 const char *user_id; a98cb7a4b757b7 David Howells 2021-03-03 40 size_t user_id_len; a98cb7a4b757b7 David Howells 2021-03-03 41 size_t fingerprint_len; 4006f47d4e2171 Roberto Sassu 2021-03-03 42 }; 4006f47d4e2171 Roberto Sassu 2021-03-03 43 4006f47d4e2171 Roberto Sassu 2021-03-03 44 /* 4006f47d4e2171 Roberto Sassu 2021-03-03 45 * Calculate the public key ID (RFC4880 12.2) 4006f47d4e2171 Roberto Sassu 2021-03-03 46 */ 4006f47d4e2171 Roberto Sassu 2021-03-03 47 static int pgp_calc_pkey_keyid(struct shash_desc *digest, 4006f47d4e2171 Roberto Sassu 2021-03-03 @48 struct pgp_parse_pubkey *pgp, 4006f47d4e2171 Roberto Sassu 2021-03-03 49 struct public_key *pub) 4006f47d4e2171 Roberto Sassu 2021-03-03 50 { 4006f47d4e2171 Roberto Sassu 2021-03-03 51 unsigned int nb[MAX_MPI]; 4006f47d4e2171 Roberto Sassu 2021-03-03 52 unsigned int nn[MAX_MPI]; 4006f47d4e2171 Roberto Sassu 2021-03-03 53 unsigned int n; 4006f47d4e2171 Roberto Sassu 2021-03-03 54 size_t keylen = pub->keylen; 4006f47d4e2171 Roberto Sassu 2021-03-03 55 u8 *key_ptr = pub->key; 4006f47d4e2171 Roberto Sassu 2021-03-03 56 u8 *pp[MAX_MPI]; 4006f47d4e2171 Roberto Sassu 2021-03-03 57 u32 a32; 4006f47d4e2171 Roberto Sassu 2021-03-03 58 int npkey; 4006f47d4e2171 Roberto Sassu 2021-03-03 59 int i, ret; 4006f47d4e2171 Roberto Sassu 2021-03-03 60 4006f47d4e2171 Roberto Sassu 2021-03-03 61 kenter(""); 4006f47d4e2171 Roberto Sassu 2021-03-03 62 4006f47d4e2171 Roberto Sassu 2021-03-03 @63 n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; 4006f47d4e2171 Roberto Sassu 2021-03-03 64 for (i = 0; i < MAX_MPI && keylen > 0; i++) { 4006f47d4e2171 Roberto Sassu 2021-03-03 65 ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); 4006f47d4e2171 Roberto Sassu 2021-03-03 66 if (ret < 0) 4006f47d4e2171 Roberto Sassu 2021-03-03 67 return ret; 4006f47d4e2171 Roberto Sassu 2021-03-03 68 4006f47d4e2171 Roberto Sassu 2021-03-03 69 pp[i] = key_ptr + 2; 4006f47d4e2171 Roberto Sassu 2021-03-03 70 key_ptr += 2 + nn[i]; 4006f47d4e2171 Roberto Sassu 2021-03-03 71 keylen -= 2 + nn[i]; 4006f47d4e2171 Roberto Sassu 2021-03-03 72 n += 2 + nn[i]; 4006f47d4e2171 Roberto Sassu 2021-03-03 73 } 4006f47d4e2171 Roberto Sassu 2021-03-03 74 4006f47d4e2171 Roberto Sassu 2021-03-03 75 if (keylen != 0) { 4006f47d4e2171 Roberto Sassu 2021-03-03 76 pr_debug("excess %zu\n", keylen); 4006f47d4e2171 Roberto Sassu 2021-03-03 77 return -EBADMSG; 4006f47d4e2171 Roberto Sassu 2021-03-03 78 } 4006f47d4e2171 Roberto Sassu 2021-03-03 79 4006f47d4e2171 Roberto Sassu 2021-03-03 80 npkey = i; 4006f47d4e2171 Roberto Sassu 2021-03-03 81 4006f47d4e2171 Roberto Sassu 2021-03-03 82 digest_putc(digest, 0x99); /* ctb */ 4006f47d4e2171 Roberto Sassu 2021-03-03 83 digest_putc(digest, n >> 8); /* 16-bit header length */ 4006f47d4e2171 Roberto Sassu 2021-03-03 84 digest_putc(digest, n); 4006f47d4e2171 Roberto Sassu 2021-03-03 85 digest_putc(digest, pgp->version); 4006f47d4e2171 Roberto Sassu 2021-03-03 86 4006f47d4e2171 Roberto Sassu 2021-03-03 87 a32 = pgp->creation_time; 4006f47d4e2171 Roberto Sassu 2021-03-03 88 digest_putc(digest, a32 >> 24); 4006f47d4e2171 Roberto Sassu 2021-03-03 89 digest_putc(digest, a32 >> 16); 4006f47d4e2171 Roberto Sassu 2021-03-03 90 digest_putc(digest, a32 >> 8); 4006f47d4e2171 Roberto Sassu 2021-03-03 91 digest_putc(digest, a32 >> 0); 4006f47d4e2171 Roberto Sassu 2021-03-03 92 4006f47d4e2171 Roberto Sassu 2021-03-03 93 if (pgp->version < PGP_KEY_VERSION_4) { 4006f47d4e2171 Roberto Sassu 2021-03-03 94 u16 a16; 4006f47d4e2171 Roberto Sassu 2021-03-03 95 4006f47d4e2171 Roberto Sassu 2021-03-03 96 if (pgp->expires_at) 4006f47d4e2171 Roberto Sassu 2021-03-03 97 a16 = (pgp->expires_at - pgp->creation_time) / 86400UL; 4006f47d4e2171 Roberto Sassu 2021-03-03 98 else 4006f47d4e2171 Roberto Sassu 2021-03-03 99 a16 = 0; 4006f47d4e2171 Roberto Sassu 2021-03-03 100 digest_putc(digest, a16 >> 8); 4006f47d4e2171 Roberto Sassu 2021-03-03 101 digest_putc(digest, a16 >> 0); 4006f47d4e2171 Roberto Sassu 2021-03-03 102 } 4006f47d4e2171 Roberto Sassu 2021-03-03 103 4006f47d4e2171 Roberto Sassu 2021-03-03 104 digest_putc(digest, pgp->pubkey_algo); 4006f47d4e2171 Roberto Sassu 2021-03-03 105 4006f47d4e2171 Roberto Sassu 2021-03-03 106 for (i = 0; i < npkey; i++) { 4006f47d4e2171 Roberto Sassu 2021-03-03 107 digest_putc(digest, nb[i] >> 8); 4006f47d4e2171 Roberto Sassu 2021-03-03 108 digest_putc(digest, nb[i]); 4006f47d4e2171 Roberto Sassu 2021-03-03 109 crypto_shash_update(digest, pp[i], nn[i]); 4006f47d4e2171 Roberto Sassu 2021-03-03 110 } 4006f47d4e2171 Roberto Sassu 2021-03-03 111 ret = 0; 4006f47d4e2171 Roberto Sassu 2021-03-03 112 4006f47d4e2171 Roberto Sassu 2021-03-03 113 kleave(" = %d", ret); 4006f47d4e2171 Roberto Sassu 2021-03-03 114 return ret; 4006f47d4e2171 Roberto Sassu 2021-03-03 115 } 4006f47d4e2171 Roberto Sassu 2021-03-03 116 4006f47d4e2171 Roberto Sassu 2021-03-03 117 /* 4006f47d4e2171 Roberto Sassu 2021-03-03 118 * Calculate the public key ID fingerprint 4006f47d4e2171 Roberto Sassu 2021-03-03 119 */ 4006f47d4e2171 Roberto Sassu 2021-03-03 120 static int pgp_generate_fingerprint(struct pgp_key_data_parse_context *ctx, 4006f47d4e2171 Roberto Sassu 2021-03-03 @121 struct pgp_parse_pubkey *pgp, 4006f47d4e2171 Roberto Sassu 2021-03-03 122 struct public_key *pub) 4006f47d4e2171 Roberto Sassu 2021-03-03 123 { 4006f47d4e2171 Roberto Sassu 2021-03-03 124 struct crypto_shash *tfm; 4006f47d4e2171 Roberto Sassu 2021-03-03 125 struct shash_desc *digest; 4006f47d4e2171 Roberto Sassu 2021-03-03 126 char *fingerprint; 4006f47d4e2171 Roberto Sassu 2021-03-03 127 u8 *raw_fingerprint; 4006f47d4e2171 Roberto Sassu 2021-03-03 128 int digest_size, offset; 4006f47d4e2171 Roberto Sassu 2021-03-03 129 int ret, i; 4006f47d4e2171 Roberto Sassu 2021-03-03 130 4006f47d4e2171 Roberto Sassu 2021-03-03 131 ret = -ENOMEM; 4006f47d4e2171 Roberto Sassu 2021-03-03 132 tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? 4006f47d4e2171 Roberto Sassu 2021-03-03 133 "md5" : "sha1", 0, 0); 4006f47d4e2171 Roberto Sassu 2021-03-03 134 if (!tfm) 4006f47d4e2171 Roberto Sassu 2021-03-03 135 goto cleanup; 4006f47d4e2171 Roberto Sassu 2021-03-03 136 4006f47d4e2171 Roberto Sassu 2021-03-03 137 digest = kmalloc(sizeof(*digest) + crypto_shash_descsize(tfm), 4006f47d4e2171 Roberto Sassu 2021-03-03 138 GFP_KERNEL); 4006f47d4e2171 Roberto Sassu 2021-03-03 139 if (!digest) 4006f47d4e2171 Roberto Sassu 2021-03-03 140 goto cleanup_tfm; 4006f47d4e2171 Roberto Sassu 2021-03-03 141 4006f47d4e2171 Roberto Sassu 2021-03-03 142 digest->tfm = tfm; 4006f47d4e2171 Roberto Sassu 2021-03-03 143 crypto_shash_set_flags(digest->tfm, CRYPTO_TFM_REQ_MAY_SLEEP); 4006f47d4e2171 Roberto Sassu 2021-03-03 144 ret = crypto_shash_init(digest); 4006f47d4e2171 Roberto Sassu 2021-03-03 145 if (ret < 0) 4006f47d4e2171 Roberto Sassu 2021-03-03 146 goto cleanup_hash; 4006f47d4e2171 Roberto Sassu 2021-03-03 147 4006f47d4e2171 Roberto Sassu 2021-03-03 @148 ret = pgp_calc_pkey_keyid(digest, pgp, pub); 4006f47d4e2171 Roberto Sassu 2021-03-03 149 if (ret < 0) 4006f47d4e2171 Roberto Sassu 2021-03-03 150 goto cleanup_hash; 4006f47d4e2171 Roberto Sassu 2021-03-03 151 4006f47d4e2171 Roberto Sassu 2021-03-03 152 digest_size = crypto_shash_digestsize(tfm); 4006f47d4e2171 Roberto Sassu 2021-03-03 153 4006f47d4e2171 Roberto Sassu 2021-03-03 154 raw_fingerprint = kmalloc(digest_size, GFP_KERNEL); 4006f47d4e2171 Roberto Sassu 2021-03-03 155 if (!raw_fingerprint) 4006f47d4e2171 Roberto Sassu 2021-03-03 156 goto cleanup_hash; 4006f47d4e2171 Roberto Sassu 2021-03-03 157 4006f47d4e2171 Roberto Sassu 2021-03-03 158 ret = crypto_shash_final(digest, raw_fingerprint); 4006f47d4e2171 Roberto Sassu 2021-03-03 159 if (ret < 0) 4006f47d4e2171 Roberto Sassu 2021-03-03 160 goto cleanup_raw_fingerprint; 4006f47d4e2171 Roberto Sassu 2021-03-03 161 a98cb7a4b757b7 David Howells 2021-03-03 162 ctx->fingerprint_len = digest_size * 2; 4006f47d4e2171 Roberto Sassu 2021-03-03 163 fingerprint = kmalloc(digest_size * 2 + 1, GFP_KERNEL); 4006f47d4e2171 Roberto Sassu 2021-03-03 164 if (!fingerprint) 4006f47d4e2171 Roberto Sassu 2021-03-03 165 goto cleanup_raw_fingerprint; 4006f47d4e2171 Roberto Sassu 2021-03-03 166 4006f47d4e2171 Roberto Sassu 2021-03-03 167 offset = digest_size - 8; 4006f47d4e2171 Roberto Sassu 2021-03-03 168 pr_debug("offset %u/%u\n", offset, digest_size); 4006f47d4e2171 Roberto Sassu 2021-03-03 169 4006f47d4e2171 Roberto Sassu 2021-03-03 170 for (i = 0; i < digest_size; i++) 4006f47d4e2171 Roberto Sassu 2021-03-03 171 sprintf(fingerprint + i * 2, "%02x", raw_fingerprint[i]); 4006f47d4e2171 Roberto Sassu 2021-03-03 172 pr_debug("fingerprint %s\n", fingerprint); 4006f47d4e2171 Roberto Sassu 2021-03-03 173 4006f47d4e2171 Roberto Sassu 2021-03-03 174 ctx->raw_fingerprint = raw_fingerprint; 4006f47d4e2171 Roberto Sassu 2021-03-03 175 ctx->fingerprint = fingerprint; 4006f47d4e2171 Roberto Sassu 2021-03-03 176 ret = 0; 4006f47d4e2171 Roberto Sassu 2021-03-03 177 cleanup_raw_fingerprint: 4006f47d4e2171 Roberto Sassu 2021-03-03 178 if (ret < 0) 4006f47d4e2171 Roberto Sassu 2021-03-03 179 kfree(raw_fingerprint); 4006f47d4e2171 Roberto Sassu 2021-03-03 180 cleanup_hash: 4006f47d4e2171 Roberto Sassu 2021-03-03 181 kfree(digest); 4006f47d4e2171 Roberto Sassu 2021-03-03 182 cleanup_tfm: 4006f47d4e2171 Roberto Sassu 2021-03-03 183 crypto_free_shash(tfm); 4006f47d4e2171 Roberto Sassu 2021-03-03 184 cleanup: 4006f47d4e2171 Roberto Sassu 2021-03-03 185 kleave(" = %d", ret); 4006f47d4e2171 Roberto Sassu 2021-03-03 186 return ret; 4006f47d4e2171 Roberto Sassu 2021-03-03 187 } 4006f47d4e2171 Roberto Sassu 2021-03-03 188 4006f47d4e2171 Roberto Sassu 2021-03-03 189 /* 4006f47d4e2171 Roberto Sassu 2021-03-03 190 * Extract a public key or public subkey from the PGP stream. 4006f47d4e2171 Roberto Sassu 2021-03-03 191 */ 4006f47d4e2171 Roberto Sassu 2021-03-03 192 static int pgp_process_public_key(struct pgp_parse_context *context, 4006f47d4e2171 Roberto Sassu 2021-03-03 193 enum pgp_packet_tag type, 4006f47d4e2171 Roberto Sassu 2021-03-03 194 u8 headerlen, 4006f47d4e2171 Roberto Sassu 2021-03-03 195 const u8 *data, 4006f47d4e2171 Roberto Sassu 2021-03-03 196 size_t datalen) 4006f47d4e2171 Roberto Sassu 2021-03-03 197 { 4006f47d4e2171 Roberto Sassu 2021-03-03 198 const char *algo; 4006f47d4e2171 Roberto Sassu 2021-03-03 199 struct pgp_key_data_parse_context *ctx = 4006f47d4e2171 Roberto Sassu 2021-03-03 200 container_of(context, struct pgp_key_data_parse_context, pgp); 4006f47d4e2171 Roberto Sassu 2021-03-03 @201 struct pgp_parse_pubkey pgp; 4006f47d4e2171 Roberto Sassu 2021-03-03 202 struct public_key *pub; 4006f47d4e2171 Roberto Sassu 2021-03-03 203 int ret; 4006f47d4e2171 Roberto Sassu 2021-03-03 204 4006f47d4e2171 Roberto Sassu 2021-03-03 205 kenter(",%u,%u,,%zu", type, headerlen, datalen); 4006f47d4e2171 Roberto Sassu 2021-03-03 206 a98cb7a4b757b7 David Howells 2021-03-03 207 if (type == PGP_PKT_USER_ID) { a98cb7a4b757b7 David Howells 2021-03-03 208 ctx->user_id = data; a98cb7a4b757b7 David Howells 2021-03-03 209 ctx->user_id_len = datalen; a98cb7a4b757b7 David Howells 2021-03-03 210 kleave(" = 0 [user ID]"); a98cb7a4b757b7 David Howells 2021-03-03 211 return 0; a98cb7a4b757b7 David Howells 2021-03-03 212 } a98cb7a4b757b7 David Howells 2021-03-03 213 4006f47d4e2171 Roberto Sassu 2021-03-03 214 if (ctx->fingerprint) { 4006f47d4e2171 Roberto Sassu 2021-03-03 215 kleave(" = -ENOKEY [already]"); 4006f47d4e2171 Roberto Sassu 2021-03-03 216 return -EBADMSG; 4006f47d4e2171 Roberto Sassu 2021-03-03 217 } 4006f47d4e2171 Roberto Sassu 2021-03-03 218 4006f47d4e2171 Roberto Sassu 2021-03-03 219 pub = kzalloc(sizeof(struct public_key), GFP_KERNEL); 4006f47d4e2171 Roberto Sassu 2021-03-03 220 if (!pub) 4006f47d4e2171 Roberto Sassu 2021-03-03 221 return -ENOMEM; 4006f47d4e2171 Roberto Sassu 2021-03-03 222 pub->id_type = "PGP"; 4006f47d4e2171 Roberto Sassu 2021-03-03 223 4006f47d4e2171 Roberto Sassu 2021-03-03 @224 ret = pgp_parse_public_key(&data, &datalen, &pgp); 4006f47d4e2171 Roberto Sassu 2021-03-03 225 if (ret < 0) 4006f47d4e2171 Roberto Sassu 2021-03-03 226 goto cleanup; 4006f47d4e2171 Roberto Sassu 2021-03-03 227 4006f47d4e2171 Roberto Sassu 2021-03-03 228 if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) 4006f47d4e2171 Roberto Sassu 2021-03-03 229 goto cleanup_unsupported_pkey_algo; 4006f47d4e2171 Roberto Sassu 2021-03-03 230 algo = pgp_to_public_key_algo[pgp.pubkey_algo]; 4006f47d4e2171 Roberto Sassu 2021-03-03 231 if (!algo) 4006f47d4e2171 Roberto Sassu 2021-03-03 232 goto cleanup_unsupported_pkey_algo; 4006f47d4e2171 Roberto Sassu 2021-03-03 233 pub->pkey_algo = algo; 4006f47d4e2171 Roberto Sassu 2021-03-03 234 4006f47d4e2171 Roberto Sassu 2021-03-03 235 pub->key = kmemdup(data, datalen, GFP_KERNEL); 4006f47d4e2171 Roberto Sassu 2021-03-03 236 if (!pub->key) 4006f47d4e2171 Roberto Sassu 2021-03-03 237 goto cleanup_nomem; 4006f47d4e2171 Roberto Sassu 2021-03-03 238 4006f47d4e2171 Roberto Sassu 2021-03-03 239 pub->keylen = datalen; 4006f47d4e2171 Roberto Sassu 2021-03-03 240 4006f47d4e2171 Roberto Sassu 2021-03-03 241 ret = pgp_generate_fingerprint(ctx, &pgp, pub); 4006f47d4e2171 Roberto Sassu 2021-03-03 242 if (ret < 0) 4006f47d4e2171 Roberto Sassu 2021-03-03 243 goto cleanup; 4006f47d4e2171 Roberto Sassu 2021-03-03 244 4006f47d4e2171 Roberto Sassu 2021-03-03 245 ctx->pub = pub; 4006f47d4e2171 Roberto Sassu 2021-03-03 246 kleave(" = 0 [use]"); 4006f47d4e2171 Roberto Sassu 2021-03-03 247 return 0; 4006f47d4e2171 Roberto Sassu 2021-03-03 248 4006f47d4e2171 Roberto Sassu 2021-03-03 249 cleanup_unsupported_pkey_algo: 4006f47d4e2171 Roberto Sassu 2021-03-03 250 pr_debug("Unsupported public key algorithm %u\n", 4006f47d4e2171 Roberto Sassu 2021-03-03 251 pgp.pubkey_algo); 4006f47d4e2171 Roberto Sassu 2021-03-03 252 ret = -ENOPKG; 4006f47d4e2171 Roberto Sassu 2021-03-03 253 goto cleanup; 4006f47d4e2171 Roberto Sassu 2021-03-03 254 cleanup_nomem: 4006f47d4e2171 Roberto Sassu 2021-03-03 255 ret = -ENOMEM; 4006f47d4e2171 Roberto Sassu 2021-03-03 256 goto cleanup; 4006f47d4e2171 Roberto Sassu 2021-03-03 257 cleanup: 4006f47d4e2171 Roberto Sassu 2021-03-03 258 pr_devel("cleanup"); 4006f47d4e2171 Roberto Sassu 2021-03-03 259 kfree(pub->key); 4006f47d4e2171 Roberto Sassu 2021-03-03 260 kfree(pub); 4006f47d4e2171 Roberto Sassu 2021-03-03 261 kleave(" = %d", ret); 4006f47d4e2171 Roberto Sassu 2021-03-03 262 return ret; 4006f47d4e2171 Roberto Sassu 2021-03-03 263 } 4006f47d4e2171 Roberto Sassu 2021-03-03 264 :::::: The code at line 35 was first introduced by commit :::::: 4006f47d4e2171af60bfb5daab2bcce8bc02c309 KEYS: PGP data parser :::::: TO: Roberto Sassu <roberto.sassu(a)huawei.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 25742/30000] drivers/soc/hisilicon/pbha.c:100:21: warning: variable 'ptent' set but not used
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9e82708a746dc5d4ec8995a3e6edace2cf23c6fd commit: 6989680f878a16015e69291360e12cb9242e1360 [25742/30000] arm64: mm: Introduce procfs interface to update PBHA0 bit config: arm64-randconfig-002-20240312 (https://download.01.org/0day-ci/archive/20240314/202403141207.Ix7wfVox-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403141207.Ix7wfVox-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403141207.Ix7wfVox-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/soc/hisilicon/pbha.c: In function 'pbha_bit0_pte_range': >> drivers/soc/hisilicon/pbha.c:100:21: warning: variable 'ptent' set but not used [-Wunused-but-set-variable] 100 | pte_t *pte, ptent; | ^~~~~ vim +/ptent +100 drivers/soc/hisilicon/pbha.c 94 95 static int pbha_bit0_pte_range(pmd_t *pmd, unsigned long addr, 96 unsigned long end, struct mm_walk *walk) 97 { 98 int *op = (int *)walk->private; 99 struct vm_area_struct *vma = walk->vma; > 100 pte_t *pte, ptent; 101 spinlock_t *ptl; 102 bool set = (*op == SET_PBHA_BIT0_FLAG); 103 104 ptl = pmd_trans_huge_lock(pmd, vma); 105 if (ptl) { 106 pbha_bit0_update_pmd_bits(vma, addr, pmd, set); 107 108 spin_unlock(ptl); 109 return 0; 110 } 111 112 if (pmd_trans_unstable(pmd)) 113 return 0; 114 115 pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl); 116 for (; addr != end; pte++, addr += PAGE_SIZE) { 117 ptent = *pte; 118 119 pbha_bit0_update_pte_bits(vma, addr, pte, set); 120 } 121 pte_unmap_unlock(pte - 1, ptl); 122 cond_resched(); 123 return 0; 124 } 125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] iommu/iova: avoid softlockup in fq_flush_timeout
by Zhang Zekun 14 Mar '24

14 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8ZE0I CVE: NA -------------------------------- There is a softlockup undering cpu pressure test. ... pc : _raw_spin_unlock_irqrestore+0x14/0x78 lr : fq_flush_timeout+0x94/0x118 ... Call trace: _raw_spin_unlock_irqrestore+0x14/0x78 call_timer_fn+0x3c/0x1d0 expire_timers+0xcc/0x190 run_timer_softirq+0xfc/0x268 __do_softirq+0x128/0x3dc ____do_softirq+0x18/0x30 call_on_irq_stack+0x24/0x30 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0xc0/0xe8 el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x78/0x80 __schedule+0xf28/0x12a0 schedule+0x3c/0x108 schedule_timeout+0xa0/0x1d0 pktgen_thread_worker+0x1180/0x15d0 kthread+0x120/0x130 ret_from_fork+0x10/0x20 This is because the timer callback fq_flush_timeout may run more than 10ms, and timer may be processed continuously in the softirq so trigger softlockup. We can use work to deal with fq_ring_free for each cpu which may take long time, that to avoid triggering softlockup. Signed-off-by: Li Bin <huawei.libin(a)huawei.com> Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Reviewed-By: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/dma-iommu.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 037fcf826407..58a90521630e 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -85,6 +85,8 @@ struct iommu_dma_cookie { /* Options for dma-iommu use */ struct iommu_dma_options options; struct mutex mutex; + + struct work_struct free_iova_work; }; static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled); @@ -184,17 +186,11 @@ static void fq_flush_iotlb(struct iommu_dma_cookie *cookie) static void fq_flush_timeout(struct timer_list *t) { struct iommu_dma_cookie *cookie = from_timer(cookie, t, fq_timer); - int cpu; atomic_set(&cookie->fq_timer_on, 0); fq_flush_iotlb(cookie); - if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { - fq_ring_free(cookie, cookie->single_fq); - } else { - for_each_possible_cpu(cpu) - fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); - } + schedule_work(&cookie->free_iova_work); } static void queue_iova(struct iommu_dma_cookie *cookie, @@ -279,6 +275,7 @@ static void iommu_dma_free_fq(struct iommu_dma_cookie *cookie) return; del_timer_sync(&cookie->fq_timer); + flush_work(&cookie->free_iova_work); if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) iommu_dma_free_fq_single(cookie->single_fq); else @@ -330,6 +327,20 @@ static int iommu_dma_init_fq_percpu(struct iommu_dma_cookie *cookie) return 0; } +static void free_iova_work_func(struct work_struct *work) +{ + struct iommu_dma_cookie *cookie = container_of(work, struct iommu_dma_cookie, free_iova_work); + int cpu; + + if (cookie->options.qt == IOMMU_DMA_OPTS_SINGLE_QUEUE) { + fq_ring_free(cookie, cookie->single_fq); + } else { + for_each_possible_cpu(cpu) + fq_ring_free(cookie, per_cpu_ptr(cookie->percpu_fq, cpu)); + } + +} + /* sysfs updates are serialised by the mutex of the group owning @domain */ int iommu_dma_init_fq(struct iommu_domain *domain) { @@ -352,6 +363,7 @@ int iommu_dma_init_fq(struct iommu_domain *domain) return -ENOMEM; } + INIT_WORK(&cookie->free_iova_work, free_iova_work_func); timer_setup(&cookie->fq_timer, fq_flush_timeout, 0); atomic_set(&cookie->fq_timer_on, 0); /* -- 2.17.1

2 1

[PATCH OLK-6.6 v2 00/23] mTHP anon support
by Kefeng Wang 14 Mar '24

14 Mar '24

Let's support mTHP for anon page. David Hildenbrand (10): mm/rmap: drop stale comment in page_add_anon_rmap and hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive out of __page_set_anon_rmap() mm/rmap: move folio_test_anon() check out of __folio_set_anon() mm/rmap: warn on new PTE-mapped folios in page_add_anon_rmap() mm/rmap: simplify PageAnonExclusive sanity checks when adding anon rmap mm/rmap: pass folio to hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive() out of page_move_anon_rmap() mm/rmap: convert page_move_anon_rmap() to folio_move_anon_rmap() memory: move exclusivity detection in do_wp_page() into wp_can_reuse_anon_folio() uprobes: use pagesize-aligned virtual address when replacing pages Ryan Roberts (12): mm: more ptep_get() conversion mm/readahead: do not allow order-1 folio mm: allow deferred splitting of arbitrary anon large folios mm: non-pmd-mappable, large folios for folio_add_new_anon_rmap() mm: thp: introduce multi-size THP sysfs interface mm: thp: support allocation of anonymous multi-size THP selftests/mm/kugepaged: restore thp settings at exit selftests/mm: factor out thp settings management selftests/mm: support multi-size THP interface in thp_settings selftests/mm/khugepaged: enlighten for multi-size THP selftests/mm/cow: generalize do_run_with_thp() helper selftests/mm/cow: add tests for anonymous multi-size THP Zach O'Keefe (1): mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" Documentation/admin-guide/mm/transhuge.rst | 97 ++++- Documentation/filesystems/proc.rst | 6 +- fs/proc/task_mmu.c | 3 +- include/linux/huge_mm.h | 183 +++++++-- include/linux/rmap.h | 4 +- kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 248 +++++++++++-- mm/hugetlb.c | 6 +- mm/khugepaged.c | 20 +- mm/ksm.c | 2 +- mm/memory.c | 204 +++++++--- mm/migrate.c | 2 +- mm/page_vma_mapped.c | 3 +- mm/readahead.c | 14 +- mm/rmap.c | 126 ++++--- mm/userfaultfd.c | 2 +- tools/testing/selftests/mm/Makefile | 4 +- tools/testing/selftests/mm/cow.c | 183 ++++++--- tools/testing/selftests/mm/khugepaged.c | 410 ++++----------------- tools/testing/selftests/mm/run_vmtests.sh | 2 + tools/testing/selftests/mm/thp_settings.c | 349 ++++++++++++++++++ tools/testing/selftests/mm/thp_settings.h | 80 ++++ 23 files changed, 1333 insertions(+), 619 deletions(-) create mode 100644 tools/testing/selftests/mm/thp_settings.c create mode 100644 tools/testing/selftests/mm/thp_settings.h -- 2.27.0

2 24

[PATCH OLK-6.6 0/1] Add Huawei Intelligent Network Card Driver: hinic3
by Zhou Shuai 14 Mar '24

14 Mar '24

Update hinic3 driver, the NIC driver supports the following features: Supports IPv4/IPv6 TCP/UDP checksum offload, TSO/LRO/RSS. Supports interrupt aggregation parameter configuration and interrupt adaptation. Supports 802.1Q VLAN (Virtual Local Area Network) offloading and filtering. Supports NIC SR-IOV (Single Root I/O Virtualization). Loopback testing is supported. Support port lighting. Support Ethernet mouth self-negotiation, support pause frame. Zhou Shuai (1): net/hinic3: add huawei/hinic3 driver Documentation/networking/hinic3.rst | 128 + MAINTAINERS | 7 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hinic3/Kconfig | 13 + drivers/net/ethernet/huawei/hinic3/Makefile | 45 + .../ethernet/huawei/hinic3/cfg_mgt_comm_pub.h | 212 ++ .../ethernet/huawei/hinic3/comm_cmdq_intf.h | 239 ++ .../net/ethernet/huawei/hinic3/comm_defs.h | 100 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 664 +++++ .../ethernet/huawei/hinic3/hinic3_comm_cmd.h | 185 ++ .../ethernet/huawei/hinic3/hinic3_common.h | 118 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 1162 +++++++++ .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 983 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.c | 405 ++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.h | 78 + .../ethernet/huawei/hinic3/hinic3_ethtool.c | 1332 ++++++++++ .../huawei/hinic3/hinic3_ethtool_stats.c | 1259 ++++++++++ .../ethernet/huawei/hinic3/hinic3_filter.c | 483 ++++ .../net/ethernet/huawei/hinic3/hinic3_hw.h | 828 +++++++ .../net/ethernet/huawei/hinic3/hinic3_irq.c | 189 ++ .../net/ethernet/huawei/hinic3/hinic3_lld.h | 205 ++ .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 953 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_main.c | 1115 +++++++++ .../huawei/hinic3/hinic3_mgmt_interface.h | 1209 ++++++++++ .../net/ethernet/huawei/hinic3/hinic3_mt.h | 681 ++++++ .../huawei/hinic3/hinic3_netdev_ops.c | 1945 +++++++++++++++ .../net/ethernet/huawei/hinic3/hinic3_nic.h | 183 ++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.c | 1608 +++++++++++++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 620 +++++ .../huawei/hinic3/hinic3_nic_cfg_vf.c | 637 +++++ .../ethernet/huawei/hinic3/hinic3_nic_cmd.h | 159 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.c | 146 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.h | 21 + .../ethernet/huawei/hinic3/hinic3_nic_dev.h | 387 +++ .../ethernet/huawei/hinic3/hinic3_nic_event.c | 580 +++++ .../ethernet/huawei/hinic3/hinic3_nic_io.c | 1121 +++++++++ .../ethernet/huawei/hinic3/hinic3_nic_io.h | 325 +++ .../ethernet/huawei/hinic3/hinic3_nic_prof.c | 47 + .../ethernet/huawei/hinic3/hinic3_nic_prof.h | 59 + .../ethernet/huawei/hinic3/hinic3_nic_qp.h | 384 +++ .../ethernet/huawei/hinic3/hinic3_ntuple.c | 904 +++++++ .../ethernet/huawei/hinic3/hinic3_profile.h | 146 ++ .../net/ethernet/huawei/hinic3/hinic3_rss.c | 971 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_rss.h | 95 + .../ethernet/huawei/hinic3/hinic3_rss_cfg.c | 384 +++ .../net/ethernet/huawei/hinic3/hinic3_rx.c | 1343 +++++++++++ .../net/ethernet/huawei/hinic3/hinic3_rx.h | 155 ++ .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 213 ++ .../net/ethernet/huawei/hinic3/hinic3_tx.c | 1002 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_tx.h | 157 ++ .../net/ethernet/huawei/hinic3/hinic3_wq.h | 130 + .../huawei/hinic3/hw/hinic3_api_cmd.c | 1210 ++++++++++ .../huawei/hinic3/hw/hinic3_api_cmd.h | 286 +++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 1540 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 204 ++ .../ethernet/huawei/hinic3/hw/hinic3_common.c | 93 + .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 187 ++ .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 802 +++++++ .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 105 + .../huawei/hinic3/hw/hinic3_devlink.c | 392 +++ .../huawei/hinic3/hw/hinic3_devlink.h | 149 ++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 1379 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.h | 164 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.c | 453 ++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.h | 141 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 1480 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 332 +++ .../huawei/hinic3/hw/hinic3_hw_comm.c | 1540 ++++++++++++ .../huawei/hinic3/hw/hinic3_hw_comm.h | 51 + .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 598 +++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.h | 49 + .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 2133 +++++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 175 ++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 994 ++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.h | 113 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 1383 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 1837 ++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 1512 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 179 ++ .../huawei/hinic3/hw/hinic3_nictool.c | 974 ++++++++ .../huawei/hinic3/hw/hinic3_nictool.h | 35 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 18 + .../huawei/hinic3/hw/hinic3_prof_adap.c | 44 + .../huawei/hinic3/hw/hinic3_prof_adap.h | 109 + .../ethernet/huawei/hinic3/hw/hinic3_sm_lt.h | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sml_lt.c | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.c | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.h | 35 + .../net/ethernet/huawei/hinic3/hw/hinic3_wq.c | 157 ++ .../huawei/hinic3/hw/ossl_knl_linux.c | 107 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 818 +++++++ .../ethernet/huawei/hinic3/mgmt_msg_base.h | 27 + .../net/ethernet/huawei/hinic3/nic_cfg_comm.h | 63 + drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 35 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 268 +++ 99 files changed, 49344 insertions(+) create mode 100644 Documentation/networking/hinic3.rst create mode 100644 drivers/net/ethernet/huawei/hinic3/Kconfig create mode 100644 drivers/net/ethernet/huawei/hinic3/Makefile create mode 100644 drivers/net/ethernet/huawei/hinic3/cfg_mgt_comm_pub.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_cmdq_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_msg_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_comm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_crm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_filter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_hw.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_event.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_srv_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_common.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_pci_id_tbl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/ossl_knl_linux.c create mode 100644 drivers/net/ethernet/huawei/hinic3/mag_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/mgmt_msg_base.h create mode 100644 drivers/net/ethernet/huawei/hinic3/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h -- 2.24.0

2 2

[PATCH openEuler-22.03-LTS-SP1 6/6] Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
by Baogen Shang 14 Mar '24

14 Mar '24

From: Tobias Heider <me(a)tobhe.de> stable inclusion from stable-v5.10.188 commit c377451012cec94f01b6c698409fec865e55dd3f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ] Fixes a bug where on the M1 mac mini initramfs-tools fails to include the necessary firmware into the initrd. Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") Signed-off-by: Tobias Heider <me(a)tobhe.de> Reviewed-by: Michael Chan <michael.chan(a)broadcom.com> Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/tg3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 9eb716acac04..39bef1809a97 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem(a)redhat.com) and Jeff Garzik (jgarzik@pobox MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); MODULE_LICENSE("GPL"); MODULE_FIRMWARE(FIRMWARE_TG3); +MODULE_FIRMWARE(FIRMWARE_TG357766); MODULE_FIRMWARE(FIRMWARE_TG3TSO); MODULE_FIRMWARE(FIRMWARE_TG3TSO5); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
by Baogen Shang 14 Mar '24

14 Mar '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v5.10.184 commit 3f6dfff5fe416bda6469cf235eaa9c54fee2a0bc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1eb4ef12591348c440ac9d6efcf7521e73cf2b10 ] As per the new udp tunnel framework, drivers which need to know the details of a port entry (i.e. port type) when it gets deleted should use the .set_port / .unset_port callbacks. Implementing the current .udp_tunnel_sync callback would mean that the deleted tunnel port entry would be all zeros. This used to work on older firmware because it would not check the input when deleting a tunnel port. With newer firmware, the delete will now fail and subsequent tunnel port allocation will fail as a result. Fixes: 442a35a5a7aa ("bnxt: convert to new udp_tunnel_nic infra") Reviewed-by: Kalesh Anakkur Purayil <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 ++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 4db84ed9d698..3dc826353b02 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -12099,26 +12099,37 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp) #endif /* CONFIG_RFS_ACCEL */ -static int bnxt_udp_tunnel_sync(struct net_device *netdev, unsigned int table) +static int bnxt_udp_tunnel_set_port(struct net_device *netdev, unsigned int table, + unsigned int entry, struct udp_tunnel_info *ti) { struct bnxt *bp = netdev_priv(netdev); - struct udp_tunnel_info ti; unsigned int cmd; - udp_tunnel_nic_get_port(netdev, table, 0, &ti); - if (ti.type == UDP_TUNNEL_TYPE_VXLAN) + if (ti->type == UDP_TUNNEL_TYPE_VXLAN) cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN; else cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE; - if (ti.port) - return bnxt_hwrm_tunnel_dst_port_alloc(bp, ti.port, cmd); + return bnxt_hwrm_tunnel_dst_port_alloc(bp, ti->port, cmd); +} + +static int bnxt_udp_tunnel_unset_port(struct net_device *netdev, unsigned int table, + unsigned int entry, struct udp_tunnel_info *ti) +{ + struct bnxt *bp = netdev_priv(netdev); + unsigned int cmd; + + if (ti->type == UDP_TUNNEL_TYPE_VXLAN) + cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN; + else + cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE; return bnxt_hwrm_tunnel_dst_port_free(bp, cmd); } static const struct udp_tunnel_nic_info bnxt_udp_tunnels = { - .sync_table = bnxt_udp_tunnel_sync, + .set_port = bnxt_udp_tunnel_set_port, + .unset_port = bnxt_udp_tunnel_unset_port, .flags = UDP_TUNNEL_NIC_INFO_MAY_SLEEP | UDP_TUNNEL_NIC_INFO_OPEN_ONLY, .tables = { -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] bnxt_en: Query default VLAN before VNIC setup on a VF
by Baogen Shang 14 Mar '24

14 Mar '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v5.10.184 commit deead0d8729f33f47cbedd0010a7e0e381527f9b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a9e4f501bc6ff1b6ecb60df54fbf2b54db43bfe ] We need to call bnxt_hwrm_func_qcfg() on a VF to query the default VLAN that may be setup by the PF. If a default VLAN is enabled, the VF cannot support VLAN acceleration on the receive side and the VNIC must be setup to strip out the default VLAN tag. If a default VLAN is not enabled, the VF can support VLAN acceleration on the receive side. The VNIC should be set up to strip or not strip the VLAN based on the RX VLAN acceleration setting. Without this call to determine the default VLAN before calling bnxt_setup_vnic(), the VNIC may not be set up correctly. For example, bnxt_setup_vnic() may set up to strip the VLAN tag based on stale default VLAN information. If RX VLAN acceleration is not enabled, the VLAN tag will be incorrectly stripped and the RX data path will not work correctly. Fixes: cf6645f8ebc6 ("bnxt_en: Add function for VF driver to query default VLAN.") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index b818d5f342d5..4db84ed9d698 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -8336,6 +8336,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init) goto err_out; } + if (BNXT_VF(bp)) + bnxt_hwrm_func_qcfg(bp); + rc = bnxt_setup_vnic(bp, 0); if (rc) goto err_out; -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] bnxt_en: Don't issue AP reset during ethtool's reset operation
by Baogen Shang 14 Mar '24

14 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.184 commit 84dbd27ad5dace21830c67d01470e9121a044b22 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1d997801c7cc6a7f542e46d5a6bf16f893ad3fe9 ] Only older NIC controller's firmware uses the PROC AP reset type. Firmware on 5731X/5741X and newer chips does not support this reset type. When bnxt_reset() issues a series of resets, this PROC AP reset may actually fail on these newer chips because the firmware is not ready to accept this unsupported command yet. Avoid this unnecessary error by skipping this reset type on chips that don't support it. Fixes: 7a13240e3718 ("bnxt_en: fix ethtool_reset_flags ABI violations") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c index d90b7b85c052..310c1d72205f 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -3446,7 +3446,7 @@ static int bnxt_reset(struct net_device *dev, u32 *flags) } } - if (req & BNXT_FW_RESET_AP) { + if (!BNXT_CHIP_P4_PLUS(bp) && (req & BNXT_FW_RESET_AP)) { /* This feature is not supported in older firmware versions */ if (bp->hwrm_spec_code >= 0x10803) { if (!bnxt_firmware_reset_ap(dev)) { -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] net: bcmgenet: Restore phy_stop() depending upon suspend/close
by Baogen Shang 14 Mar '24

14 Mar '24

From: Florian Fainelli <f.fainelli(a)gmail.com> stable inclusion from stable-v5.10.181 commit 43f6575004e0bbe0acc5d7a1955f326b22f38121 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 225c657945c4a6307741cb3cc89467eadcc26e9b ] Removing the phy_stop() from bcmgenet_netif_stop() ended up causing warnings from the PHY library that phy_start() is called from the RUNNING state since we are no longer stopping the PHY state machine during bcmgenet_suspend(). Restore the call to phy_stop() but make it conditional on being called from the close or suspend path. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Fixes: 93e0401e0fc0 ("net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()") Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Link: https://lore.kernel.org/r/20230515025608.2587012-1-f.fainelli@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 52c93701a9e4..f198144a7ce1 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3393,7 +3393,7 @@ static int bcmgenet_open(struct net_device *dev) return ret; } -static void bcmgenet_netif_stop(struct net_device *dev) +static void bcmgenet_netif_stop(struct net_device *dev, bool stop_phy) { struct bcmgenet_priv *priv = netdev_priv(dev); @@ -3408,6 +3408,8 @@ static void bcmgenet_netif_stop(struct net_device *dev) /* Disable MAC transmit. TX DMA disabled must be done before this */ umac_enable_set(priv, CMD_TX_EN, false); + if (stop_phy) + phy_stop(dev->phydev); bcmgenet_disable_rx_napi(priv); bcmgenet_intr_disable(priv); @@ -3433,7 +3435,7 @@ static int bcmgenet_close(struct net_device *dev) netif_dbg(priv, ifdown, dev, "bcmgenet_close\n"); - bcmgenet_netif_stop(dev); + bcmgenet_netif_stop(dev, false); /* Really kill the PHY state machine and disconnect from it */ phy_disconnect(dev->phydev); @@ -4235,7 +4237,7 @@ static int bcmgenet_suspend(struct device *d) netif_device_detach(dev); - bcmgenet_netif_stop(dev); + bcmgenet_netif_stop(dev, true); if (!device_may_wakeup(d)) phy_suspend(dev->phydev); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
by Baogen Shang 14 Mar '24

14 Mar '24

From: Florian Fainelli <f.fainelli(a)gmail.com> stable inclusion from stable-v5.10.181 commit e92727ed9e8b6798efc1e7ae44bbe7c44c453670 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ] The call to phy_stop() races with the later call to phy_disconnect(), resulting in concurrent phy_suspend() calls being run from different CPUs. The final call to phy_disconnect() ensures that the PHY is stopped and suspended, too. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 6ee6c34f28f2..52c93701a9e4 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3408,7 +3408,6 @@ static void bcmgenet_netif_stop(struct net_device *dev) /* Disable MAC transmit. TX DMA disabled must be done before this */ umac_enable_set(priv, CMD_TX_EN, false); - phy_stop(dev->phydev); bcmgenet_disable_rx_napi(priv); bcmgenet_intr_disable(priv); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] Upgrade driver for Broadcom NIC BCM57414
by Baogen Shang 14 Mar '24

14 Mar '24

From: Dapeng Yu <dapeng.yu(a)windriver.com> Upgrade driver for Broadcom NIC BCM57414 Florian Fainelli (2): net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close Somnath Kotur (2): bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks Sreekanth Reddy (1): bnxt_en: Don't issue AP reset during ethtool's reset operation Tobias Heider (1): Add MODULE_FIRMWARE() for FIRMWARE_TG357766. drivers/net/ethernet/broadcom/bnxt/bnxt.c | 28 ++++++++++++++----- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 9 +++--- drivers/net/ethernet/broadcom/tg3.c | 1 + 4 files changed, 28 insertions(+), 12 deletions(-) -- 2.43.0

1 0

[PATCH OLK-5.10] drm: Don't unref the same fb many times by mistake due to deadlock handling
by Jinjie Ruan 14 Mar '24

14 Mar '24

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> stable inclusion from stable-v5.10.210 commit f55261469be87c55df13db76dc945f6bcd825105 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NI1 CVE: CVE-2023-52486 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c upstream. If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use. Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup. This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit. Cc: stable(a)vger.kernel.org Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231211081625.25704-1-ville.… Acked-by: Javier Martinez Canillas <javierm(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/gpu/drm/drm_plane.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c index 24f643982903..79249568bdec 100644 --- a/drivers/gpu/drm/drm_plane.c +++ b/drivers/gpu/drm/drm_plane.c @@ -1213,6 +1213,7 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, out: if (fb) drm_framebuffer_put(fb); + fb = NULL; if (plane->old_fb) drm_framebuffer_put(plane->old_fb); plane->old_fb = NULL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm: Don't unref the same fb many times by mistake due to deadlock handling
by Jinjie Ruan 14 Mar '24

14 Mar '24

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> stable inclusion from stable-v5.10.210 commit f55261469be87c55df13db76dc945f6bcd825105 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NI1 CVE: CVE-2023-52486 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cb4daf271302d71a6b9a7c01bd0b6d76febd8f0c upstream. If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry the whole thing from the top. But we forget to reset the fb pointer back to NULL, and so if we then get another error during the retry, before the fb lookup, we proceed the unref the same fb again without having gotten another reference. The end result is that the fb will (eventually) end up being freed while it's still in use. Reset fb to NULL once we've unreffed it to avoid doing it again until we've done another fb lookup. This turned out to be pretty easy to hit on a DG2 when doing async flips (and CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y). The first symptom I saw that drm_closefb() simply got stuck in a busy loop while walking the framebuffer list. Fortunately I was able to convince it to oops instead, and from there it was easier to track down the culprit. Cc: stable(a)vger.kernel.org Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20231211081625.25704-1-ville.… Acked-by: Javier Martinez Canillas <javierm(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/gpu/drm/drm_plane.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c index 2411b6de055e..4c530900a208 100644 --- a/drivers/gpu/drm/drm_plane.c +++ b/drivers/gpu/drm/drm_plane.c @@ -1183,6 +1183,7 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev, out: if (fb) drm_framebuffer_put(fb); + fb = NULL; if (plane->old_fb) drm_framebuffer_put(plane->old_fb); plane->old_fb = NULL; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 6/6] Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
by Dapeng Yu 14 Mar '24

14 Mar '24

From: Tobias Heider <me(a)tobhe.de> stable inclusion from stable-v5.10.188 commit c377451012cec94f01b6c698409fec865e55dd3f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 046f753da6143ee16452966915087ec8b0de3c70 ] Fixes a bug where on the M1 mac mini initramfs-tools fails to include the necessary firmware into the initrd. Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") Signed-off-by: Tobias Heider <me(a)tobhe.de> Reviewed-by: Michael Chan <michael.chan(a)broadcom.com> Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/tg3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c index 9eb716acac04..39bef1809a97 100644 --- a/drivers/net/ethernet/broadcom/tg3.c +++ b/drivers/net/ethernet/broadcom/tg3.c @@ -224,6 +224,7 @@ MODULE_AUTHOR("David S. Miller (davem(a)redhat.com) and Jeff Garzik (jgarzik@pobox MODULE_DESCRIPTION("Broadcom Tigon3 ethernet driver"); MODULE_LICENSE("GPL"); MODULE_FIRMWARE(FIRMWARE_TG3); +MODULE_FIRMWARE(FIRMWARE_TG357766); MODULE_FIRMWARE(FIRMWARE_TG3TSO); MODULE_FIRMWARE(FIRMWARE_TG3TSO5); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 5/6] bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
by Dapeng Yu 14 Mar '24

14 Mar '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v5.10.184 commit 3f6dfff5fe416bda6469cf235eaa9c54fee2a0bc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1eb4ef12591348c440ac9d6efcf7521e73cf2b10 ] As per the new udp tunnel framework, drivers which need to know the details of a port entry (i.e. port type) when it gets deleted should use the .set_port / .unset_port callbacks. Implementing the current .udp_tunnel_sync callback would mean that the deleted tunnel port entry would be all zeros. This used to work on older firmware because it would not check the input when deleting a tunnel port. With newer firmware, the delete will now fail and subsequent tunnel port allocation will fail as a result. Fixes: 442a35a5a7aa ("bnxt: convert to new udp_tunnel_nic infra") Reviewed-by: Kalesh Anakkur Purayil <kalesh-anakkur.purayil(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 ++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 4db84ed9d698..3dc826353b02 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -12099,26 +12099,37 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp) #endif /* CONFIG_RFS_ACCEL */ -static int bnxt_udp_tunnel_sync(struct net_device *netdev, unsigned int table) +static int bnxt_udp_tunnel_set_port(struct net_device *netdev, unsigned int table, + unsigned int entry, struct udp_tunnel_info *ti) { struct bnxt *bp = netdev_priv(netdev); - struct udp_tunnel_info ti; unsigned int cmd; - udp_tunnel_nic_get_port(netdev, table, 0, &ti); - if (ti.type == UDP_TUNNEL_TYPE_VXLAN) + if (ti->type == UDP_TUNNEL_TYPE_VXLAN) cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN; else cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE; - if (ti.port) - return bnxt_hwrm_tunnel_dst_port_alloc(bp, ti.port, cmd); + return bnxt_hwrm_tunnel_dst_port_alloc(bp, ti->port, cmd); +} + +static int bnxt_udp_tunnel_unset_port(struct net_device *netdev, unsigned int table, + unsigned int entry, struct udp_tunnel_info *ti) +{ + struct bnxt *bp = netdev_priv(netdev); + unsigned int cmd; + + if (ti->type == UDP_TUNNEL_TYPE_VXLAN) + cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN; + else + cmd = TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE; return bnxt_hwrm_tunnel_dst_port_free(bp, cmd); } static const struct udp_tunnel_nic_info bnxt_udp_tunnels = { - .sync_table = bnxt_udp_tunnel_sync, + .set_port = bnxt_udp_tunnel_set_port, + .unset_port = bnxt_udp_tunnel_unset_port, .flags = UDP_TUNNEL_NIC_INFO_MAY_SLEEP | UDP_TUNNEL_NIC_INFO_OPEN_ONLY, .tables = { -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 4/6] bnxt_en: Query default VLAN before VNIC setup on a VF
by Dapeng Yu 14 Mar '24

14 Mar '24

From: Somnath Kotur <somnath.kotur(a)broadcom.com> stable inclusion from stable-v5.10.184 commit deead0d8729f33f47cbedd0010a7e0e381527f9b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a9e4f501bc6ff1b6ecb60df54fbf2b54db43bfe ] We need to call bnxt_hwrm_func_qcfg() on a VF to query the default VLAN that may be setup by the PF. If a default VLAN is enabled, the VF cannot support VLAN acceleration on the receive side and the VNIC must be setup to strip out the default VLAN tag. If a default VLAN is not enabled, the VF can support VLAN acceleration on the receive side. The VNIC should be set up to strip or not strip the VLAN based on the RX VLAN acceleration setting. Without this call to determine the default VLAN before calling bnxt_setup_vnic(), the VNIC may not be set up correctly. For example, bnxt_setup_vnic() may set up to strip the VLAN tag based on stale default VLAN information. If RX VLAN acceleration is not enabled, the VLAN tag will be incorrectly stripped and the RX data path will not work correctly. Fixes: cf6645f8ebc6 ("bnxt_en: Add function for VF driver to query default VLAN.") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index b818d5f342d5..4db84ed9d698 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -8336,6 +8336,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init) goto err_out; } + if (BNXT_VF(bp)) + bnxt_hwrm_func_qcfg(bp); + rc = bnxt_setup_vnic(bp, 0); if (rc) goto err_out; -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 3/6] bnxt_en: Don't issue AP reset during ethtool's reset operation
by Dapeng Yu 14 Mar '24

14 Mar '24

From: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> stable inclusion from stable-v5.10.184 commit 84dbd27ad5dace21830c67d01470e9121a044b22 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1d997801c7cc6a7f542e46d5a6bf16f893ad3fe9 ] Only older NIC controller's firmware uses the PROC AP reset type. Firmware on 5731X/5741X and newer chips does not support this reset type. When bnxt_reset() issues a series of resets, this PROC AP reset may actually fail on these newer chips because the firmware is not ready to accept this unsupported command yet. Avoid this unnecessary error by skipping this reset type on chips that don't support it. Fixes: 7a13240e3718 ("bnxt_en: fix ethtool_reset_flags ABI violations") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Signed-off-by: Sreekanth Reddy <sreekanth.reddy(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c index d90b7b85c052..310c1d72205f 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -3446,7 +3446,7 @@ static int bnxt_reset(struct net_device *dev, u32 *flags) } } - if (req & BNXT_FW_RESET_AP) { + if (!BNXT_CHIP_P4_PLUS(bp) && (req & BNXT_FW_RESET_AP)) { /* This feature is not supported in older firmware versions */ if (bp->hwrm_spec_code >= 0x10803) { if (!bnxt_firmware_reset_ap(dev)) { -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 2/6] net: bcmgenet: Restore phy_stop() depending upon suspend/close
by Dapeng Yu 14 Mar '24

14 Mar '24

From: Florian Fainelli <f.fainelli(a)gmail.com> stable inclusion from stable-v5.10.181 commit 43f6575004e0bbe0acc5d7a1955f326b22f38121 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 225c657945c4a6307741cb3cc89467eadcc26e9b ] Removing the phy_stop() from bcmgenet_netif_stop() ended up causing warnings from the PHY library that phy_start() is called from the RUNNING state since we are no longer stopping the PHY state machine during bcmgenet_suspend(). Restore the call to phy_stop() but make it conditional on being called from the close or suspend path. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Fixes: 93e0401e0fc0 ("net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()") Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Link: https://lore.kernel.org/r/20230515025608.2587012-1-f.fainelli@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 52c93701a9e4..f198144a7ce1 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3393,7 +3393,7 @@ static int bcmgenet_open(struct net_device *dev) return ret; } -static void bcmgenet_netif_stop(struct net_device *dev) +static void bcmgenet_netif_stop(struct net_device *dev, bool stop_phy) { struct bcmgenet_priv *priv = netdev_priv(dev); @@ -3408,6 +3408,8 @@ static void bcmgenet_netif_stop(struct net_device *dev) /* Disable MAC transmit. TX DMA disabled must be done before this */ umac_enable_set(priv, CMD_TX_EN, false); + if (stop_phy) + phy_stop(dev->phydev); bcmgenet_disable_rx_napi(priv); bcmgenet_intr_disable(priv); @@ -3433,7 +3435,7 @@ static int bcmgenet_close(struct net_device *dev) netif_dbg(priv, ifdown, dev, "bcmgenet_close\n"); - bcmgenet_netif_stop(dev); + bcmgenet_netif_stop(dev, false); /* Really kill the PHY state machine and disconnect from it */ phy_disconnect(dev->phydev); @@ -4235,7 +4237,7 @@ static int bcmgenet_suspend(struct device *d) netif_device_detach(dev); - bcmgenet_netif_stop(dev); + bcmgenet_netif_stop(dev, true); if (!device_may_wakeup(d)) phy_suspend(dev->phydev); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 1/6] net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
by Dapeng Yu 14 Mar '24

14 Mar '24

From: Florian Fainelli <f.fainelli(a)gmail.com> stable inclusion from stable-v5.10.181 commit e92727ed9e8b6798efc1e7ae44bbe7c44c453670 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8L4MY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93e0401e0fc0c54b0ac05b687cd135c2ac38187c ] The call to phy_stop() races with the later call to phy_disconnect(), resulting in concurrent phy_suspend() calls being run from different CPUs. The final call to phy_disconnect() ensures that the PHY is stopped and suspended, too. Fixes: c96e731c93ff ("net: bcmgenet: connect and disconnect from the PHY state machine") Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dapeng Yu <dapeng.yu(a)windriver.com> --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c index 6ee6c34f28f2..52c93701a9e4 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3408,7 +3408,6 @@ static void bcmgenet_netif_stop(struct net_device *dev) /* Disable MAC transmit. TX DMA disabled must be done before this */ umac_enable_set(priv, CMD_TX_EN, false); - phy_stop(dev->phydev); bcmgenet_disable_rx_napi(priv); bcmgenet_intr_disable(priv); -- 2.43.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] Upgrade driver for Broadcom NIC BCM57414
by Dapeng Yu 14 Mar '24

14 Mar '24

From: Dapeng Yu <dapeng.yu(a)windriver.com> Upgrade driver for Broadcom NIC BCM57414 Florian Fainelli (2): net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close Somnath Kotur (2): bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks Sreekanth Reddy (1): bnxt_en: Don't issue AP reset during ethtool's reset operation Tobias Heider (1): Add MODULE_FIRMWARE() for FIRMWARE_TG357766. drivers/net/ethernet/broadcom/bnxt/bnxt.c | 28 ++++++++++++++----- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 9 +++--- drivers/net/ethernet/broadcom/tg3.c | 1 + 4 files changed, 28 insertions(+), 12 deletions(-) -- 2.43.0

1 0

[PATCH OLK-5.10] dmaengine: fix NULL pointer in channel unregistration function
by Zheng Yejian 14 Mar '24

14 Mar '24

From: Amelie Delaunay <amelie.delaunay(a)foss.st.com> stable inclusion from stable-v5.10.210 commit 9de69732dde4e443c1c7f89acbbed2c45a6a8e17 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I97NHW CVE: CVE-2023-52492 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit f5c24d94512f1b288262beda4d3dcb9629222fc7 ] __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local is nullified. When dma_async_device_unregister() is called (because of managed API or intentionally by DMA controller driver), channels are unconditionally unregistered, leading to this NULL pointer: [ 1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 [...] [ 1.484499] Call trace: [ 1.486930] device_del+0x40/0x394 [ 1.490314] device_unregister+0x20/0x7c [ 1.494220] __dma_async_device_channel_unregister+0x68/0xc0 Look at dma_async_device_register() function error path, channel device unregistration is done only if chan->local is not NULL. Then add the same condition at the beginning of __dma_async_device_channel_unregister() function, to avoid NULL pointer issue whatever the API used to reach this function. Fixes: d2fb0a043838 ("dmaengine: break out channel registration") Signed-off-by: Amelie Delaunay <amelie.delaunay(a)foss.st.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231213160452.2598073-1-amelie.delaunay@foss.st.… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/dma/dmaengine.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index 4ec7bb58c195..9559ebd61f3b 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -1108,6 +1108,9 @@ EXPORT_SYMBOL_GPL(dma_async_device_channel_register); static void __dma_async_device_channel_unregister(struct dma_device *device, struct dma_chan *chan) { + if (chan->local == NULL) + return; + WARN_ONCE(!device->device_release && chan->client_count, "%s called while %d clients hold a reference\n", __func__, chan->client_count); -- 2.25.1

2 1

[PATCH OLK-6.6 00/22] mTHP anon support
by Kefeng Wang 14 Mar '24

14 Mar '24

Let's support mTHP for anon page. David Hildenbrand (9): mm/rmap: drop stale comment in page_add_anon_rmap and hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive out of __page_set_anon_rmap() mm/rmap: move folio_test_anon() check out of __folio_set_anon() mm/rmap: warn on new PTE-mapped folios in page_add_anon_rmap() mm/rmap: simplify PageAnonExclusive sanity checks when adding anon rmap mm/rmap: pass folio to hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive() out of page_move_anon_rmap() mm/rmap: convert page_move_anon_rmap() to folio_move_anon_rmap() memory: move exclusivity detection in do_wp_page() into wp_can_reuse_anon_folio() Ryan Roberts (12): mm: more ptep_get() conversion mm/readahead: do not allow order-1 folio mm: allow deferred splitting of arbitrary anon large folios mm: non-pmd-mappable, large folios for folio_add_new_anon_rmap() mm: thp: introduce multi-size THP sysfs interface mm: thp: support allocation of anonymous multi-size THP selftests/mm/kugepaged: restore thp settings at exit selftests/mm: factor out thp settings management selftests/mm: support multi-size THP interface in thp_settings selftests/mm/khugepaged: enlighten for multi-size THP selftests/mm/cow: generalize do_run_with_thp() helper selftests/mm/cow: add tests for anonymous multi-size THP Zach O'Keefe (1): mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" Documentation/admin-guide/mm/transhuge.rst | 97 ++++- Documentation/filesystems/proc.rst | 6 +- fs/proc/task_mmu.c | 3 +- include/linux/huge_mm.h | 183 +++++++-- include/linux/rmap.h | 4 +- mm/filemap.c | 2 +- mm/huge_memory.c | 248 +++++++++++-- mm/hugetlb.c | 6 +- mm/khugepaged.c | 20 +- mm/ksm.c | 2 +- mm/memory.c | 204 +++++++--- mm/migrate.c | 2 +- mm/page_vma_mapped.c | 3 +- mm/readahead.c | 14 +- mm/rmap.c | 126 ++++--- mm/userfaultfd.c | 2 +- tools/testing/selftests/mm/Makefile | 4 +- tools/testing/selftests/mm/cow.c | 183 ++++++--- tools/testing/selftests/mm/khugepaged.c | 410 ++++----------------- tools/testing/selftests/mm/run_vmtests.sh | 2 + tools/testing/selftests/mm/thp_settings.c | 349 ++++++++++++++++++ tools/testing/selftests/mm/thp_settings.h | 80 ++++ 22 files changed, 1332 insertions(+), 618 deletions(-) create mode 100644 tools/testing/selftests/mm/thp_settings.c create mode 100644 tools/testing/selftests/mm/thp_settings.h -- 2.27.0

2 23

[openeuler:openEuler-1.0-LTS 18554/21854] drivers/net/ethernet/netswift/ngbe/ngbe_param.o: warning: objtool: missing symbol for section .text
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b318937609077b966b3bd130583ee3aaaa4d015a commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [18554/21854] net: ngbe: Add Netswift Giga NIC driver config: x86_64-buildonly-randconfig-006-20240313 (https://download.01.org/0day-ci/archive/20240314/202403140713.UrAXxk6G-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403140713.UrAXxk6G-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403140713.UrAXxk6G-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/ngbe/ngbe_param.c:23: In file included from drivers/net/ethernet/netswift/ngbe/ngbe.h:22: In file included from include/net/ip.h:32: In file included from include/net/route.h:31: include/net/ip_fib.h:417:10: warning: array index 0 is past the end of the array (that has type 'struct fib_nh[0]') [-Warray-bounds] 417 | *itag = FIB_RES_NH(*res).nh_tclassid<<16; | ^~~~~~~~~~~~~~~~ include/net/ip_fib.h:167:27: note: expanded from macro 'FIB_RES_NH' 167 | #define FIB_RES_NH(res) ((res).fi->fib_nh[0]) | ^ ~ include/net/ip_fib.h:127:2: note: array 'fib_nh' declared here 127 | struct fib_nh fib_nh[0]; | ^ In file included from drivers/net/ethernet/netswift/ngbe/ngbe_param.c:23: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ 2 warnings generated. >> drivers/net/ethernet/netswift/ngbe/ngbe_param.o: warning: objtool: missing symbol for section .text -- In file included from drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:30: In file included from drivers/net/ethernet/netswift/ngbe/ngbe.h:22: In file included from include/net/ip.h:32: In file included from include/net/route.h:31: include/net/ip_fib.h:417:10: warning: array index 0 is past the end of the array (that has type 'struct fib_nh[0]') [-Warray-bounds] 417 | *itag = FIB_RES_NH(*res).nh_tclassid<<16; | ^~~~~~~~~~~~~~~~ include/net/ip_fib.h:167:27: note: expanded from macro 'FIB_RES_NH' 167 | #define FIB_RES_NH(res) ((res).fi->fib_nh[0]) | ^ ~ include/net/ip_fib.h:127:2: note: array 'fib_nh' declared here 127 | struct fib_nh fib_nh[0]; | ^ In file included from drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:30: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ 2 warnings generated. >> drivers/net/ethernet/netswift/ngbe/ngbe_sriov.o: warning: objtool: missing symbol for section .text -- | = 0 drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1054:12: warning: variable 'value' is used uninitialized whenever '?:' condition is false [-Wsometimes-uninitialized] 1054 | status = TCALL(hw, phy.ops.read_reg_mdi, 4, 0, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1055:22: note: uninitialized use occurs here 1055 | *pause_bit = (u8)((value >> 10) & 0x3); | ^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1054:12: note: remove the '?:' if its condition is always true 1054 | status = TCALL(hw, phy.ops.read_reg_mdi, 4, 0, &value); | ^ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1049:11: note: initialize the variable 'value' to silence this warning 1049 | u16 value; | ^ | = 0 drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1074:5: warning: no previous prototype for function 'ngbe_phy_get_lp_advertised_pause' [-Wmissing-prototypes] 1074 | s32 ngbe_phy_get_lp_advertised_pause(struct ngbe_hw *hw, u8 *pause_bit) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1074:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1074 | s32 ngbe_phy_get_lp_advertised_pause(struct ngbe_hw *hw, u8 *pause_bit) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1098:12: warning: variable 'value' is used uninitialized whenever '?:' condition is false [-Wsometimes-uninitialized] 1098 | status = TCALL(hw, phy.ops.read_reg_mdi, 5, 0, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1099:22: note: uninitialized use occurs here 1099 | *pause_bit = (u8)((value >> 10) & 0x3); | ^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1098:12: note: remove the '?:' if its condition is always true 1098 | status = TCALL(hw, phy.ops.read_reg_mdi, 5, 0, &value); | ^ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1093:11: note: initialize the variable 'value' to silence this warning 1093 | u16 value; | ^ | = 0 drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1119:5: warning: no previous prototype for function 'ngbe_phy_set_pause_advertisement' [-Wmissing-prototypes] 1119 | s32 ngbe_phy_set_pause_advertisement(struct ngbe_hw *hw, u16 pause_bit) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1119:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1119 | s32 ngbe_phy_set_pause_advertisement(struct ngbe_hw *hw, u16 pause_bit) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1124:11: warning: variable 'value' is used uninitialized whenever '?:' condition is false [-Wsometimes-uninitialized] 1124 | status = TCALL(hw, phy.ops.read_reg, 4, 0, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1125:2: note: uninitialized use occurs here 1125 | value &= ~0xC00; | ^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1124:11: note: remove the '?:' if its condition is always true 1124 | status = TCALL(hw, phy.ops.read_reg, 4, 0, &value); | ^ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1121:11: note: initialize the variable 'value' to silence this warning 1121 | u16 value; | ^ | = 0 drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1138:12: warning: variable 'value' is used uninitialized whenever '?:' condition is false [-Wsometimes-uninitialized] 1138 | status = TCALL(hw, phy.ops.read_reg_mdi, 4, 0, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1139:3: note: uninitialized use occurs here 1139 | value &= ~0xC00; | ^~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1138:12: note: remove the '?:' if its condition is always true 1138 | status = TCALL(hw, phy.ops.read_reg_mdi, 4, 0, &value); | ^ drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2761:35: note: expanded from macro 'TCALL' 2761 | #define TCALL(hw, func, args...) (((hw)->func != NULL) \ | ^ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1134:11: note: initialize the variable 'value' to silence this warning 1134 | u16 value; | ^ | = 0 drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1167:5: warning: no previous prototype for function 'ngbe_phy_setup' [-Wmissing-prototypes] 1167 | s32 ngbe_phy_setup(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1167:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1167 | s32 ngbe_phy_setup(struct ngbe_hw *hw) | ^ | static 19 warnings generated. drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:123: warning: Function parameter or member 'device_type' not described in 'ngbe_phy_read_reg_mdi' >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19926/21854] block/blk-core.c:158:18: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b318937609077b966b3bd130583ee3aaaa4d015a commit: f39ebff66fab7eee91421258aa7254ee0bbac778 [19926/21854] block: support to dispatch bio asynchronously config: x86_64-randconfig-r121-20240313 (https://download.01.org/0day-ci/archive/20240314/202403140612.D8NswI2V-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403140612.D8NswI2V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403140612.D8NswI2V-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-core.c:158:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:158:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:158:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** >> block/blk-core.c:158:17: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct bio_dispatch_async_ctl *ctl @@ got struct bio_dispatch_async_ctl [noderef] __percpu * @@ block/blk-core.c:158:17: sparse: expected struct bio_dispatch_async_ctl *ctl block/blk-core.c:158:17: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu * block/blk-core.c:222:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:222:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:222:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** block/blk-core.c:222:17: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct bio_dispatch_async_ctl *ctl @@ got struct bio_dispatch_async_ctl [noderef] __percpu * @@ block/blk-core.c:222:17: sparse: expected struct bio_dispatch_async_ctl *ctl block/blk-core.c:222:17: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu * >> block/blk-core.c:259:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct bio_dispatch_async_ctl [noderef] __percpu **static [toplevel] bio_dispatch_async_ctl @@ got struct bio_dispatch_async_ctl *[noderef] __percpu * @@ block/blk-core.c:259:32: sparse: expected struct bio_dispatch_async_ctl [noderef] __percpu **static [toplevel] bio_dispatch_async_ctl block/blk-core.c:259:32: sparse: got struct bio_dispatch_async_ctl *[noderef] __percpu * block/blk-core.c:269:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:269:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:269:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** >> block/blk-core.c:269:59: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct bio_dispatch_async_ctl [noderef] __percpu * @@ got struct bio_dispatch_async_ctl *ctl @@ block/blk-core.c:269:59: sparse: expected struct bio_dispatch_async_ctl [noderef] __percpu * block/blk-core.c:269:59: sparse: got struct bio_dispatch_async_ctl *ctl block/blk-core.c: note: in included file: include/linux/backing-dev.h:511:19: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/backing-dev.h:511:19: sparse: struct rcu_device [noderef] __rcu * include/linux/backing-dev.h:511:19: sparse: struct rcu_device * vim +158 block/blk-core.c 152 153 static int bio_dispatch_work(void *data) 154 { 155 int loop_count = 0; 156 int cpu = smp_processor_id(); 157 struct bio_dispatch_async_ctl *ctl = > 158 *per_cpu_ptr(bio_dispatch_async_ctl, cpu); 159 160 for (;; loop_count++) { 161 struct bio_list bio_list_on_stack; 162 struct blk_plug plug; 163 struct bio *bio; 164 int count; 165 166 bio_list_init(&bio_list_on_stack); 167 count = collect_bio(ctl, &bio_list_on_stack); 168 169 if (!count) { 170 DEFINE_WAIT(wait); 171 172 for (;;) { 173 prepare_to_wait(&ctl->wait, &wait, 174 TASK_INTERRUPTIBLE); 175 count = collect_bio(ctl, &bio_list_on_stack); 176 if (count) 177 break; 178 schedule(); 179 loop_count = 0; 180 } 181 finish_wait(&ctl->wait, &wait); 182 183 } 184 185 blk_start_plug(&plug); 186 while ((bio = bio_list_pop(&bio_list_on_stack))) { 187 struct request_queue *q = bio->bi_disk->queue; 188 189 q->make_request_fn(q, bio); 190 } 191 blk_finish_plug(&plug); 192 193 /* prevent soft lockup */ 194 if (loop_count >= BIO_DISPATCH_MAX_LOOP) { 195 loop_count = 0; 196 cond_resched(); 197 } 198 } 199 200 return 0; 201 } 202 203 static int get_dispatch_cpu(struct request_queue *q, int cpu) 204 { 205 int *last_dispatch_cpu = per_cpu_ptr(q->last_dispatch_cpu, cpu); 206 207 cpu = cpumask_next(*last_dispatch_cpu, &q->dispatch_async_cpus); 208 if (cpu >= nr_cpu_ids) 209 cpu = cpumask_first(&q->dispatch_async_cpus); 210 211 *last_dispatch_cpu = cpu; 212 213 return cpu; 214 } 215 216 static void blk_queue_make_request_async(struct bio *bio) 217 { 218 struct request_queue *q = bio->bi_disk->queue; 219 int cpu = smp_processor_id(); 220 int dispatch_cpu = get_dispatch_cpu(q, cpu); 221 struct bio_dispatch_async_ctl *ctl = > 222 *per_cpu_ptr(bio_dispatch_async_ctl, dispatch_cpu); 223 224 spin_lock_irq(bio_async_lock(ctl, cpu)); 225 bio_list_add(bio_async_list(ctl, cpu), bio); 226 spin_unlock_irq(bio_async_lock(ctl, cpu)); 227 228 if (wq_has_sleeper(&ctl->wait)) 229 wake_up(&ctl->wait); 230 } 231 232 static blk_qc_t blk_queue_do_make_request(struct bio *bio) 233 { 234 struct request_queue *q = bio->bi_disk->queue; 235 int cpu = smp_processor_id(); 236 237 /* 238 * Don't dispatch bio asynchronously in following cases: 239 * 240 * 1) QUEUE_FLAG_DISPATCH_ASYNC is not set; 241 * 2) current cpu is the target cpu; 242 * 3) bio is flagged no wait; 243 * 4) TODO: return value of submit_bio() will be used in io polling. 244 */ 245 if (!test_bit(QUEUE_FLAG_DISPATCH_ASYNC, &q->queue_flags) || 246 cpumask_test_cpu(cpu, &q->dispatch_async_cpus) || 247 bio->bi_opf & REQ_NOWAIT) 248 return q->make_request_fn(q, bio); 249 250 /* return value is not concerned */ 251 blk_queue_make_request_async(bio); 252 return BLK_QC_T_NONE; 253 } 254 255 static void init_blk_queue_async_dispatch(void) 256 { 257 int cpu; 258 > 259 bio_dispatch_async_ctl = alloc_percpu(struct bio_dispatch_async_ctl *); 260 if (!bio_dispatch_async_ctl) 261 panic("Failed to alloc bio_dispatch_async_ctl\n"); 262 263 for_each_possible_cpu(cpu) { 264 int i; 265 struct bio_dispatch_async_ctl *ctl = 266 kmalloc(sizeof(struct bio_dispatch_async_ctl), 267 GFP_KERNEL | __GFP_NOFAIL); 268 > 269 *per_cpu_ptr(bio_dispatch_async_ctl, cpu) = ctl; 270 271 ctl->thread = 272 kthread_create_on_cpu(bio_dispatch_work, NULL, cpu, 273 "bio_dispatch_work_%u"); 274 if (IS_ERR_OR_NULL(ctl->thread)) 275 panic("Failed to create bio dispatch thread\n"); 276 277 ctl->list = kmalloc_array(nr_cpu_ids, 278 sizeof(struct bio_list) << BIO_ASYNC_LIST_SHIFT, 279 GFP_KERNEL | __GFP_NOFAIL); 280 ctl->lock = kmalloc_array(nr_cpu_ids, 281 sizeof(spinlock_t) << BIO_ASYNC_LOCK_SHIFT, 282 GFP_KERNEL | __GFP_NOFAIL); 283 for (i = 0; i < nr_cpu_ids; ++i) { 284 bio_list_init(bio_async_list(ctl, i)); 285 spin_lock_init(bio_async_lock(ctl, i)); 286 } 287 288 wake_up_process(ctl->thread); 289 init_waitqueue_head(&ctl->wait); 290 } 291 } 292 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION caa1ae20bcc64a80625a9449240580f5190ed3a0
by kernel test robot 14 Mar '24

14 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: caa1ae20bcc64a80625a9449240580f5190ed3a0 !5156 RDMA/srp: Do not call scsi_done() from srp_abort() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403131805.usWE0GjN-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403140313.Qwz6h2Lt-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403140406.xZgDttKV-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) mm/share_pool.c:4215:63: error: 'HUGETLB_ALLOC_NORECLAIM' undeclared (first use in this function) Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-003-20240312 | `-- mm-share_pool.c:error:HUGETLB_ALLOC_NORECLAIM-undeclared-(first-use-in-this-function) |-- x86_64-randconfig-122-20240313 | `-- drivers-ide-ide-io.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu `-- x86_64-randconfig-r121-20240313 |-- mm-clear_freelist_page.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer `-- mm-clear_freelist_page.c:sparse:sparse:incorrect-type-in-initializer-(incompatible-argument-(different-address-spaces))-expected-int-(-usertype-proc_handler-)(-...-)-got-int-(-)(-...-) clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode |-- x86_64-buildonly-randconfig-002-20240314 | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode `-- x86_64-buildonly-randconfig-003-20240314 |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 735m configs tested: 31 configs skipped: 97 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240314 clang x86_64 buildonly-randconfig-002-20240314 clang x86_64 buildonly-randconfig-003-20240314 clang x86_64 buildonly-randconfig-004-20240314 gcc x86_64 buildonly-randconfig-005-20240314 clang x86_64 buildonly-randconfig-006-20240314 clang x86_64 defconfig gcc x86_64 randconfig-001-20240314 gcc x86_64 randconfig-002-20240314 gcc x86_64 randconfig-003-20240314 clang x86_64 randconfig-004-20240314 clang x86_64 randconfig-005-20240314 clang x86_64 randconfig-006-20240314 clang x86_64 randconfig-011-20240314 clang x86_64 randconfig-012-20240314 gcc x86_64 randconfig-013-20240314 gcc x86_64 randconfig-014-20240314 gcc x86_64 randconfig-015-20240314 clang x86_64 randconfig-016-20240314 gcc x86_64 randconfig-071-20240314 gcc x86_64 randconfig-072-20240314 clang x86_64 randconfig-073-20240314 clang x86_64 randconfig-074-20240314 gcc x86_64 randconfig-075-20240314 gcc x86_64 randconfig-076-20240314 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS b318937609077b966b3bd130583ee3aaaa4d015a
by kernel test robot 14 Mar '24

14 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: b318937609077b966b3bd130583ee3aaaa4d015a !5157 RDMA/srp: Do not call scsi_done() from srp_abort() Warning reports: https://lore.kernel.org/oe-kbuild-all/202403132000.KEN5Ibpb-lkp@intel.com Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- x86_64-randconfig-122-20240313 `-- kernel-ktask.c:sparse:sparse:symbol-ktask_max_threads-was-not-declared.-Should-it-be-static elapsed time: 734m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16692/30000] mm/share_pool.c:4215:63: error: 'HUGETLB_ALLOC_NORECLAIM' undeclared
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: caa1ae20bcc64a80625a9449240580f5190ed3a0 commit: 107e2b7c4b1d007583efab423cc48429c87c6408 [16692/30000] mm/sharepool: Fix sharepool hugepage cgroup uncount error. config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240314/202403140406.xZgDttKV-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403140406.xZgDttKV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403140406.xZgDttKV-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:864:23: warning: no previous prototype for 'find_spg_node_by_spg' [-Wmissing-prototypes] 864 | struct sp_group_node *find_spg_node_by_spg(struct mm_struct *mm, | ^~~~~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3073:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3073 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3073:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3450:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3450 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: At top level: mm/share_pool.c:3942:6: warning: no previous prototype for 'spa_overview_show' [-Wmissing-prototypes] 3942 | void spa_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:4024:6: warning: no previous prototype for 'spg_overview_show' [-Wmissing-prototypes] 4024 | void spg_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4215:41: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4215 | HUGETLB_ALLOC_BUDDY | HUGETLB_ALLOC_NORECLAIM); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4215:41: note: each undeclared identifier is reported only once for each function it appears in >> mm/share_pool.c:4215:63: error: 'HUGETLB_ALLOC_NORECLAIM' undeclared (first use in this function) 4215 | HUGETLB_ALLOC_BUDDY | HUGETLB_ALLOC_NORECLAIM); | ^~~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4221 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4234:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4234 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4256:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4256 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4258:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4258 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_NORECLAIM +4215 mm/share_pool.c 4023 > 4024 void spg_overview_show(struct seq_file *seq) 4025 { 4026 if (!sp_is_enabled()) 4027 return; 4028 4029 if (seq != NULL) { 4030 seq_printf(seq, "Share pool total size: %lld KB, spa total num: %d.\n", 4031 byte2kb(atomic64_read(&sp_overall_stat.spa_total_size)), 4032 atomic_read(&sp_overall_stat.spa_total_num)); 4033 } else { 4034 pr_info("Share pool total size: %lld KB, spa total num: %d.\n", 4035 byte2kb(atomic64_read(&sp_overall_stat.spa_total_size)), 4036 atomic_read(&sp_overall_stat.spa_total_num)); 4037 } 4038 4039 down_read(&sp_group_sem); 4040 idr_for_each(&sp_group_idr, spg_info_show, seq); 4041 up_read(&sp_group_sem); 4042 4043 if (seq != NULL) 4044 seq_puts(seq, "\n"); 4045 else 4046 pr_info("\n"); 4047 } 4048 4049 static int spa_stat_show(struct seq_file *seq, void *offset) 4050 { 4051 spg_overview_show(seq); 4052 spa_overview_show(seq); 4053 /* print the file header */ 4054 seq_printf(seq, "%-10s %-16s %-16s %-10s %-7s %-5s %-8s %-8s\n", 4055 "Group ID", "va_start", "va_end", "Size(KB)", "Type", "Huge", "PID", "Ref"); 4056 spa_ro_stat_show(seq); 4057 spa_normal_stat_show(seq); 4058 spa_dvpp_stat_show(seq); 4059 return 0; 4060 } 4061 4062 static int proc_usage_by_group(int id, void *p, void *data) 4063 { 4064 struct sp_group *spg = p; 4065 struct seq_file *seq = data; 4066 struct sp_group_node *spg_node; 4067 struct mm_struct *mm; 4068 struct sp_group_master *master; 4069 int tgid; 4070 unsigned long anon, file, shmem, total_rss; 4071 4072 down_read(&spg->rw_lock); 4073 list_for_each_entry(spg_node, &spg->procs, proc_node) { 4074 master = spg_node->master; 4075 mm = master->mm; 4076 tgid = master->instat.tgid; 4077 4078 get_mm_rss_info(mm, &anon, &file, &shmem, &total_rss); 4079 4080 seq_printf(seq, "%-8d ", tgid); 4081 seq_printf(seq, "%-8d ", id); 4082 seq_printf(seq, "%-9ld %-9ld %-9ld %-8ld %-7ld %-7ld ", 4083 get_spg_proc_alloc(spg_node), 4084 get_spg_proc_k2u(spg_node), 4085 get_sp_res_by_spg_proc(spg_node), 4086 page2kb(mm->total_vm), page2kb(total_rss), 4087 page2kb(shmem)); 4088 print_process_prot(seq, spg_node->prot); 4089 seq_putc(seq, '\n'); 4090 } 4091 up_read(&spg->rw_lock); 4092 cond_resched(); 4093 4094 return 0; 4095 } 4096 4097 static int proc_group_usage_show(struct seq_file *seq, void *offset) 4098 { 4099 spg_overview_show(seq); 4100 spa_overview_show(seq); 4101 4102 /* print the file header */ 4103 seq_printf(seq, "%-8s %-8s %-9s %-9s %-9s %-8s %-7s %-7s %-4s\n", 4104 "PID", "Group_ID", "SP_ALLOC", "SP_K2U", "SP_RES", 4105 "VIRT", "RES", "Shm", "PROT"); 4106 /* print kthread buff_module_guard_work */ 4107 seq_printf(seq, "%-8s %-8s %-9lld %-9lld\n", 4108 "guard", "-", 4109 byte2kb(atomic64_read(&kthread_stat.alloc_size)), 4110 byte2kb(atomic64_read(&kthread_stat.k2u_size))); 4111 4112 down_read(&sp_group_sem); 4113 idr_for_each(&sp_group_idr, proc_usage_by_group, seq); 4114 up_read(&sp_group_sem); 4115 4116 return 0; 4117 } 4118 4119 static int proc_usage_show(struct seq_file *seq, void *offset) 4120 { 4121 struct sp_group_master *master = NULL; 4122 unsigned long anon, file, shmem, total_rss; 4123 long sp_res, sp_res_nsize, non_sp_res, non_sp_shm; 4124 struct sp_proc_stat *proc_stat; 4125 4126 seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", 4127 "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", 4128 "Non-SP_Shm", "VIRT"); 4129 4130 down_read(&sp_group_sem); 4131 mutex_lock(&master_list_lock); 4132 list_for_each_entry(master, &master_list, list_node) { 4133 proc_stat = &master->instat; 4134 get_mm_rss_info(master->mm, &anon, &file, &shmem, &total_rss); 4135 get_process_sp_res(master, &sp_res, &sp_res_nsize); 4136 get_process_non_sp_res(total_rss, shmem, sp_res_nsize, 4137 &non_sp_res, &non_sp_shm); 4138 seq_printf(seq, "%-8d %-16s %-9ld %-9ld %-9ld %-10ld %-10ld %-8ld\n", 4139 proc_stat->tgid, proc_stat->comm, 4140 get_proc_alloc(proc_stat), 4141 get_proc_k2u(proc_stat), 4142 sp_res, non_sp_res, non_sp_shm, 4143 page2kb(master->mm->total_vm)); 4144 } 4145 mutex_unlock(&master_list_lock); 4146 up_read(&sp_group_sem); 4147 4148 return 0; 4149 } 4150 4151 static void __init proc_sharepool_init(void) 4152 { 4153 if (!proc_mkdir("sharepool", NULL)) 4154 return; 4155 4156 proc_create_single_data("sharepool/spa_stat", 0400, NULL, spa_stat_show, NULL); 4157 proc_create_single_data("sharepool/proc_stat", 0400, NULL, proc_group_usage_show, NULL); 4158 proc_create_single_data("sharepool/proc_overview", 0400, NULL, proc_usage_show, NULL); 4159 } 4160 4161 /*** End of tatistical and maintenance functions ***/ 4162 4163 bool sp_check_addr(unsigned long addr) 4164 { 4165 if (sp_is_enabled() && mg_is_sharepool_addr(addr) && 4166 !check_aoscore_process(current)) 4167 return true; 4168 else 4169 return false; 4170 } 4171 4172 bool sp_check_mmap_addr(unsigned long addr, unsigned long flags) 4173 { 4174 if (sp_is_enabled() && mg_is_sharepool_addr(addr) && 4175 !check_aoscore_process(current) && !(flags & MAP_SHARE_POOL)) 4176 return true; 4177 else 4178 return false; 4179 } 4180 4181 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4182 struct vm_area_struct *vma, 4183 struct address_space *mapping, pgoff_t idx, 4184 unsigned long address, pte_t *ptep, unsigned int flags) 4185 { 4186 struct hstate *h = hstate_vma(vma); 4187 vm_fault_t ret = VM_FAULT_SIGBUS; 4188 unsigned long size; 4189 struct page *page; 4190 pte_t new_pte; 4191 spinlock_t *ptl; 4192 unsigned long haddr = address & huge_page_mask(h); 4193 bool new_page = false; 4194 int err; 4195 int node_id; 4196 struct sp_area *spa; 4197 4198 spa = vma->vm_private_data; 4199 if (!spa) { 4200 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4201 return ret; 4202 } 4203 node_id = spa->node_id; 4204 4205 retry: 4206 page = find_lock_page(mapping, idx); 4207 if (!page) { 4208 size = i_size_read(mapping->host) >> huge_page_shift(h); 4209 if (idx >= size) 4210 goto out; 4211 4212 page = alloc_huge_page(vma, haddr, 0); 4213 if (IS_ERR(page)) { 4214 page = hugetlb_alloc_hugepage(node_id, > 4215 HUGETLB_ALLOC_BUDDY | HUGETLB_ALLOC_NORECLAIM); 4216 if (!page) 4217 page = ERR_PTR(-ENOMEM); 4218 } 4219 if (IS_ERR(page)) { 4220 ptl = huge_pte_lock(h, mm, ptep); 4221 if (!huge_pte_none(huge_ptep_get(ptep))) { 4222 ret = 0; 4223 spin_unlock(ptl); 4224 goto out; 4225 } 4226 spin_unlock(ptl); 4227 ret = vmf_error(PTR_ERR(page)); 4228 goto out; 4229 } 4230 __SetPageUptodate(page); 4231 new_page = true; 4232 4233 /* sharepool pages are all shared */ 4234 err = huge_add_to_page_cache(page, mapping, idx); 4235 if (err) { 4236 put_page(page); 4237 if (err == -EEXIST) 4238 goto retry; 4239 goto out; 4240 } 4241 } 4242 4243 4244 ptl = huge_pte_lock(h, mm, ptep); 4245 size = i_size_read(mapping->host) >> huge_page_shift(h); 4246 if (idx >= size) 4247 goto backout; 4248 4249 ret = 0; 4250 if (!huge_pte_none(huge_ptep_get(ptep))) 4251 goto backout; 4252 4253 page_dup_rmap(page, true); 4254 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4255 && (vma->vm_flags & VM_SHARED))); 4256 set_huge_pte_at(mm, haddr, ptep, new_pte); 4257 4258 hugetlb_count_add(pages_per_huge_page(h), mm); 4259 4260 spin_unlock(ptl); 4261 4262 if (new_page) { 4263 SetPagePrivate(&page[1]); 4264 } 4265 4266 unlock_page(page); 4267 out: 4268 return ret; 4269 4270 backout: 4271 spin_unlock(ptl); 4272 unlock_page(page); 4273 put_page(page); 4274 goto out; 4275 } 4276 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 11013/30000] drivers/ide/ide-io.c:456:58: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 14 Mar '24

14 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: caa1ae20bcc64a80625a9449240580f5190ed3a0 commit: 8a6bee347626968d467aef07453c4547bc23cb64 [11013/30000] blk-mq: fix potential uaf for 'queue_hw_ctx' config: x86_64-randconfig-122-20240313 (https://download.01.org/0day-ci/archive/20240314/202403140313.Qwz6h2Lt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240314/202403140313.Qwz6h2Lt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403140313.Qwz6h2Lt-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/ide/ide-io.c:456:58: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ drivers/ide/ide-io.c:456:58: sparse: expected struct blk_mq_hw_ctx *hctx drivers/ide/ide-io.c:456:58: sparse: got struct blk_mq_hw_ctx [noderef] __rcu * vim +456 drivers/ide/ide-io.c 5b31f855f10d00 Bartlomiej Zolnierkiewicz 2009-01-06 446 782b86e2656762 Jens Axboe 2011-04-05 447 void ide_requeue_and_plug(ide_drive_t *drive, struct request *rq) 782b86e2656762 Jens Axboe 2011-04-05 448 { 782b86e2656762 Jens Axboe 2011-04-05 449 struct request_queue *q = drive->queue; 782b86e2656762 Jens Axboe 2011-04-05 450 600335205b8d16 Jens Axboe 2018-10-26 451 /* Use 3ms as that was the old plug delay */ 600335205b8d16 Jens Axboe 2018-10-26 452 if (rq) { 600335205b8d16 Jens Axboe 2018-10-26 453 blk_mq_requeue_request(rq, false); 600335205b8d16 Jens Axboe 2018-10-26 454 blk_mq_delay_kick_requeue_list(q, 3); 600335205b8d16 Jens Axboe 2018-10-26 455 } else 600335205b8d16 Jens Axboe 2018-10-26 @456 blk_mq_delay_run_hw_queue(q->queue_hw_ctx[0], 3); 782b86e2656762 Jens Axboe 2011-04-05 457 } 782b86e2656762 Jens Axboe 2011-04-05 458 :::::: The code at line 456 was first introduced by commit :::::: 600335205b8d162891b5ef2e32343f5b8020efd8 ide: convert to blk-mq :::::: TO: Jens Axboe <axboe(a)kernel.dk> :::::: CC: Jens Axboe <axboe(a)kernel.dk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/6] Upgrade driver for Broadcom NIC BCM57414
by Dapeng Yu 14 Mar '24

14 Mar '24

Upgrade driver for Broadcom NIC BCM57414 Florian Fainelli (2): net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop() net: bcmgenet: Restore phy_stop() depending upon suspend/close Somnath Kotur (2): bnxt_en: Query default VLAN before VNIC setup on a VF bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks Sreekanth Reddy (1): bnxt_en: Don't issue AP reset during ethtool's reset operation Tobias Heider (1): Add MODULE_FIRMWARE() for FIRMWARE_TG357766. drivers/net/ethernet/broadcom/bnxt/bnxt.c | 28 ++++++++++++++----- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- .../net/ethernet/broadcom/genet/bcmgenet.c | 9 +++--- drivers/net/ethernet/broadcom/tg3.c | 1 + 4 files changed, 28 insertions(+), 12 deletions(-) -- 2.43.0

1 6

[openeuler:OLK-6.6 1812/3958] kernel/sched/fair.c:175:5: sparse: sparse: symbol 'sysctl_sched_util_low_pct' was not declared. Should it be static?
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f066d3699b4816fda2b6f452885b51bd22199c43 commit: 2e1dfc02d115143587ccfee1815ad295763050f2 [1812/3958] sched: Adjust wakeup cpu range according CPU util dynamicly config: x86_64-randconfig-123-20240313 (https://download.01.org/0day-ci/archive/20240313/202403132127.OaVz6UjY-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403132127.OaVz6UjY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403132127.OaVz6UjY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:143:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:144:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? >> kernel/sched/fair.c:175:5: sparse: sparse: symbol 'sysctl_sched_util_low_pct' was not declared. Should it be static? kernel/sched/fair.c:1256:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1256:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1256:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:3039:13: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct task_struct *tsk @@ got struct task_struct [noderef] __rcu * @@ kernel/sched/fair.c:3039:13: sparse: expected struct task_struct *tsk kernel/sched/fair.c:3039:13: sparse: got struct task_struct [noderef] __rcu * kernel/sched/fair.c:12740:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12740:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12740:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:5891:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:5891:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:5891:22: sparse: struct task_struct * kernel/sched/fair.c:6633:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6633:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6633:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7964:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7964:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7964:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8258:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8258:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8258:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8367:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8367:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8367:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8587:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8587:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8587:22: sparse: struct task_struct * kernel/sched/fair.c:8941:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8941:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8941:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9934:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:9934:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:9934:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:10571:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:10571:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:10571:22: sparse: struct task_struct * kernel/sched/fair.c:12012:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12012:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12012:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11669:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11669:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:11669:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12108:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12108:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12108:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:2985:9: sparse: sparse: context imbalance in 'task_numa_placement' - different lock contexts for basic block kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2309:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2309:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2309:9: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * vim +/sysctl_sched_util_low_pct +175 kernel/sched/fair.c 64 65 /* 66 * The initial- and re-scaling of tunables is configurable 67 * 68 * Options are: 69 * 70 * SCHED_TUNABLESCALING_NONE - unscaled, always *1 71 * SCHED_TUNABLESCALING_LOG - scaled logarithmical, *1+ilog(ncpus) 72 * SCHED_TUNABLESCALING_LINEAR - scaled linear, *ncpus 73 * 74 * (default SCHED_TUNABLESCALING_LOG = *(1+ilog(ncpus)) 75 */ > 76 unsigned int sysctl_sched_tunable_scaling = SCHED_TUNABLESCALING_LOG; 77 78 /* 79 * Minimal preemption granularity for CPU-bound tasks: 80 * 81 * (default: 0.75 msec * (1 + ilog(ncpus)), units: nanoseconds) 82 */ 83 unsigned int sysctl_sched_base_slice = 750000ULL; 84 static unsigned int normalized_sysctl_sched_base_slice = 750000ULL; 85 86 /* 87 * After fork, child runs first. If set to 0 (default) then 88 * parent will (try to) run first. 89 */ 90 unsigned int sysctl_sched_child_runs_first __read_mostly; 91 92 const_debug unsigned int sysctl_sched_migration_cost = 500000UL; 93 94 int sched_thermal_decay_shift; 95 static int __init setup_sched_thermal_decay_shift(char *str) 96 { 97 int _shift = 0; 98 99 if (kstrtoint(str, 0, &_shift)) 100 pr_warn("Unable to set scheduler thermal pressure decay shift parameter\n"); 101 102 sched_thermal_decay_shift = clamp(_shift, 0, 10); 103 return 1; 104 } 105 __setup("sched_thermal_decay_shift=", setup_sched_thermal_decay_shift); 106 107 #ifdef CONFIG_SMP 108 /* 109 * For asym packing, by default the lower numbered CPU has higher priority. 110 */ 111 int __weak arch_asym_cpu_priority(int cpu) 112 { 113 return -cpu; 114 } 115 116 /* 117 * The margin used when comparing utilization with CPU capacity. 118 * 119 * (default: ~20%) 120 */ 121 #define fits_capacity(cap, max) ((cap) * 1280 < (max) * 1024) 122 123 /* 124 * The margin used when comparing CPU capacities. 125 * is 'cap1' noticeably greater than 'cap2' 126 * 127 * (default: ~5%) 128 */ 129 #define capacity_greater(cap1, cap2) ((cap1) * 1024 > (cap2) * 1078) 130 #endif 131 132 #ifdef CONFIG_QOS_SCHED 133 134 /* 135 * To distinguish cfs bw, use QOS_THROTTLED mark cfs_rq->throttled 136 * when qos throttled(and cfs bw throttle mark cfs_rq->throttled as 1). 137 */ 138 #define QOS_THROTTLED 2 139 140 static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); 141 static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); 142 static DEFINE_PER_CPU(int, qos_cpu_overload); 143 unsigned int sysctl_overload_detect_period = 5000; /* in ms */ 144 unsigned int sysctl_offline_wait_interval = 100; /* in ms */ 145 static int one_thousand = 1000; 146 static int hundred_thousand = 100000; 147 static int unthrottle_qos_cfs_rqs(int cpu); 148 #endif 149 150 #ifdef CONFIG_CFS_BANDWIDTH 151 /* 152 * Amount of runtime to allocate from global (tg) to local (per-cfs_rq) pool 153 * each time a cfs_rq requests quota. 154 * 155 * Note: in the case that the slice exceeds the runtime remaining (either due 156 * to consumption or the quota being specified to be smaller than the slice) 157 * we will always only issue the remaining available time. 158 * 159 * (default: 5 msec, units: microseconds) 160 */ 161 static unsigned int sysctl_sched_cfs_bandwidth_slice = 5000UL; 162 #endif 163 164 #ifdef CONFIG_NUMA_BALANCING 165 /* Restrict the NUMA promotion throughput (MB/s) for each target node. */ 166 static unsigned int sysctl_numa_balancing_promote_rate_limit = 65536; 167 #endif 168 169 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 170 /* 171 * Low utilization threshold for CPU 172 * 173 * (default: 85%), units: percentage of CPU utilization) 174 */ > 175 int sysctl_sched_util_low_pct = 85; 176 #endif 177 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/22] mTHP anon support
by Kefeng Wang 13 Mar '24

13 Mar '24

Let's support mTHP for anon page. David Hildenbrand (9): mm/rmap: drop stale comment in page_add_anon_rmap and hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive out of __page_set_anon_rmap() mm/rmap: move folio_test_anon() check out of __folio_set_anon() mm/rmap: warn on new PTE-mapped folios in page_add_anon_rmap() mm/rmap: simplify PageAnonExclusive sanity checks when adding anon rmap mm/rmap: pass folio to hugepage_add_anon_rmap() mm/rmap: move SetPageAnonExclusive() out of page_move_anon_rmap() mm/rmap: convert page_move_anon_rmap() to folio_move_anon_rmap() memory: move exclusivity detection in do_wp_page() into wp_can_reuse_anon_folio() Ryan Roberts (12): mm: more ptep_get() conversion mm/readahead: do not allow order-1 folio mm: allow deferred splitting of arbitrary anon large folios mm: non-pmd-mappable, large folios for folio_add_new_anon_rmap() mm: thp: introduce multi-size THP sysfs interface mm: thp: support allocation of anonymous multi-size THP selftests/mm/kugepaged: restore thp settings at exit selftests/mm: factor out thp settings management selftests/mm: support multi-size THP interface in thp_settings selftests/mm/khugepaged: enlighten for multi-size THP selftests/mm/cow: generalize do_run_with_thp() helper selftests/mm/cow: add tests for anonymous multi-size THP Zach O'Keefe (1): mm/thp: fix "mm: thp: kill __transhuge_page_enabled()" Documentation/admin-guide/mm/transhuge.rst | 97 ++++- Documentation/filesystems/proc.rst | 6 +- fs/proc/task_mmu.c | 3 +- include/linux/huge_mm.h | 183 +++++++-- include/linux/rmap.h | 4 +- mm/filemap.c | 2 +- mm/huge_memory.c | 248 +++++++++++-- mm/hugetlb.c | 6 +- mm/khugepaged.c | 20 +- mm/ksm.c | 2 +- mm/memory.c | 204 +++++++--- mm/migrate.c | 2 +- mm/page_vma_mapped.c | 3 +- mm/readahead.c | 14 +- mm/rmap.c | 126 ++++--- mm/userfaultfd.c | 2 +- tools/testing/selftests/mm/Makefile | 4 +- tools/testing/selftests/mm/cow.c | 183 ++++++--- tools/testing/selftests/mm/khugepaged.c | 410 ++++----------------- tools/testing/selftests/mm/run_vmtests.sh | 2 + tools/testing/selftests/mm/thp_settings.c | 349 ++++++++++++++++++ tools/testing/selftests/mm/thp_settings.h | 80 ++++ 22 files changed, 1332 insertions(+), 618 deletions(-) create mode 100644 tools/testing/selftests/mm/thp_settings.c create mode 100644 tools/testing/selftests/mm/thp_settings.h -- 2.27.0

2 23

[openeuler:openEuler-1.0-LTS 8452/21854] kernel/ktask.c:80:5: sparse: sparse: symbol 'ktask_max_threads' was not declared. Should it be static?
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b318937609077b966b3bd130583ee3aaaa4d015a commit: c48676ef6b6f9cb8497d6264ae9ff71b87630337 [8452/21854] ktask: multithread CPU-intensive kernel work config: x86_64-randconfig-122-20240313 (https://download.01.org/0day-ci/archive/20240313/202403132000.KEN5Ibpb-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403132000.KEN5Ibpb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403132000.KEN5Ibpb-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/ktask.c:80:5: sparse: sparse: symbol 'ktask_max_threads' was not declared. Should it be static? vim +/ktask_max_threads +80 kernel/ktask.c 78 79 /* Maximum number of threads for a single task. */ > 80 int ktask_max_threads = KTASK_DEFAULT_MAX_THREADS; 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 16901/30000] mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: caa1ae20bcc64a80625a9449240580f5190ed3a0 commit: 426b9efea56f9b065151d165caab2ebd32906505 [16901/30000] mm: Add sysctl to clear free list pages config: x86_64-randconfig-r121-20240313 (https://download.01.org/0day-ci/archive/20240313/202403131805.usWE0GjN-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403131805.usWE0GjN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403131805.usWE0GjN-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/clear_freelist_page.c:141:50: sparse: expected void * mm/clear_freelist_page.c:141:50: sparse: got void [noderef] __user *buffer >> mm/clear_freelist_page.c:155:36: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/clear_freelist_page.c:155:36: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/clear_freelist_page.c:155:36: sparse: got int ( * )( ... ) vim +141 mm/clear_freelist_page.c 133 134 static int sysctl_clear_freelist_handler(struct ctl_table *table, int write, 135 void __user *buffer, size_t *lenp, loff_t *ppos) 136 { 137 int ret; 138 int val; 139 140 table->data = &val; > 141 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 142 143 if (!ret && write) 144 clear_freelist_pages(); 145 146 return ret; 147 } 148 149 static struct ctl_table clear_freelist_table[] = { 150 { 151 .procname = "clear_freelist_pages", 152 .data = NULL, 153 .maxlen = sizeof(int), 154 .mode = 0200, > 155 .proc_handler = &sysctl_clear_freelist_handler, 156 .extra1 = SYSCTL_ONE, 157 .extra2 = SYSCTL_ONE, 158 }, 159 { } 160 }; 161 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] Add Huawei Intelligent Network Card Driver: hinic3
by Zhou Shuai 13 Mar '24

13 Mar '24

Update hinic3 driver, the NIC driver supports the following features: Supports IPv4/IPv6 TCP/UDP checksum offload, TSO/LRO/RSS. Supports interrupt aggregation parameter configuration and interrupt adaptation. Supports 802.1Q VLAN (Virtual Local Area Network) offloading and filtering. Supports NIC SR-IOV (Single Root I/O Virtualization). Loopback testing is supported. Support port lighting. Support Ethernet mouth self-negotiation, support pause frame. Zhou Shuai (1): net/hinic3: add huawei/hinic3 driver Documentation/networking/hinic3.rst | 128 + MAINTAINERS | 25 +- drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/hinic3/Kconfig | 13 + drivers/net/ethernet/huawei/hinic3/Makefile | 45 + .../ethernet/huawei/hinic3/cfg_mgt_comm_pub.h | 212 ++ .../ethernet/huawei/hinic3/comm_cmdq_intf.h | 239 ++ .../net/ethernet/huawei/hinic3/comm_defs.h | 100 + .../ethernet/huawei/hinic3/comm_msg_intf.h | 664 +++++ .../ethernet/huawei/hinic3/hinic3_comm_cmd.h | 185 ++ .../ethernet/huawei/hinic3/hinic3_common.h | 118 + .../net/ethernet/huawei/hinic3/hinic3_crm.h | 1162 +++++++++ .../net/ethernet/huawei/hinic3/hinic3_dbg.c | 983 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.c | 405 ++++ .../net/ethernet/huawei/hinic3/hinic3_dcb.h | 78 + .../ethernet/huawei/hinic3/hinic3_ethtool.c | 1332 ++++++++++ .../huawei/hinic3/hinic3_ethtool_stats.c | 1259 ++++++++++ .../ethernet/huawei/hinic3/hinic3_filter.c | 483 ++++ .../net/ethernet/huawei/hinic3/hinic3_hw.h | 828 +++++++ .../net/ethernet/huawei/hinic3/hinic3_irq.c | 189 ++ .../net/ethernet/huawei/hinic3/hinic3_lld.h | 205 ++ .../ethernet/huawei/hinic3/hinic3_mag_cfg.c | 953 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_main.c | 1115 +++++++++ .../huawei/hinic3/hinic3_mgmt_interface.h | 1209 ++++++++++ .../net/ethernet/huawei/hinic3/hinic3_mt.h | 681 ++++++ .../huawei/hinic3/hinic3_netdev_ops.c | 1945 +++++++++++++++ .../net/ethernet/huawei/hinic3/hinic3_nic.h | 183 ++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.c | 1608 +++++++++++++ .../ethernet/huawei/hinic3/hinic3_nic_cfg.h | 620 +++++ .../huawei/hinic3/hinic3_nic_cfg_vf.c | 637 +++++ .../ethernet/huawei/hinic3/hinic3_nic_cmd.h | 159 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.c | 146 ++ .../ethernet/huawei/hinic3/hinic3_nic_dbg.h | 21 + .../ethernet/huawei/hinic3/hinic3_nic_dev.h | 387 +++ .../ethernet/huawei/hinic3/hinic3_nic_event.c | 580 +++++ .../ethernet/huawei/hinic3/hinic3_nic_io.c | 1121 +++++++++ .../ethernet/huawei/hinic3/hinic3_nic_io.h | 325 +++ .../ethernet/huawei/hinic3/hinic3_nic_prof.c | 47 + .../ethernet/huawei/hinic3/hinic3_nic_prof.h | 59 + .../ethernet/huawei/hinic3/hinic3_nic_qp.h | 384 +++ .../ethernet/huawei/hinic3/hinic3_ntuple.c | 904 +++++++ .../ethernet/huawei/hinic3/hinic3_profile.h | 146 ++ .../net/ethernet/huawei/hinic3/hinic3_rss.c | 971 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_rss.h | 95 + .../ethernet/huawei/hinic3/hinic3_rss_cfg.c | 384 +++ .../net/ethernet/huawei/hinic3/hinic3_rx.c | 1343 +++++++++++ .../net/ethernet/huawei/hinic3/hinic3_rx.h | 155 ++ .../ethernet/huawei/hinic3/hinic3_srv_nic.h | 213 ++ .../net/ethernet/huawei/hinic3/hinic3_tx.c | 1002 ++++++++ .../net/ethernet/huawei/hinic3/hinic3_tx.h | 157 ++ .../net/ethernet/huawei/hinic3/hinic3_wq.h | 130 + .../huawei/hinic3/hw/hinic3_api_cmd.c | 1210 ++++++++++ .../huawei/hinic3/hw/hinic3_api_cmd.h | 286 +++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.c | 1540 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_cmdq.h | 204 ++ .../ethernet/huawei/hinic3/hw/hinic3_common.c | 93 + .../ethernet/huawei/hinic3/hw/hinic3_csr.h | 187 ++ .../huawei/hinic3/hw/hinic3_dev_mgmt.c | 802 +++++++ .../huawei/hinic3/hw/hinic3_dev_mgmt.h | 105 + .../huawei/hinic3/hw/hinic3_devlink.c | 392 +++ .../huawei/hinic3/hw/hinic3_devlink.h | 149 ++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.c | 1379 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_eqs.h | 164 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.c | 453 ++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_api.h | 141 ++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 1480 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h | 332 +++ .../huawei/hinic3/hw/hinic3_hw_comm.c | 1540 ++++++++++++ .../huawei/hinic3/hw/hinic3_hw_comm.h | 51 + .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.c | 598 +++++ .../ethernet/huawei/hinic3/hw/hinic3_hw_mt.h | 49 + .../ethernet/huawei/hinic3/hw/hinic3_hwdev.c | 2133 +++++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwdev.h | 175 ++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 994 ++++++++ .../ethernet/huawei/hinic3/hw/hinic3_hwif.h | 113 + .../ethernet/huawei/hinic3/hw/hinic3_lld.c | 1383 +++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.c | 1837 ++++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mbox.h | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.c | 1512 ++++++++++++ .../ethernet/huawei/hinic3/hw/hinic3_mgmt.h | 179 ++ .../huawei/hinic3/hw/hinic3_nictool.c | 974 ++++++++ .../huawei/hinic3/hw/hinic3_nictool.h | 35 + .../huawei/hinic3/hw/hinic3_pci_id_tbl.h | 18 + .../huawei/hinic3/hw/hinic3_prof_adap.c | 44 + .../huawei/hinic3/hw/hinic3_prof_adap.h | 109 + .../ethernet/huawei/hinic3/hw/hinic3_sm_lt.h | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sml_lt.c | 160 ++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.c | 267 +++ .../ethernet/huawei/hinic3/hw/hinic3_sriov.h | 35 + .../net/ethernet/huawei/hinic3/hw/hinic3_wq.c | 157 ++ .../huawei/hinic3/hw/ossl_knl_linux.c | 107 + drivers/net/ethernet/huawei/hinic3/mag_cmd.h | 818 +++++++ .../ethernet/huawei/hinic3/mgmt_msg_base.h | 27 + .../net/ethernet/huawei/hinic3/nic_cfg_comm.h | 63 + drivers/net/ethernet/huawei/hinic3/ossl_knl.h | 35 + .../ethernet/huawei/hinic3/ossl_knl_linux.h | 269 +++ 97 files changed, 49344 insertions(+), 17 deletions(-) create mode 100644 Documentation/networking/hinic3.rst create mode 100644 drivers/net/ethernet/huawei/hinic3/Kconfig create mode 100644 drivers/net/ethernet/huawei/hinic3/Makefile create mode 100644 drivers/net/ethernet/huawei/hinic3/cfg_mgt_comm_pub.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_cmdq_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_defs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/comm_msg_intf.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_comm_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_common.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_crm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_dcb.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_filter.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_hw.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_irq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_lld.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_main.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg_vf.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_event.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_prof.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_ntuple.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_profile.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rss_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_rx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_srv_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_tx.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hinic3_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_cmdq.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_common.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_mt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_pci_id_tbl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_prof_adap.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.h create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/hinic3_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic3/hw/ossl_knl_linux.c create mode 100644 drivers/net/ethernet/huawei/hinic3/mag_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic3/mgmt_msg_base.h create mode 100644 drivers/net/ethernet/huawei/hinic3/nic_cfg_comm.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h -- 2.24.0

2 2

[openeuler:OLK-5.10 25744/30000] arch/arm64/kernel/cpufeature.c:1627:6: warning: no previous prototype for 'update_pbha_perf_only_bit'
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fa7099066983597bd415dde5a3e416bf2bd8f7c commit: f43933b3f947a7f9314ec8d704c6ae01041dbbba [25744/30000] arm64: cpufeature: Enable PBHA for stage1 early via FDT config: arm64-randconfig-002-20240312 (https://download.01.org/0day-ci/archive/20240313/202403131533.AIOfBKrb-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403131533.AIOfBKrb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403131533.AIOfBKrb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/cpufeature.c:1627:6: warning: no previous prototype for 'update_pbha_perf_only_bit' [-Wmissing-prototypes] 1627 | void update_pbha_perf_only_bit(const u8 *bits, int cnt) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/cpufeature.c:1729:13: warning: no previous prototype for 'early_pbha_init' [-Wmissing-prototypes] 1729 | void __init early_pbha_init(void) | ^~~~~~~~~~~~~~~ vim +/update_pbha_perf_only_bit +1627 arch/arm64/kernel/cpufeature.c 1626 > 1627 void update_pbha_perf_only_bit(const u8 *bits, int cnt) 1628 { 1629 u8 val; 1630 int i; 1631 1632 /* any listed value is usable at stage 1 */ 1633 for (i = 0 ; i < cnt; i++) { 1634 val = bits[i]; 1635 if (val > 0xf) 1636 continue; 1637 1638 pbha_stage1_enable_bits |= val; 1639 set_bit(val, &arm64_pbha_perf_only_values); 1640 } 1641 } 1642 1643 static bool plat_can_use_pbha_stage1(const struct arm64_cpu_capabilities *cap, 1644 int scope) 1645 { 1646 u8 val; 1647 struct device_node *cpus; 1648 const u8 *perf_only_vals; 1649 int num_perf_only_vals, i; 1650 1651 if (!has_cpuid_feature(cap, scope)) 1652 return false; 1653 1654 /* 1655 * Calls with scope == SCOPE_LOCAL_CPU need only testing whether this 1656 * cpu has the feature. A later 'system' scope call will check for a 1657 * firmware description. 1658 */ 1659 if (scope == SCOPE_LOCAL_CPU) 1660 return true; 1661 1662 spin_lock(&pbha_dt_lock); 1663 if (pbha_enabled) 1664 goto out_unlock; 1665 1666 cpus = of_find_node_by_path("/cpus"); 1667 if (!cpus) 1668 goto done; 1669 1670 perf_only_vals = of_get_property(cpus, "arm,pbha-performance-only", 1671 &num_perf_only_vals); 1672 if (!perf_only_vals) 1673 goto done; 1674 1675 update_pbha_perf_only_bit(perf_only_vals, num_perf_only_vals); 1676 1677 /* 1678 * for stage2 the values are collapsed back to 4 bits that can only 1679 * enable values in the arm64_pbha_perf_only_values mask. 1680 */ 1681 for (i = 0 ; i < num_perf_only_vals; i++) { 1682 val = perf_only_vals[i]; 1683 if (val > 0xf) 1684 continue; 1685 1686 stage2_test_pbha_value(val); 1687 } 1688 1689 done: 1690 of_node_put(cpus); 1691 pbha_enabled = true; 1692 1693 out_unlock: 1694 spin_unlock(&pbha_dt_lock); 1695 return !!pbha_stage1_enable_bits; 1696 } 1697 1698 static void enable_pbha_inner(void) 1699 { 1700 u64 tcr; 1701 1702 if (!pbha_stage1_enable_bits) 1703 return; 1704 1705 tcr = read_sysreg(tcr_el1); 1706 tcr |= FIELD_PREP(TCR_HWU0nn_MASK, pbha_stage1_enable_bits); 1707 tcr |= FIELD_PREP(TCR_HWU1nn_MASK, pbha_stage1_enable_bits); 1708 tcr |= FIELD_PREP(TCR_HPD0, 1) | FIELD_PREP(TCR_HPD1, 1); 1709 1710 write_sysreg(tcr, tcr_el1); 1711 isb(); 1712 local_flush_tlb_all(); 1713 } 1714 1715 static void cpu_enable_pbha(struct arm64_cpu_capabilities const *cap) 1716 { 1717 enable_pbha_inner(); 1718 } 1719 1720 static inline bool cpu_has_pbha(void) 1721 { 1722 u64 mmfr1 = read_cpuid(ID_AA64MMFR1_EL1); 1723 int val = cpuid_feature_extract_unsigned_field(mmfr1, 1724 ID_AA64MMFR1_HPD_SHIFT); 1725 1726 return val == 2; 1727 } 1728 > 1729 void __init early_pbha_init(void) 1730 { 1731 void *fdt; 1732 int node; 1733 const u8 *prop; 1734 int size; 1735 1736 spin_lock(&pbha_dt_lock); 1737 1738 fdt = get_early_fdt_ptr(); 1739 if (!fdt) 1740 goto unlock; 1741 1742 node = fdt_path_offset(fdt, "/cpus"); 1743 if (node < 0) 1744 goto unlock; 1745 1746 prop = fdt_getprop(fdt, node, "arm,pbha-performance-only", &size); 1747 if (!prop) 1748 goto unlock; 1749 1750 if (!cpu_has_pbha()) 1751 goto unlock; 1752 1753 update_pbha_perf_only_bit(prop, size); 1754 enable_pbha_inner(); 1755 1756 pbha_enabled = true; 1757 1758 unlock: 1759 spin_unlock(&pbha_dt_lock); 1760 } 1761 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] Update Huawei Intelligent Network Card Driver: hinic
by Zhou Shuai 13 Mar '24

13 Mar '24

Update hinic driver, the NIC driver supports the following features: Supports IPv4/IPv6 TCP/UDP checksum offload, TSO (TCP Segmentation Offload), LRO (Large Receive Offload) offload and RSS (Receive Side Scaling) functions Supports interrupt aggregation parameter configuration and interrupt adaptation. Supports 802.1Q VLAN (Virtual Local Area Network) offloading and filtering. Supports NIC SR-IOV (Single Root I/O Virtualization). Support PF promiscuous mode, unicast list filtering, multicast list filtering, and full multicast mode. Support VF unicast list filtering, multicast list filtering, and full multicast mode. Supports VF QinQ mode. Supports VF link state configuration and QoS configuration. Support VF MAC address management. Support VF spoofchk check. Loopback testing is supported. Support port lighting. Support Ethernet mouth self-negotiation, support pause frame. Zhou Shuai (1): net/hinic: Update Huawei Intelligent Network Card Driver: hinic drivers/net/ethernet/huawei/hinic/Makefile | 14 +- .../net/ethernet/huawei/hinic/hinic_api_cmd.c | 1164 ++++ .../net/ethernet/huawei/hinic/hinic_api_cmd.h | 298 + drivers/net/ethernet/huawei/hinic/hinic_cfg.c | 2478 ++++++++ drivers/net/ethernet/huawei/hinic/hinic_cfg.h | 526 ++ .../net/ethernet/huawei/hinic/hinic_cmdq.c | 1575 ++++++ .../net/ethernet/huawei/hinic/hinic_cmdq.h | 217 + .../net/ethernet/huawei/hinic/hinic_common.c | 71 - .../net/ethernet/huawei/hinic/hinic_common.h | 29 - drivers/net/ethernet/huawei/hinic/hinic_csr.h | 207 + .../net/ethernet/huawei/hinic/hinic_ctx_def.h | 242 + drivers/net/ethernet/huawei/hinic/hinic_dbg.h | 93 + .../ethernet/huawei/hinic/hinic_dbgtool_knl.c | 899 +++ .../ethernet/huawei/hinic/hinic_dbgtool_knl.h | 120 + drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 1795 ++++++ drivers/net/ethernet/huawei/hinic/hinic_dcb.h | 67 + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 324 -- .../net/ethernet/huawei/hinic/hinic_debugfs.h | 113 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 132 - .../net/ethernet/huawei/hinic/hinic_devlink.c | 584 -- .../net/ethernet/huawei/hinic/hinic_devlink.h | 119 - .../net/ethernet/huawei/hinic/hinic_dfx_def.h | 150 + drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 1462 +++++ drivers/net/ethernet/huawei/hinic/hinic_eqs.h | 177 + .../net/ethernet/huawei/hinic/hinic_ethtool.c | 3078 ++++++---- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 770 +++ .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 987 ---- .../ethernet/huawei/hinic/hinic_hw_api_cmd.h | 203 - .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 963 ---- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.h | 185 - .../net/ethernet/huawei/hinic/hinic_hw_csr.h | 139 - .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 1197 ---- .../net/ethernet/huawei/hinic/hinic_hw_dev.h | 660 --- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 996 ---- .../net/ethernet/huawei/hinic/hinic_hw_eqs.h | 262 - .../net/ethernet/huawei/hinic/hinic_hw_if.c | 419 -- .../net/ethernet/huawei/hinic/hinic_hw_if.h | 295 - .../net/ethernet/huawei/hinic/hinic_hw_io.c | 634 --- .../net/ethernet/huawei/hinic/hinic_hw_io.h | 123 - .../net/ethernet/huawei/hinic/hinic_hw_mbox.h | 172 - .../net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 681 --- .../net/ethernet/huawei/hinic/hinic_hw_mgmt.h | 636 ++- .../net/ethernet/huawei/hinic/hinic_hw_qp.c | 971 ---- .../net/ethernet/huawei/hinic/hinic_hw_qp.h | 232 - .../ethernet/huawei/hinic/hinic_hw_qp_ctxt.h | 210 - .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 904 --- .../net/ethernet/huawei/hinic/hinic_hw_wq.h | 111 - .../net/ethernet/huawei/hinic/hinic_hw_wqe.h | 430 -- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 5001 +++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_hwdev.h | 370 ++ .../net/ethernet/huawei/hinic/hinic_hwif.c | 1005 ++++ .../net/ethernet/huawei/hinic/hinic_hwif.h | 123 + drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2923 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.h | 128 + .../net/ethernet/huawei/hinic/hinic_main.c | 3850 +++++++++---- .../hinic/{hinic_hw_mbox.c => hinic_mbox.c} | 1267 +++-- .../net/ethernet/huawei/hinic/hinic_mbox.h | 241 + .../net/ethernet/huawei/hinic/hinic_mgmt.c | 1446 +++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 245 + .../huawei/hinic/hinic_mgmt_interface.h | 987 ++++ .../ethernet/huawei/hinic/hinic_msix_attr.c | 130 + .../ethernet/huawei/hinic/hinic_msix_attr.h | 69 + .../huawei/hinic/hinic_multi_host_mgmt.c | 972 ++++ .../huawei/hinic/hinic_multi_host_mgmt.h | 107 + drivers/net/ethernet/huawei/hinic/hinic_nic.h | 115 + .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 3996 +++++++++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 638 +++ .../net/ethernet/huawei/hinic/hinic_nic_dbg.c | 294 + .../net/ethernet/huawei/hinic/hinic_nic_dev.h | 289 + .../net/ethernet/huawei/hinic/hinic_nic_io.c | 1047 ++++ .../net/ethernet/huawei/hinic/hinic_nic_io.h | 99 + .../net/ethernet/huawei/hinic/hinic_nictool.c | 2503 +++++++++ .../net/ethernet/huawei/hinic/hinic_nictool.h | 277 + .../ethernet/huawei/hinic/hinic_pci_id_tbl.h | 40 + .../net/ethernet/huawei/hinic/hinic_port.c | 1412 ----- .../net/ethernet/huawei/hinic/hinic_port.h | 900 --- .../ethernet/huawei/hinic/hinic_port_cmd.h | 541 ++ .../net/ethernet/huawei/hinic/hinic_qe_def.h | 459 ++ drivers/net/ethernet/huawei/hinic/hinic_qp.c | 222 + drivers/net/ethernet/huawei/hinic/hinic_qp.h | 143 + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 1342 +++-- drivers/net/ethernet/huawei/hinic/hinic_rx.h | 126 +- .../net/ethernet/huawei/hinic/hinic_sm_lt.h | 228 + .../ethernet/huawei/hinic/hinic_sml_counter.c | 310 + .../ethernet/huawei/hinic/hinic_sml_counter.h | 119 + .../net/ethernet/huawei/hinic/hinic_sml_lt.c | 286 + .../net/ethernet/huawei/hinic/hinic_sriov.c | 1535 ++--- .../net/ethernet/huawei/hinic/hinic_sriov.h | 98 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 1426 +++-- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 127 +- drivers/net/ethernet/huawei/hinic/hinic_wq.c | 683 +++ drivers/net/ethernet/huawei/hinic/hinic_wq.h | 117 + drivers/net/ethernet/huawei/hinic/ossl_knl.h | 63 + 93 files changed, 46545 insertions(+), 19868 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_ctx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dfx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_csr.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp_ctxt.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wqe.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.h rename drivers/net/ethernet/huawei/hinic/{hinic_hw_mbox.c => hinic_mbox.c} (58%) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_pci_id_tbl.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qe_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic/ossl_knl.h -- 2.24.0

2 2

[openeuler:OLK-5.10 16692/30000] mm/share_pool.c:4227:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fa7099066983597bd415dde5a3e416bf2bd8f7c commit: bec70574669710bd0962f1f6807363915fc94f16 [16692/30000] mm/sharepool: fix hugepage_rsvd count increase error config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240313/202403131259.tZO2bTEt-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403131259.tZO2bTEt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403131259.tZO2bTEt-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:865:23: warning: no previous prototype for 'find_spg_node_by_spg' [-Wmissing-prototypes] 865 | struct sp_group_node *find_spg_node_by_spg(struct mm_struct *mm, | ^~~~~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3085:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3085 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3085:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3462:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3462 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: At top level: mm/share_pool.c:3954:6: warning: no previous prototype for 'spa_overview_show' [-Wmissing-prototypes] 3954 | void spa_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:4036:6: warning: no previous prototype for 'spg_overview_show' [-Wmissing-prototypes] 4036 | void spg_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:4227:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4227 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4227:64: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4233:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4233 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4246:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4246 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4268:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4268 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4270:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4270 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_BUDDY +4227 mm/share_pool.c 4193 4194 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4195 struct vm_area_struct *vma, 4196 struct address_space *mapping, pgoff_t idx, 4197 unsigned long address, pte_t *ptep, unsigned int flags) 4198 { 4199 struct hstate *h = hstate_vma(vma); 4200 vm_fault_t ret = VM_FAULT_SIGBUS; 4201 unsigned long size; 4202 struct page *page; 4203 pte_t new_pte; 4204 spinlock_t *ptl; 4205 unsigned long haddr = address & huge_page_mask(h); 4206 bool new_page = false; 4207 int err; 4208 int node_id; 4209 struct sp_area *spa; 4210 4211 spa = vma->vm_private_data; 4212 if (!spa) { 4213 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4214 return ret; 4215 } 4216 node_id = spa->node_id; 4217 4218 retry: 4219 page = find_lock_page(mapping, idx); 4220 if (!page) { 4221 size = i_size_read(mapping->host) >> huge_page_shift(h); 4222 if (idx >= size) 4223 goto out; 4224 4225 page = alloc_huge_page(vma, haddr, 0); 4226 if (IS_ERR(page)) { > 4227 page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); 4228 if (!page) 4229 page = ERR_PTR(-ENOMEM); 4230 } 4231 if (IS_ERR(page)) { 4232 ptl = huge_pte_lock(h, mm, ptep); 4233 if (!huge_pte_none(huge_ptep_get(ptep))) { 4234 ret = 0; 4235 spin_unlock(ptl); 4236 goto out; 4237 } 4238 spin_unlock(ptl); 4239 ret = vmf_error(PTR_ERR(page)); 4240 goto out; 4241 } 4242 __SetPageUptodate(page); 4243 new_page = true; 4244 4245 /* sharepool pages are all shared */ 4246 err = huge_add_to_page_cache(page, mapping, idx); 4247 if (err) { 4248 put_page(page); 4249 if (err == -EEXIST) 4250 goto retry; 4251 goto out; 4252 } 4253 } 4254 4255 4256 ptl = huge_pte_lock(h, mm, ptep); 4257 size = i_size_read(mapping->host) >> huge_page_shift(h); 4258 if (idx >= size) 4259 goto backout; 4260 4261 ret = 0; 4262 if (!huge_pte_none(huge_ptep_get(ptep))) 4263 goto backout; 4264 4265 page_dup_rmap(page, true); 4266 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4267 && (vma->vm_flags & VM_SHARED))); 4268 set_huge_pte_at(mm, haddr, ptep, new_pte); 4269 4270 hugetlb_count_add(pages_per_huge_page(h), mm); 4271 4272 spin_unlock(ptl); 4273 4274 if (new_page) { 4275 SetPagePrivate(&page[1]); 4276 } 4277 4278 unlock_page(page); 4279 out: 4280 return ret; 4281 4282 backout: 4283 spin_unlock(ptl); 4284 unlock_page(page); 4285 put_page(page); 4286 goto out; 4287 } 4288 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: nfc: llcp: Add lock when modifying device list
by Ziyang Xuan 13 Mar '24

13 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v5.10.198 commit dba849cc98113b145c6e720122942c00b8012bdb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1R CVE: CVE-2023-52524 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfc7f7a988dad34c3bf4c053124fb26aa6c5f916 ] The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") Link: https://lore.kernel.org/r/20230908235853.1319596-1-jeremy@jcline.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/llcp_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index ddfd159f64e13..b1107570eaee8 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1646,7 +1646,9 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0); INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work); + spin_lock(&llcp_devices_lock); list_add(&local->list, &llcp_devices); + spin_unlock(&llcp_devices_lock); return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: nfc: llcp: Add lock when modifying device list
by Ziyang Xuan 13 Mar '24

13 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> mainline inclusion from mainline-v6.6-rc5 commit dfc7f7a988dad34c3bf4c053124fb26aa6c5f916 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1R CVE: CVE-2023-52524 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. Reported-and-tested-by: syzbot+c1d0a03d305972dbbe14(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c1d0a03d305972dbbe14 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Fixes: 6709d4b7bc2e ("net: nfc: Fix use-after-free caused by nfc_llcp_find_local") Link: https://lore.kernel.org/r/20230908235853.1319596-1-jeremy@jcline.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/llcp_core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 2c38e739ab71a..aaaf498aaaea2 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -1653,7 +1653,9 @@ int nfc_llcp_register_device(struct nfc_dev *ndev) timer_setup(&local->sdreq_timer, nfc_llcp_sdreq_timer, 0); INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work); + spin_lock(&llcp_devices_lock); list_add(&local->list, &llcp_devices); + spin_unlock(&llcp_devices_lock); return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6 v2 00/11] KVM: arm64: Enable 'writable' ID registers
by chenxiang 13 Mar '24

13 Mar '24

From: caijian <caijian11(a)h-partners.com> Backport the code of enabling 'writable' ID registers from mainline to openEuler 6.6. It is the fundation of live migration between different platforms. Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Oliver Upton (6): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs Documentation/virt/kvm/api.rst | 52 +++++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++++ arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/uapi/asm/kvm.h | 32 +++ arch/arm64/kvm/arm.c | 10 + arch/arm64/kvm/sys_regs.c | 194 ++++++++++++++++--- include/uapi/linux/kvm.h | 2 + 8 files changed, 309 insertions(+), 32 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.30.0

2 12

[PATCH openEuler-1.0-LTS 0/2] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 13 Mar '24

13 Mar '24

Wang ShaoBo (1): arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak Zeng Heng (1): arm64/mpam: Fix use-after-free when deleting resource groups arch/arm64/include/asm/resctrl.h | 18 +++++++++++++ arch/arm64/kernel/mpam/mpam_ctrlmon.c | 8 ------ arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- fs/resctrlfs.c | 37 ++++++++++----------------- 4 files changed, 32 insertions(+), 33 deletions(-) -- 2.25.1

2 3

[PATCH 0/8] Support hns roce bonding
by Chengchang Tang 13 Mar '24

13 Mar '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Support hns roce bonding. Junxian Huang (8): RDMA/hns: Support RoCE bonding RDMA/hns: Set IB port state depending on upper device for RoCE bonding RDMA/hns: Support dispatching IB event for RoCE bonding RDMA/hns: Add functions to obtain netdev and bus_num from an hr_dev RDMA/hns: Support reset recovery for RoCE bonding RDMA/hns: Fix wild pointer error of RoCE bonding when rmmod hns3 RDMA/hns: Fix the device loss after unbinding RoCE bond resource slave RDMA/hns: Fix the concurrency error between bond and reset. drivers/infiniband/hw/hns/Makefile | 4 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 1 - drivers/infiniband/hw/hns/hns_roce_bond.c | 951 ++++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_bond.h | 92 ++ drivers/infiniband/hw/hns/hns_roce_device.h | 21 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 173 +++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 19 + drivers/infiniband/hw/hns/hns_roce_main.c | 153 +++- drivers/infiniband/hw/hns/hns_roce_pd.c | 1 - drivers/infiniband/hw/hns/hns_roce_qp.c | 5 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 1 - 11 files changed, 1387 insertions(+), 34 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_bond.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_bond.h -- 2.30.0

1 8

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 4fa7099066983597bd415dde5a3e416bf2bd8f7c
by kernel test robot 13 Mar '24

13 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4fa7099066983597bd415dde5a3e416bf2bd8f7c !5152 arm64/mpam: Remove warning about no msc corresponding to the online cpu Warning reports: https://lore.kernel.org/oe-kbuild-all/202403122352.tvX5nEio-lkp@intel.com Warning: (recently discovered and may have been fixed) arch/arm64/kernel/smp.c:1232:5: warning: no previous prototype for 'hw_nmi_get_sample_period' [-Wmissing-prototypes] Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-002-20240312 `-- arch-arm64-kernel-smp.c:warning:no-previous-prototype-for-hw_nmi_get_sample_period clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 732m configs tested: 35 configs skipped: 149 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240313 clang arm64 randconfig-002-20240313 clang arm64 randconfig-003-20240313 clang arm64 randconfig-004-20240313 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240313 clang x86_64 buildonly-randconfig-002-20240313 gcc x86_64 buildonly-randconfig-003-20240313 clang x86_64 buildonly-randconfig-004-20240313 clang x86_64 buildonly-randconfig-005-20240313 gcc x86_64 buildonly-randconfig-006-20240313 clang x86_64 defconfig gcc x86_64 randconfig-001-20240313 clang x86_64 randconfig-002-20240313 gcc x86_64 randconfig-003-20240313 clang x86_64 randconfig-004-20240313 gcc x86_64 randconfig-005-20240313 gcc x86_64 randconfig-006-20240313 clang x86_64 randconfig-011-20240313 clang x86_64 randconfig-012-20240313 clang x86_64 randconfig-013-20240313 clang x86_64 randconfig-014-20240313 clang x86_64 randconfig-015-20240313 gcc x86_64 randconfig-016-20240313 gcc x86_64 randconfig-071-20240313 gcc x86_64 randconfig-072-20240313 clang x86_64 randconfig-073-20240313 clang x86_64 randconfig-074-20240313 gcc x86_64 randconfig-075-20240313 clang x86_64 randconfig-076-20240313 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f066d3699b4816fda2b6f452885b51bd22199c43
by kernel test robot 13 Mar '24

13 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f066d3699b4816fda2b6f452885b51bd22199c43 !4427 【OLK-6.6】watchdog: Support watchdog_sdei coexist with existing watchdogs Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- arm64-randconfig-003-20240312 | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_disable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_enable_msi | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-005-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-004-20240312 | |-- ld.lld:error:undefined-symbol:arch_elf_adjust_prot | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-buildonly-randconfig-001-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead elapsed time: 730m configs tested: 40 configs skipped: 145 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240312 gcc loongarch randconfig-002-20240312 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 randconfig-072-20240312 gcc x86_64 randconfig-073-20240312 clang x86_64 randconfig-074-20240312 gcc x86_64 randconfig-075-20240312 gcc x86_64 randconfig-076-20240312 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20704/21850] kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v'
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: ce35ded5d5774f055f6850b15032066ff4936414 [20704/21850] sched: smart grid: init sched_grid_qos structure on QOS purpose config: x86_64-randconfig-161-20240313 (https://download.01.org/0day-ci/archive/20240313/202403130506.ha6K0yEi-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403130506.ha6K0yEi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403130506.ha6K0yEi-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/grid/qos.c:19: kernel/sched/grid/qos.c: In function 'sched_grid_preferred_interleave_nid': >> kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' 84 | if (nodes_equal(policy->v.nodes, *preferred_nmask)) | ^~ include/linux/nodemask.h:202:41: note: in definition of macro 'nodes_equal' 202 | __nodes_equal(&(src1), &(src2), MAX_NUMNODES) | ^~~~ kernel/sched/grid/qos.c:91:32: error: 'struct mempolicy' has no member named 'v' 91 | nodes_and(nmask, policy->v.nodes, *preferred_nmask); | ^~ include/linux/nodemask.h:162:47: note: in definition of macro 'nodes_and' 162 | __nodes_and(&(dst), &(src1), &(src2), MAX_NUMNODES) | ^~~~ >> kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' 95 | next = next_node_in(me->il_prev, nmask); | ^~ include/linux/nodemask.h:278:46: note: in definition of macro 'next_node_in' 278 | #define next_node_in(n, src) __next_node_in((n), &(src)) | ^ kernel/sched/grid/qos.c:97:19: error: 'struct task_struct' has no member named 'il_prev' 97 | me->il_prev = next; | ^~ In file included from kernel/sched/grid/qos.c:20: include/linux/mempolicy.h: At top level: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +84 kernel/sched/grid/qos.c 68 69 /* dynamic select a more appropriate preferred interleave nid for process */ 70 int sched_grid_preferred_interleave_nid(struct mempolicy *policy) 71 { 72 nodemask_t nmask; 73 unsigned int next; 74 struct task_struct *me = current; 75 nodemask_t *preferred_nmask = NULL; 76 77 if (likely(me->grid_qos)) 78 preferred_nmask = 79 &me->grid_qos->affinity.mem_preferred_node_mask; 80 81 if (!preferred_nmask || !policy) 82 return NUMA_NO_NODE; 83 > 84 if (nodes_equal(policy->v.nodes, *preferred_nmask)) 85 return NUMA_NO_NODE; 86 /* 87 * We perceive the actual consumption of memory bandwidth 88 * in each node and post a preferred interleave nid in 89 * more appropriate range. 90 */ 91 nodes_and(nmask, policy->v.nodes, *preferred_nmask); 92 if (nodes_empty(nmask)) 93 return NUMA_NO_NODE; 94 > 95 next = next_node_in(me->il_prev, nmask); 96 if (next < MAX_NUMNODES) 97 me->il_prev = next; 98 return next; 99 } 100 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13427/21850] kernel/watchdog_hld.c:123:13: error: implicit declaration of function 'is_hardlockup'
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 818ac22d9d2f02632b39ef1a4f472e6dbe0d417a [13427/21850] sdei_watchdog: fix compile error when CONFIG_HARDLOCKUP_DETECTOR is not set config: arm64-randconfig-001-20240312 (https://download.01.org/0day-ci/archive/20240313/202403130340.177twYMV-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403130340.177twYMV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403130340.177twYMV-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/watchdog_hld.c: In function 'watchdog_hardlockup_check': >> kernel/watchdog_hld.c:123:13: error: implicit declaration of function 'is_hardlockup' [-Werror=implicit-function-declaration] 123 | if (is_hardlockup()) { | ^~~~~~~~~~~~~ >> kernel/watchdog_hld.c:142:21: error: 'sysctl_hardlockup_all_cpu_backtrace' undeclared (first use in this function) 142 | if (sysctl_hardlockup_all_cpu_backtrace && | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/watchdog_hld.c:142:21: note: each undeclared identifier is reported only once for each function it appears in cc1: some warnings being treated as errors -- arch/arm64/kernel/watchdog_sdei.c: In function 'watchdog_nmi_enable': >> arch/arm64/kernel/watchdog_sdei.c:38:42: error: 'watchdog_thresh' undeclared (first use in this function); did you mean 'proc_watchdog_thresh'? 38 | sdei_api_set_secure_timer_period(watchdog_thresh); | ^~~~~~~~~~~~~~~ | proc_watchdog_thresh arch/arm64/kernel/watchdog_sdei.c:38:42: note: each undeclared identifier is reported only once for each function it appears in arch/arm64/kernel/watchdog_sdei.c: In function 'watchdog_nmi_probe': arch/arm64/kernel/watchdog_sdei.c:119:46: error: 'watchdog_thresh' undeclared (first use in this function); did you mean 'proc_watchdog_thresh'? 119 | if (sdei_api_set_secure_timer_period(watchdog_thresh)) { | ^~~~~~~~~~~~~~~ | proc_watchdog_thresh Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HARDLOCKUP_DETECTOR Depends on [n]: DEBUG_KERNEL [=n] && !S390 && (HAVE_HARDLOCKUP_DETECTOR_PERF [=n] || HAVE_HARDLOCKUP_DETECTOR_ARCH [=y]) Selected by [y]: - SDEI_WATCHDOG [=y] && <choice> && ARM_SDE_INTERFACE [=y] && !HARDLOCKUP_CHECK_TIMESTAMP [=n] vim +/is_hardlockup +123 kernel/watchdog_hld.c 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 106 b8163908982cff Xiongfeng Wang 2019-01-28 107 void watchdog_hardlockup_check(struct pt_regs *regs) 73ce0511c43686 Babu Moger 2016-12-14 108 { 73ce0511c43686 Babu Moger 2016-12-14 109 if (__this_cpu_read(watchdog_nmi_touch) == true) { 73ce0511c43686 Babu Moger 2016-12-14 110 __this_cpu_write(watchdog_nmi_touch, false); 73ce0511c43686 Babu Moger 2016-12-14 111 return; 73ce0511c43686 Babu Moger 2016-12-14 112 } 73ce0511c43686 Babu Moger 2016-12-14 113 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 114 if (!watchdog_check_timestamp()) 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 115 return; 7edaeb6841dfb2 Thomas Gleixner 2017-08-15 116 73ce0511c43686 Babu Moger 2016-12-14 117 /* check for a hardlockup 73ce0511c43686 Babu Moger 2016-12-14 118 * This is done by making sure our timer interrupt 73ce0511c43686 Babu Moger 2016-12-14 119 * is incrementing. The timer interrupt should have 73ce0511c43686 Babu Moger 2016-12-14 120 * fired multiple times before we overflow'd. If it hasn't 73ce0511c43686 Babu Moger 2016-12-14 121 * then this is a good indication the cpu is stuck 73ce0511c43686 Babu Moger 2016-12-14 122 */ 73ce0511c43686 Babu Moger 2016-12-14 @123 if (is_hardlockup()) { 73ce0511c43686 Babu Moger 2016-12-14 124 int this_cpu = smp_processor_id(); 73ce0511c43686 Babu Moger 2016-12-14 125 73ce0511c43686 Babu Moger 2016-12-14 126 /* only print hardlockups once */ 73ce0511c43686 Babu Moger 2016-12-14 127 if (__this_cpu_read(hard_watchdog_warn) == true) 73ce0511c43686 Babu Moger 2016-12-14 128 return; 73ce0511c43686 Babu Moger 2016-12-14 129 73ce0511c43686 Babu Moger 2016-12-14 130 pr_emerg("Watchdog detected hard LOCKUP on cpu %d", this_cpu); 73ce0511c43686 Babu Moger 2016-12-14 131 print_modules(); 73ce0511c43686 Babu Moger 2016-12-14 132 print_irqtrace_events(current); 73ce0511c43686 Babu Moger 2016-12-14 133 if (regs) 73ce0511c43686 Babu Moger 2016-12-14 134 show_regs(regs); 73ce0511c43686 Babu Moger 2016-12-14 135 else 73ce0511c43686 Babu Moger 2016-12-14 136 dump_stack(); 73ce0511c43686 Babu Moger 2016-12-14 137 73ce0511c43686 Babu Moger 2016-12-14 138 /* 73ce0511c43686 Babu Moger 2016-12-14 139 * Perform all-CPU dump only once to avoid multiple hardlockups 73ce0511c43686 Babu Moger 2016-12-14 140 * generating interleaving traces 73ce0511c43686 Babu Moger 2016-12-14 141 */ 73ce0511c43686 Babu Moger 2016-12-14 @142 if (sysctl_hardlockup_all_cpu_backtrace && 73ce0511c43686 Babu Moger 2016-12-14 143 !test_and_set_bit(0, &hardlockup_allcpu_dumped)) 73ce0511c43686 Babu Moger 2016-12-14 144 trigger_allbutself_cpu_backtrace(); 73ce0511c43686 Babu Moger 2016-12-14 145 73ce0511c43686 Babu Moger 2016-12-14 146 if (hardlockup_panic) 73ce0511c43686 Babu Moger 2016-12-14 147 nmi_panic(regs, "Hard LOCKUP"); 73ce0511c43686 Babu Moger 2016-12-14 148 73ce0511c43686 Babu Moger 2016-12-14 149 __this_cpu_write(hard_watchdog_warn, true); 73ce0511c43686 Babu Moger 2016-12-14 150 return; 73ce0511c43686 Babu Moger 2016-12-14 151 } 73ce0511c43686 Babu Moger 2016-12-14 152 73ce0511c43686 Babu Moger 2016-12-14 153 __this_cpu_write(hard_watchdog_warn, false); 73ce0511c43686 Babu Moger 2016-12-14 154 return; 73ce0511c43686 Babu Moger 2016-12-14 155 } 6c19c0e5140a24 Xiongfeng Wang 2019-04-20 156 NOKPROBE_SYMBOL(watchdog_hardlockup_check); 73ce0511c43686 Babu Moger 2016-12-14 157 :::::: The code at line 123 was first introduced by commit :::::: 73ce0511c43686095efd2f65ef564aab952e07bc kernel/watchdog.c: move hardlockup detector to separate file :::::: TO: Babu Moger <babu.moger(a)oracle.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21846/21850] drivers/dma/pl330.c:2598:22: warning: 'dst' may be used uninitialized
by kernel test robot 13 Mar '24

13 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 0299853c014aa0eecf7fb85ac2f1ebd0a9a6ba73 [21846/21850] dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV config: arm64-defconfig (https://download.01.org/0day-ci/archive/20240313/202403130014.Z6L6BJzl-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240313/202403130014.Z6L6BJzl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403130014.Z6L6BJzl-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In function 'fill_px', inlined from 'pl330_prep_dma_cyclic' at drivers/dma/pl330.c:2716:3: >> drivers/dma/pl330.c:2598:22: warning: 'dst' may be used uninitialized [-Wmaybe-uninitialized] 2598 | px->dst_addr = dst; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c: In function 'pl330_prep_dma_cyclic': drivers/dma/pl330.c:2656:20: note: 'dst' was declared here 2656 | dma_addr_t dst; | ^~~ In function 'fill_px', inlined from 'pl330_prep_dma_cyclic' at drivers/dma/pl330.c:2716:3: >> drivers/dma/pl330.c:2599:22: warning: 'src' may be used uninitialized [-Wmaybe-uninitialized] 2599 | px->src_addr = src; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c: In function 'pl330_prep_dma_cyclic': drivers/dma/pl330.c:2657:20: note: 'src' was declared here 2657 | dma_addr_t src; | ^~~ drivers/dma/pl330.c:297: warning: cannot understand function prototype: 'struct pl330_reqcfg ' vim +/dst +2598 drivers/dma/pl330.c b3040e40675ec2 Jassi Brar 2010-05-23 2593 b3040e40675ec2 Jassi Brar 2010-05-23 2594 static inline void fill_px(struct pl330_xfer *px, b3040e40675ec2 Jassi Brar 2010-05-23 2595 dma_addr_t dst, dma_addr_t src, size_t len) b3040e40675ec2 Jassi Brar 2010-05-23 2596 { b3040e40675ec2 Jassi Brar 2010-05-23 2597 px->bytes = len; b3040e40675ec2 Jassi Brar 2010-05-23 @2598 px->dst_addr = dst; b3040e40675ec2 Jassi Brar 2010-05-23 @2599 px->src_addr = src; b3040e40675ec2 Jassi Brar 2010-05-23 2600 } b3040e40675ec2 Jassi Brar 2010-05-23 2601 :::::: The code at line 2598 was first introduced by commit :::::: b3040e40675ec2c43542331cd30d4ee3dae797e8 DMA: PL330: Add dma api driver :::::: TO: Jassi Brar <jassi.brar(a)samsung.com> :::::: CC: Dan Williams <dan.j.williams(a)intel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION c38cc0a3be12e5c70b9a2a015cbee44014a52518
by kernel test robot 12 Mar '24

12 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: c38cc0a3be12e5c70b9a2a015cbee44014a52518 !5133 CVE-2021-46926 Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403122233.J2ozeWSt-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403122249.xsnDebIP-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 |-- mm-share_pool.c:error:HUGETLB_ALLOC_NONE-undeclared-(first-use-in-this-function) `-- mm-share_pool.c:error:implicit-declaration-of-function-hugetlb_alloc_hugepage clang_recent_errors `-- x86_64-buildonly-randconfig-003-20240312 `-- drivers-platform-x86-.tmp_dell-smbios-wmi.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 741m configs tested: 34 configs skipped: 147 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 randconfig-072-20240312 gcc x86_64 randconfig-073-20240312 clang x86_64 randconfig-074-20240312 gcc x86_64 randconfig-075-20240312 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 280/30000] arch/arm64/kernel/smp.c:1232:5: warning: no previous prototype for 'hw_nmi_get_sample_period'
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fa7099066983597bd415dde5a3e416bf2bd8f7c commit: 22a589ef7833a36ba116897ac86e671290b86f2b [280/30000] arm64: Add support for hard lockup by using pmu counter config: arm64-randconfig-002-20240312 (https://download.01.org/0day-ci/archive/20240312/202403122352.tvX5nEio-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403122352.tvX5nEio-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403122352.tvX5nEio-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/smp.c: In function 'smp_prepare_cpus': arch/arm64/kernel/smp.c:786:30: error: 'cpu_madt_gicc' undeclared (first use in this function) 786 | if ((cpu_madt_gicc[cpu].flags & ACPI_MADT_ENABLED)) | ^~~~~~~~~~~~~ arch/arm64/kernel/smp.c:786:30: note: each undeclared identifier is reported only once for each function it appears in arch/arm64/kernel/smp.c: At top level: arch/arm64/kernel/smp.c:844:6: warning: no previous prototype for 'arch_irq_work_raise' [-Wmissing-prototypes] 844 | void arch_irq_work_raise(void) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/smp.c:864:6: warning: no previous prototype for 'panic_smp_self_stop' [-Wmissing-prototypes] 864 | void panic_smp_self_stop(void) | ^~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/smp.c:1232:5: warning: no previous prototype for 'hw_nmi_get_sample_period' [-Wmissing-prototypes] 1232 | u64 hw_nmi_get_sample_period(int watchdog_thresh) | ^~~~~~~~~~~~~~~~~~~~~~~~ vim +/hw_nmi_get_sample_period +1232 arch/arm64/kernel/smp.c 1231 > 1232 u64 hw_nmi_get_sample_period(int watchdog_thresh) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18183/21850] mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'?
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 4a280fac30d27ae2aff096f9f99aa12d50f83426 [18183/21850] ascend: share_pool: support share pool features for ascend platform config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240312/202403122233.J2ozeWSt-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403122233.J2ozeWSt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403122233.J2ozeWSt-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:1542:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 1542 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:1542:21: error: invalid initializer mm/share_pool.c: In function 'sp_alloc_pages': >> mm/share_pool.c:2263:24: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:2263:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 2263 | return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE mm/share_pool.c:2263:61: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:2266:1: warning: control reaches end of non-void function [-Wreturn-type] 2266 | } | ^ cc1: some warnings being treated as errors vim +2263 mm/share_pool.c 2257 2258 2259 struct page *sp_alloc_pages(struct vm_struct *area, gfp_t mask, 2260 unsigned int page_order, int node) 2261 { 2262 if (area->flags & VM_HUGE_PAGES) > 2263 return hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); 2264 else 2265 return alloc_pages_node(node, mask, page_order); 2266 } 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21699/21850] drivers/platform/x86/.tmp_dell-smbios-wmi.o: warning: objtool: missing symbol for section .text
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c38cc0a3be12e5c70b9a2a015cbee44014a52518 commit: 14dbb7913c699931c3e0314f650058dacdaf566b [21699/21850] platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios config: x86_64-buildonly-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240312/202403122249.xsnDebIP-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403122249.xsnDebIP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403122249.xsnDebIP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/platform/x86/.tmp_dell-smbios-wmi.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] *** SUBJECT HERE ***
by Zhou Shuai 12 Mar '24

12 Mar '24

*** BLURB HERE *** Zhou Shuai (1): net/hinic: Update Huawei Intelligent Network Card Driver: hinic drivers/net/ethernet/huawei/hinic/Makefile | 14 +- .../net/ethernet/huawei/hinic/hinic_api_cmd.c | 1164 ++++ .../net/ethernet/huawei/hinic/hinic_api_cmd.h | 298 + drivers/net/ethernet/huawei/hinic/hinic_cfg.c | 2478 ++++++++ drivers/net/ethernet/huawei/hinic/hinic_cfg.h | 526 ++ .../net/ethernet/huawei/hinic/hinic_cmdq.c | 1575 ++++++ .../net/ethernet/huawei/hinic/hinic_cmdq.h | 217 + .../net/ethernet/huawei/hinic/hinic_common.c | 71 - .../net/ethernet/huawei/hinic/hinic_common.h | 29 - drivers/net/ethernet/huawei/hinic/hinic_csr.h | 207 + .../net/ethernet/huawei/hinic/hinic_ctx_def.h | 242 + drivers/net/ethernet/huawei/hinic/hinic_dbg.h | 93 + .../ethernet/huawei/hinic/hinic_dbgtool_knl.c | 899 +++ .../ethernet/huawei/hinic/hinic_dbgtool_knl.h | 120 + drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 1795 ++++++ drivers/net/ethernet/huawei/hinic/hinic_dcb.h | 67 + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 324 -- .../net/ethernet/huawei/hinic/hinic_debugfs.h | 113 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 132 - .../net/ethernet/huawei/hinic/hinic_devlink.c | 584 -- .../net/ethernet/huawei/hinic/hinic_devlink.h | 119 - .../net/ethernet/huawei/hinic/hinic_dfx_def.h | 150 + drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 1462 +++++ drivers/net/ethernet/huawei/hinic/hinic_eqs.h | 177 + .../net/ethernet/huawei/hinic/hinic_ethtool.c | 3078 ++++++---- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 770 +++ .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 987 ---- .../ethernet/huawei/hinic/hinic_hw_api_cmd.h | 203 - .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 963 ---- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.h | 185 - .../net/ethernet/huawei/hinic/hinic_hw_csr.h | 139 - .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 1197 ---- .../net/ethernet/huawei/hinic/hinic_hw_dev.h | 660 --- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 996 ---- .../net/ethernet/huawei/hinic/hinic_hw_eqs.h | 262 - .../net/ethernet/huawei/hinic/hinic_hw_if.c | 419 -- .../net/ethernet/huawei/hinic/hinic_hw_if.h | 295 - .../net/ethernet/huawei/hinic/hinic_hw_io.c | 634 --- .../net/ethernet/huawei/hinic/hinic_hw_io.h | 123 - .../net/ethernet/huawei/hinic/hinic_hw_mbox.h | 172 - .../net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 681 --- .../net/ethernet/huawei/hinic/hinic_hw_mgmt.h | 636 ++- .../net/ethernet/huawei/hinic/hinic_hw_qp.c | 971 ---- .../net/ethernet/huawei/hinic/hinic_hw_qp.h | 232 - .../ethernet/huawei/hinic/hinic_hw_qp_ctxt.h | 210 - .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 904 --- .../net/ethernet/huawei/hinic/hinic_hw_wq.h | 111 - .../net/ethernet/huawei/hinic/hinic_hw_wqe.h | 430 -- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 5001 +++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_hwdev.h | 370 ++ .../net/ethernet/huawei/hinic/hinic_hwif.c | 1005 ++++ .../net/ethernet/huawei/hinic/hinic_hwif.h | 123 + drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2923 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.h | 128 + .../net/ethernet/huawei/hinic/hinic_main.c | 3848 +++++++++---- .../hinic/{hinic_hw_mbox.c => hinic_mbox.c} | 1267 +++-- .../net/ethernet/huawei/hinic/hinic_mbox.h | 241 + .../net/ethernet/huawei/hinic/hinic_mgmt.c | 1446 +++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 245 + .../huawei/hinic/hinic_mgmt_interface.h | 987 ++++ .../ethernet/huawei/hinic/hinic_msix_attr.c | 130 + .../ethernet/huawei/hinic/hinic_msix_attr.h | 69 + .../huawei/hinic/hinic_multi_host_mgmt.c | 972 ++++ .../huawei/hinic/hinic_multi_host_mgmt.h | 107 + drivers/net/ethernet/huawei/hinic/hinic_nic.h | 115 + .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 3996 +++++++++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 638 +++ .../net/ethernet/huawei/hinic/hinic_nic_dbg.c | 294 + .../net/ethernet/huawei/hinic/hinic_nic_dev.h | 289 + .../net/ethernet/huawei/hinic/hinic_nic_io.c | 1047 ++++ .../net/ethernet/huawei/hinic/hinic_nic_io.h | 99 + .../net/ethernet/huawei/hinic/hinic_nictool.c | 2503 +++++++++ .../net/ethernet/huawei/hinic/hinic_nictool.h | 277 + .../ethernet/huawei/hinic/hinic_pci_id_tbl.h | 40 + .../net/ethernet/huawei/hinic/hinic_port.c | 1412 ----- .../net/ethernet/huawei/hinic/hinic_port.h | 900 --- .../ethernet/huawei/hinic/hinic_port_cmd.h | 541 ++ .../net/ethernet/huawei/hinic/hinic_qe_def.h | 459 ++ drivers/net/ethernet/huawei/hinic/hinic_qp.c | 222 + drivers/net/ethernet/huawei/hinic/hinic_qp.h | 143 + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 1342 +++-- drivers/net/ethernet/huawei/hinic/hinic_rx.h | 126 +- .../net/ethernet/huawei/hinic/hinic_sm_lt.h | 228 + .../ethernet/huawei/hinic/hinic_sml_counter.c | 310 + .../ethernet/huawei/hinic/hinic_sml_counter.h | 119 + .../net/ethernet/huawei/hinic/hinic_sml_lt.c | 286 + .../net/ethernet/huawei/hinic/hinic_sriov.c | 1535 ++--- .../net/ethernet/huawei/hinic/hinic_sriov.h | 98 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 1426 +++-- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 127 +- drivers/net/ethernet/huawei/hinic/hinic_wq.c | 683 +++ drivers/net/ethernet/huawei/hinic/hinic_wq.h | 117 + drivers/net/ethernet/huawei/hinic/ossl_knl.h | 63 + 93 files changed, 46543 insertions(+), 19868 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_ctx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dfx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_csr.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp_ctxt.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wqe.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.h rename drivers/net/ethernet/huawei/hinic/{hinic_hw_mbox.c => hinic_mbox.c} (58%) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_pci_id_tbl.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qe_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic/ossl_knl.h -- 2.24.0

2 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52502 for openEuler-1.0-LTS
by Liu Jian 12 Mar '24

12 Mar '24

CVE-2023-52502 Eric Dumazet (1): net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Krzysztof Kozlowski (1): nfc: constify several pointers to u8, char and sk_buff include/net/nfc/nfc.h | 4 +-- net/nfc/core.c | 4 +-- net/nfc/hci/llc_shdlc.c | 10 +++--- net/nfc/llcp.h | 8 ++--- net/nfc/llcp_commands.c | 46 ++++++++++++++------------ net/nfc/llcp_core.c | 72 ++++++++++++++++++++--------------------- net/nfc/nfc.h | 2 +- 7 files changed, 74 insertions(+), 72 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
by Liu Jian 12 Mar '24

12 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.199 commit 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXP CVE: CVE-2023-52502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ] Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear. Fixes: 8f50020ed9b8 ("NFC: LLCP late binding") Reported-by: Sili Luo <rootlab(a)huawei.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willy Tarreau <w(a)1wt.eu> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/llcp_core.c | 30 ++++++++++++------------------ 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index ddfd159f64e1..f2a2454ed07d 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local, if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) { llcp_sock = tmp_sock; + sock_hold(&llcp_sock->sk); break; } } read_unlock(&local->sockets.lock); - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - return llcp_sock; } @@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len) static struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, - const u8 *sn, size_t sn_len) + const u8 *sn, size_t sn_len, + bool needref) { struct sock *sk; struct nfc_llcp_sock *llcp_sock, *tmp_sock; @@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local, if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) { llcp_sock = tmp_sock; + if (needref) + sock_hold(&llcp_sock->sk); break; } } @@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local, * to this service name. */ if (nfc_llcp_sock_from_sn(local, sock->service_name, - sock->service_name_len) != NULL) { + sock->service_name_len, + false) != NULL) { mutex_unlock(&local->sdp_lock); return LLCP_SAP_MAX; @@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local, const u8 *sn, size_t sn_len) { - struct nfc_llcp_sock *llcp_sock; - - llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len); - - if (llcp_sock == NULL) - return NULL; - - sock_hold(&llcp_sock->sk); - - return llcp_sock; + return nfc_llcp_sock_from_sn(local, sn, sn_len, true); } static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len) @@ -1307,7 +1298,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, } llcp_sock = nfc_llcp_sock_from_sn(local, service_name, - service_name_len); + service_name_len, + true); if (!llcp_sock) { sap = 0; goto add_snl; @@ -1327,6 +1319,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, if (sap == LLCP_SAP_MAX) { sap = 0; + nfc_llcp_sock_put(llcp_sock); goto add_snl; } @@ -1344,6 +1337,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local, pr_debug("%p %d\n", llcp_sock, sap); + nfc_llcp_sock_put(llcp_sock); add_snl: sdp = nfc_llcp_build_sdres_tlv(tid, sap); if (sdp == NULL) -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] *** SUBJECT HERE ***
by Zhou Shuai 12 Mar '24

12 Mar '24

*** BLURB HERE *** Zhou Shuai (1): net/hinic: Sync hinic driver with OLK-5.10 drivers/net/ethernet/huawei/hinic/Makefile | 14 +- .../net/ethernet/huawei/hinic/hinic_api_cmd.c | 1164 ++++ .../net/ethernet/huawei/hinic/hinic_api_cmd.h | 298 + drivers/net/ethernet/huawei/hinic/hinic_cfg.c | 2478 ++++++++ drivers/net/ethernet/huawei/hinic/hinic_cfg.h | 526 ++ .../net/ethernet/huawei/hinic/hinic_cmdq.c | 1575 ++++++ .../net/ethernet/huawei/hinic/hinic_cmdq.h | 217 + .../net/ethernet/huawei/hinic/hinic_common.c | 71 - .../net/ethernet/huawei/hinic/hinic_common.h | 29 - drivers/net/ethernet/huawei/hinic/hinic_csr.h | 207 + .../net/ethernet/huawei/hinic/hinic_ctx_def.h | 242 + drivers/net/ethernet/huawei/hinic/hinic_dbg.h | 93 + .../ethernet/huawei/hinic/hinic_dbgtool_knl.c | 899 +++ .../ethernet/huawei/hinic/hinic_dbgtool_knl.h | 120 + drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 1795 ++++++ drivers/net/ethernet/huawei/hinic/hinic_dcb.h | 67 + .../net/ethernet/huawei/hinic/hinic_debugfs.c | 324 -- .../net/ethernet/huawei/hinic/hinic_debugfs.h | 113 - drivers/net/ethernet/huawei/hinic/hinic_dev.h | 132 - .../net/ethernet/huawei/hinic/hinic_devlink.c | 584 -- .../net/ethernet/huawei/hinic/hinic_devlink.h | 119 - .../net/ethernet/huawei/hinic/hinic_dfx_def.h | 150 + drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 1462 +++++ drivers/net/ethernet/huawei/hinic/hinic_eqs.h | 177 + .../net/ethernet/huawei/hinic/hinic_ethtool.c | 3078 ++++++---- drivers/net/ethernet/huawei/hinic/hinic_hw.h | 770 +++ .../ethernet/huawei/hinic/hinic_hw_api_cmd.c | 987 ---- .../ethernet/huawei/hinic/hinic_hw_api_cmd.h | 203 - .../net/ethernet/huawei/hinic/hinic_hw_cmdq.c | 963 ---- .../net/ethernet/huawei/hinic/hinic_hw_cmdq.h | 185 - .../net/ethernet/huawei/hinic/hinic_hw_csr.h | 139 - .../net/ethernet/huawei/hinic/hinic_hw_dev.c | 1197 ---- .../net/ethernet/huawei/hinic/hinic_hw_dev.h | 660 --- .../net/ethernet/huawei/hinic/hinic_hw_eqs.c | 996 ---- .../net/ethernet/huawei/hinic/hinic_hw_eqs.h | 262 - .../net/ethernet/huawei/hinic/hinic_hw_if.c | 419 -- .../net/ethernet/huawei/hinic/hinic_hw_if.h | 295 - .../net/ethernet/huawei/hinic/hinic_hw_io.c | 634 --- .../net/ethernet/huawei/hinic/hinic_hw_io.h | 123 - .../net/ethernet/huawei/hinic/hinic_hw_mbox.h | 172 - .../net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 681 --- .../net/ethernet/huawei/hinic/hinic_hw_mgmt.h | 636 ++- .../net/ethernet/huawei/hinic/hinic_hw_qp.c | 971 ---- .../net/ethernet/huawei/hinic/hinic_hw_qp.h | 232 - .../ethernet/huawei/hinic/hinic_hw_qp_ctxt.h | 210 - .../net/ethernet/huawei/hinic/hinic_hw_wq.c | 904 --- .../net/ethernet/huawei/hinic/hinic_hw_wq.h | 111 - .../net/ethernet/huawei/hinic/hinic_hw_wqe.h | 430 -- .../net/ethernet/huawei/hinic/hinic_hwdev.c | 5001 +++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_hwdev.h | 370 ++ .../net/ethernet/huawei/hinic/hinic_hwif.c | 1005 ++++ .../net/ethernet/huawei/hinic/hinic_hwif.h | 123 + drivers/net/ethernet/huawei/hinic/hinic_lld.c | 2923 ++++++++++ drivers/net/ethernet/huawei/hinic/hinic_lld.h | 128 + .../net/ethernet/huawei/hinic/hinic_main.c | 3848 +++++++++---- .../hinic/{hinic_hw_mbox.c => hinic_mbox.c} | 1267 +++-- .../net/ethernet/huawei/hinic/hinic_mbox.h | 241 + .../net/ethernet/huawei/hinic/hinic_mgmt.c | 1446 +++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 245 + .../huawei/hinic/hinic_mgmt_interface.h | 987 ++++ .../ethernet/huawei/hinic/hinic_msix_attr.c | 130 + .../ethernet/huawei/hinic/hinic_msix_attr.h | 69 + .../huawei/hinic/hinic_multi_host_mgmt.c | 972 ++++ .../huawei/hinic/hinic_multi_host_mgmt.h | 107 + drivers/net/ethernet/huawei/hinic/hinic_nic.h | 115 + .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 3996 +++++++++++++ .../net/ethernet/huawei/hinic/hinic_nic_cfg.h | 638 +++ .../net/ethernet/huawei/hinic/hinic_nic_dbg.c | 294 + .../net/ethernet/huawei/hinic/hinic_nic_dev.h | 289 + .../net/ethernet/huawei/hinic/hinic_nic_io.c | 1047 ++++ .../net/ethernet/huawei/hinic/hinic_nic_io.h | 99 + .../net/ethernet/huawei/hinic/hinic_nictool.c | 2503 +++++++++ .../net/ethernet/huawei/hinic/hinic_nictool.h | 277 + .../ethernet/huawei/hinic/hinic_pci_id_tbl.h | 40 + .../net/ethernet/huawei/hinic/hinic_port.c | 1412 ----- .../net/ethernet/huawei/hinic/hinic_port.h | 900 --- .../ethernet/huawei/hinic/hinic_port_cmd.h | 541 ++ .../net/ethernet/huawei/hinic/hinic_qe_def.h | 459 ++ drivers/net/ethernet/huawei/hinic/hinic_qp.c | 222 + drivers/net/ethernet/huawei/hinic/hinic_qp.h | 143 + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 1342 +++-- drivers/net/ethernet/huawei/hinic/hinic_rx.h | 126 +- .../net/ethernet/huawei/hinic/hinic_sm_lt.h | 228 + .../ethernet/huawei/hinic/hinic_sml_counter.c | 310 + .../ethernet/huawei/hinic/hinic_sml_counter.h | 119 + .../net/ethernet/huawei/hinic/hinic_sml_lt.c | 286 + .../net/ethernet/huawei/hinic/hinic_sriov.c | 1535 ++--- .../net/ethernet/huawei/hinic/hinic_sriov.h | 98 +- drivers/net/ethernet/huawei/hinic/hinic_tx.c | 1426 +++-- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 127 +- drivers/net/ethernet/huawei/hinic/hinic_wq.c | 683 +++ drivers/net/ethernet/huawei/hinic/hinic_wq.h | 117 + drivers/net/ethernet/huawei/hinic/ossl_knl.h | 63 + 93 files changed, 46543 insertions(+), 19868 deletions(-) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_common.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_csr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_ctx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dcb.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_debugfs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_devlink.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_dfx_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_eqs.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_api_cmd.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_cmdq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_csr.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_dev.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_if.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_io.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_qp_ctxt.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wq.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hw_wqe.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwdev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_hwif.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_lld.h rename drivers/net/ethernet/huawei/hinic/{hinic_hw_mbox.c => hinic_mbox.c} (58%) create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mbox.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_mgmt_interface.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_msix_attr.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nic_io.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_nictool.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_pci_id_tbl.h delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.c delete mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_port_cmd.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qe_def.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_qp.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sm_lt.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_counter.h create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_sml_lt.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.c create mode 100644 drivers/net/ethernet/huawei/hinic/hinic_wq.h create mode 100644 drivers/net/ethernet/huawei/hinic/ossl_knl.h -- 2.24.0

2 2

[PATCH OLK-6.6 00/15] KVM: arm64: Enable 'writable' ID registers
by chenxiang 12 Mar '24

12 Mar '24

From: caijian <caijian11(a)h-partners.com> Backport the code of enabling 'writable' ID registers from mainline to openEuler 6.6. It is the fundation of live migration between different platforms. Marc Zyngier (15): KVM: arm64: vgic-v3: Upgrade AP1Rn to 64bit. KVM: arm64: vgic-v3: Allow the NMI state to make it into the LRs KVM: arm64: vgic-v3: Make NMI priority RES0 KVM: arm64: vgic-v4: Propagate the NMI state into the GICv4.1 VSGI configuration KVM: arm64: vgic-v3: Use the NMI attribute as part of the AP-list sorting KVM: arm64: vgic-v3: Add support for GIC{D,R}_INMIR registers KVM: arm64: vgic-v3: Add userspace selection for GICv3.3 NMI KVM: arm64: vgic-debug: Add the NMI field to the debug output KVM: arm64: Allow userspace to control ID_AA64PFR1_EL1.NMI KVM: arm64: Don't trap ALLINT accesses if the vcpu has FEAT_NMI KVM: arm64: vgic-v3: Don't inject an NMI if the vcpu doesn't have FEAT_NMI KVM: arm64: Allow GICv3.3 NMI if the host supports it KVM: arm64: Handle traps of ALLINT arm64: Decouple KVM from CONFIG_ARM64_NMI KVM: arm64: vgic-v3: Handle traps of ICV_NMIAR1_EL1 arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/asm/sysreg.h | 3 ++ arch/arm64/kernel/cpufeature.c | 15 +++--- arch/arm64/kvm/arm.c | 3 ++ arch/arm64/kvm/hyp/include/hyp/switch.h | 6 ++- arch/arm64/kvm/hyp/vgic-v3-sr.c | 14 +++-- arch/arm64/kvm/sys_regs.c | 33 +++++++++++- arch/arm64/kvm/vgic/vgic-debug.c | 9 ++-- arch/arm64/kvm/vgic/vgic-init.c | 10 +++- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 1 + arch/arm64/kvm/vgic/vgic-mmio-v3.c | 70 ++++++++++++++++++++++++- arch/arm64/kvm/vgic/vgic-mmio.c | 25 ++++++--- arch/arm64/kvm/vgic/vgic-v3.c | 12 ++++- arch/arm64/kvm/vgic/vgic-v4.c | 1 + arch/arm64/kvm/vgic/vgic.c | 8 ++- arch/arm64/kvm/vgic/vgic.h | 1 + drivers/irqchip/irq-gic-v3-its.c | 9 ++++ drivers/irqchip/irq-gic-v3.c | 12 +++++ drivers/irqchip/irq-gic-v4.c | 3 +- include/kvm/arm_vgic.h | 10 +++- include/linux/irqchip/arm-gic-v4.h | 4 +- include/linux/irqchip/arm-vgic-info.h | 2 + 23 files changed, 224 insertions(+), 32 deletions(-) -- 2.30.0

2 12

[PATCH OLK-6.6 0/6] Adding Huawei BMA driver
by Zheng Zengkai 12 Mar '24

12 Mar '24

From: Huajingjing <huajingjing1(a)huawei.com> This patch set contains 5 communication drivers for Huawei BMA software. The BMA software is a system management software. It supports the status monitoring, performance monitoring, and event monitoring of various components, including server CPUs, memory, hard disks, NICs, IB cards, PCIe cards, RAID controller cards, and optical modules. These 5 drivers are used to send/receive message through PCIe channel in different ways by BMA software. Huajingjing (6): Huawei BMA: Adding Huawei BMA driver: host_edma_drv Huawei BMA: Adding Huawei BMA driver: host_cdev_drv Huawei BMA: Adding Huawei BMA driver: host_veth_drv Huawei BMA: Adding Huawei BMA driver: host_kbox_drv Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv configs: add config BMA to config files arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/bma/Kconfig | 10 + drivers/net/ethernet/huawei/bma/Makefile | 9 + .../net/ethernet/huawei/bma/cdev_drv/Makefile | 2 + .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 369 +++ .../huawei/bma/cdev_veth_drv/Makefile | 2 + .../bma/cdev_veth_drv/virtual_cdev_eth_net.c | 1864 ++++++++++++ .../bma/cdev_veth_drv/virtual_cdev_eth_net.h | 299 ++ .../net/ethernet/huawei/bma/edma_drv/Makefile | 2 + .../huawei/bma/edma_drv/bma_devintf.c | 621 ++++ .../huawei/bma/edma_drv/bma_devintf.h | 40 + .../huawei/bma/edma_drv/bma_include.h | 116 + .../ethernet/huawei/bma/edma_drv/bma_pci.c | 533 ++++ .../ethernet/huawei/bma/edma_drv/bma_pci.h | 98 + .../ethernet/huawei/bma/edma_drv/edma_host.c | 1462 ++++++++++ .../ethernet/huawei/bma/edma_drv/edma_host.h | 351 +++ .../huawei/bma/include/bma_ker_intf.h | 94 + .../net/ethernet/huawei/bma/kbox_drv/Makefile | 5 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.c | 121 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.h | 33 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.c | 102 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.h | 33 + .../huawei/bma/kbox_drv/kbox_include.h | 40 + .../ethernet/huawei/bma/kbox_drv/kbox_main.c | 176 ++ .../ethernet/huawei/bma/kbox_drv/kbox_main.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_mce.c | 264 ++ .../ethernet/huawei/bma/kbox_drv/kbox_mce.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_panic.c | 187 ++ .../ethernet/huawei/bma/kbox_drv/kbox_panic.h | 25 + .../huawei/bma/kbox_drv/kbox_printk.c | 363 +++ .../huawei/bma/kbox_drv/kbox_printk.h | 33 + .../huawei/bma/kbox_drv/kbox_ram_drive.c | 188 ++ .../huawei/bma/kbox_drv/kbox_ram_drive.h | 31 + .../huawei/bma/kbox_drv/kbox_ram_image.c | 135 + .../huawei/bma/kbox_drv/kbox_ram_image.h | 84 + .../huawei/bma/kbox_drv/kbox_ram_op.c | 986 +++++++ .../huawei/bma/kbox_drv/kbox_ram_op.h | 77 + .../net/ethernet/huawei/bma/veth_drv/Makefile | 2 + .../ethernet/huawei/bma/veth_drv/veth_hb.c | 2504 +++++++++++++++++ .../ethernet/huawei/bma/veth_drv/veth_hb.h | 440 +++ 43 files changed, 11751 insertions(+) create mode 100644 drivers/net/ethernet/huawei/bma/Kconfig create mode 100644 drivers/net/ethernet/huawei/bma/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.h create mode 100644 drivers/net/ethernet/huawei/bma/include/bma_ker_intf.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.h create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h -- 2.27.0

2 7

[PATCH OLK-5.10] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v5.10.199 commit a424807d860ba816aaafc3064b46b456361c0802 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index ed9019d807c7..4c931bd1c174 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -894,6 +894,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v4.19.297 commit a686f84101680b8442181a8846fbd3c934653729 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 75017a345b5a..6ba0cdbf8c4a 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -902,6 +902,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 12 Mar '24

12 Mar '24

Wang ShaoBo (1): arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak Zeng Heng (1): arm64/mpam: Fix use-after-free when deleting resource groups arch/arm64/include/asm/resctrl.h | 18 +++++++++++++ arch/arm64/kernel/mpam/mpam_ctrlmon.c | 8 ------ arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- fs/resctrlfs.c | 37 ++++++++++----------------- 4 files changed, 32 insertions(+), 33 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 6dcdc42ed081..ec54cd687ef1 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2917,7 +2917,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2933,19 +2932,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 9b9b9557ae74..11f9cb222bdc 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2803,7 +2803,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2819,19 +2818,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..0cfb3cd21858 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -78,9 +78,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info_once("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,9 +170,10 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + if (!d) { + pr_info_once("There is no msc corresponding to CPU%d.\n", cpu); continue; + } cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97GSW ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 0b16164dc7a9 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 3f650eafccd0..0bbe0c50f4f9 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -672,26 +672,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[openeuler:OLK-5.10 9183/30000] mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'?
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2ad5d68f167008a56711bd61c282768420796602 commit: c533562a2802206135467a06384ba33cff42b18a [9183/30000] share_pool: Use sharepool_no_page to alloc hugepage config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240312/202403121009.nJzCAN1u-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403121009.nJzCAN1u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403121009.nJzCAN1u-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:858:29: warning: ordered comparison of pointer with integer zero [-Wextra] 858 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3014:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3014 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3014:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3394:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3394 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: At top level: mm/share_pool.c:3691:6: warning: no previous prototype for 'sp_proc_stat_drop' [-Wmissing-prototypes] 3691 | void sp_proc_stat_drop(struct sp_proc_stat *stat) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:3922:6: warning: no previous prototype for 'spa_overview_show' [-Wmissing-prototypes] 3922 | void spa_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:4004:6: warning: no previous prototype for 'spg_overview_show' [-Wmissing-prototypes] 4004 | void spg_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4221 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock >> mm/share_pool.c:4234:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4234 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache >> mm/share_pool.c:4256:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4256 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at >> mm/share_pool.c:4258:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4258 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors vim +4221 mm/share_pool.c 4179 4180 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4181 struct vm_area_struct *vma, 4182 struct address_space *mapping, pgoff_t idx, 4183 unsigned long address, pte_t *ptep, unsigned int flags) 4184 { 4185 struct hstate *h = hstate_vma(vma); 4186 vm_fault_t ret = VM_FAULT_SIGBUS; 4187 unsigned long size; 4188 struct page *page; 4189 pte_t new_pte; 4190 spinlock_t *ptl; 4191 unsigned long haddr = address & huge_page_mask(h); 4192 bool new_page = false; 4193 int err; 4194 int node_id; 4195 struct sp_area *spa; 4196 4197 spa = __find_sp_area(vma->vm_start); 4198 if (!spa) { 4199 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4200 return ret; 4201 } 4202 node_id = spa->node_id; 4203 __sp_area_drop(spa); 4204 4205 retry: 4206 page = find_lock_page(mapping, idx); 4207 if (!page) { 4208 size = i_size_read(mapping->host) >> huge_page_shift(h); 4209 if (idx >= size) 4210 goto out; 4211 4212 page = alloc_huge_page(vma, haddr, 0); 4213 if (IS_ERR(page)) { 4214 page = alloc_huge_page_nodemask(hstate_file(vma->vm_file), 4215 node_id, NULL, GFP_KERNEL); 4216 if (!page) 4217 page = ERR_PTR(-ENOMEM); 4218 } 4219 if (IS_ERR(page)) { 4220 ptl = huge_pte_lock(h, mm, ptep); > 4221 if (!huge_pte_none(huge_ptep_get(ptep))) { 4222 ret = 0; 4223 spin_unlock(ptl); 4224 goto out; 4225 } 4226 spin_unlock(ptl); 4227 ret = vmf_error(PTR_ERR(page)); 4228 goto out; 4229 } 4230 __SetPageUptodate(page); 4231 new_page = true; 4232 4233 /* sharepool pages are all shared */ > 4234 err = huge_add_to_page_cache(page, mapping, idx); 4235 if (err) { 4236 put_page(page); 4237 if (err == -EEXIST) 4238 goto retry; 4239 goto out; 4240 } 4241 } 4242 4243 4244 ptl = huge_pte_lock(h, mm, ptep); 4245 size = i_size_read(mapping->host) >> huge_page_shift(h); 4246 if (idx >= size) 4247 goto backout; 4248 4249 ret = 0; 4250 if (!huge_pte_none(huge_ptep_get(ptep))) 4251 goto backout; 4252 4253 page_dup_rmap(page, true); 4254 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4255 && (vma->vm_flags & VM_SHARED))); > 4256 set_huge_pte_at(mm, haddr, ptep, new_pte); 4257 > 4258 hugetlb_count_add(pages_per_huge_page(h), mm); 4259 4260 spin_unlock(ptl); 4261 4262 if (new_page) { 4263 SetPagePrivate(&page[1]); 4264 } 4265 4266 unlock_page(page); 4267 out: 4268 return ret; 4269 4270 backout: 4271 spin_unlock(ptl); 4272 unlock_page(page); 4273 put_page(page); 4274 goto out; 4275 } 4276 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97KAV -------------------------------- Refer to the below commit: commit b8511ccc75c0 ("x86/resctrl: Fix use-after-free when deleting resource groups") Before removing rdtgroup, we need to refer to waitcount counter, otherwise when unmounting the resctrl file system or deleting ctrl_mon groups, and there were a waiter on resctrl system, then a use-after-free issue would occurs. Fix that by removing rdtgroup after checking the waitcount. Fixes: 3b856c03b36a ("arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index e02e4769edc0..3f650eafccd0 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -485,7 +485,10 @@ static void free_all_child_rdtgrp(struct resctrl_group *rdtgrp) /* rmid may not be used */ rmid_free(sentry->mon.rmid); list_del(&sentry->mon.crdtgrp_list); - rdtgroup_remove(sentry); + if (atomic_read(&sentry->waitcount) != 0) + sentry->flags = RDT_DELETED; + else + rdtgroup_remove(sentry); } } @@ -519,7 +522,10 @@ static void rmdir_all_sub(void) kernfs_remove(rdtgrp->kn); list_del(&rdtgrp->resctrl_group_list); - rdtgroup_remove(rdtgrp); + if (atomic_read(&rdtgrp->waitcount) != 0) + rdtgrp->flags = RDT_DELETED; + else + rdtgroup_remove(rdtgrp); } /* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */ update_closid_rmid(cpu_online_mask, &resctrl_group_default); -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 2ad5d68f167008a56711bd61c282768420796602
by kernel test robot 12 Mar '24

12 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2ad5d68f167008a56711bd61c282768420796602 !5117 fix CVE-2023-52527 Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240312 `-- drivers-gpu-drm-phytium-phytium_dp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 736m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 randconfig-072-20240312 gcc x86_64 randconfig-073-20240312 clang x86_64 randconfig-074-20240312 gcc x86_64 randconfig-075-20240312 gcc x86_64 randconfig-076-20240312 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f0a83d8e747248d5b1628d7afec65bee2e48e580
by kernel test robot 12 Mar '24

12 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f0a83d8e747248d5b1628d7afec65bee2e48e580 !4927 ima: digest list new support modsig Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- arm64-randconfig-003-20240312 | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_disable_msi | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:implicit-declaration-of-function-pci_enable_msi | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-002-20240312 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-005-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-004-20240312 | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-buildonly-randconfig-001-20240312 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead elapsed time: 732m configs tested: 36 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240312 gcc arm64 randconfig-002-20240312 gcc arm64 randconfig-003-20240312 gcc arm64 randconfig-004-20240312 clang loongarch alldefconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240312 gcc loongarch randconfig-002-20240312 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240312 clang x86_64 buildonly-randconfig-002-20240312 clang x86_64 buildonly-randconfig-003-20240312 clang x86_64 buildonly-randconfig-004-20240312 clang x86_64 buildonly-randconfig-005-20240312 gcc x86_64 buildonly-randconfig-006-20240312 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240312 clang x86_64 randconfig-002-20240312 clang x86_64 randconfig-003-20240312 gcc x86_64 randconfig-004-20240312 gcc x86_64 randconfig-005-20240312 gcc x86_64 randconfig-006-20240312 clang x86_64 randconfig-011-20240312 gcc x86_64 randconfig-012-20240312 clang x86_64 randconfig-013-20240312 gcc x86_64 randconfig-014-20240312 gcc x86_64 randconfig-015-20240312 clang x86_64 randconfig-016-20240312 clang x86_64 randconfig-071-20240312 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 3160/21845] drivers/acpi/arm64/iort.c:1370:73: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 8393e1c316adfa8f2fdbba0d7c69fc7ae2293393 commit: 68088650bec0647cef4d822b31f818a094f5eead [3160/21845] perf/smmuv3_pmu: Enable HiSilicon Erratum 162001800 quirk config: arm64-randconfig-r132-20240304 (https://download.01.org/0day-ci/archive/20240312/202403120704.BrgZdp3c-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240312/202403120704.BrgZdp3c-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403120704.BrgZdp3c-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/acpi/arm64/iort.c:1370:73: sparse: sparse: Using plain integer as NULL pointer drivers/acpi/arm64/iort.c:61: warning: Function parameter or member 'iort_node' not described in 'iort_set_fwnode' drivers/acpi/arm64/iort.c:61: warning: Excess function parameter 'node' description in 'iort_set_fwnode' drivers/acpi/arm64/iort.c:980: warning: Function parameter or member 'dma_size' not described in 'iort_dma_setup' drivers/acpi/arm64/iort.c:980: warning: Excess function parameter 'size' description in 'iort_dma_setup' drivers/acpi/arm64/iort.c:1447: warning: Function parameter or member 'ops' not described in 'iort_add_platform_device' vim +1370 drivers/acpi/arm64/iort.c 1367 1368 static struct acpi_platform_list pmcg_plat_info[] __initdata = { 1369 /* HiSilicon Hip08 Platform */ > 1370 {"HISI ", "HIP08 ", 0, ACPI_SIG_IORT, greater_than_or_equal, 0, 1371 IORT_SMMU_V3_PMCG_HISI_HIP08}, 1372 { } 1373 }; 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/8] cpuset exclusive feature
by Chen Ridong 11 Mar '24

11 Mar '24

Harshit Mogalapalli (1): cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check() Kamalesh Babulal (1): cgroup/cpuset: Fix retval in update_cpumask() Waiman Long (6): cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 cgroup/cpuset: Add cpuset.cpus.exclusive for v2 cgroup/cpuset: Introduce remote partition cgroup/cpuset: Check partition conflict with housekeeping setup cgroup/cpuset: Enable invalid to valid local partition transition cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() kernel/cgroup/cpuset.c | 1306 ++++++++++++++++++++++++++++++---------- 1 file changed, 975 insertions(+), 331 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 11 Mar '24

11 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9758Q ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 750084197059 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 0e6753012140..4e9a1cdb9b13 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -550,26 +550,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 11 Mar '24

11 Mar '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9758Q ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 750084197059 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 0e6753012140..4e9a1cdb9b13 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -550,26 +550,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-v5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: 189657 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- fs/nfs/fs_context.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c index 29ec8b09a52d..05b39e8f97b9 100644 --- a/fs/nfs/fs_context.c +++ b/fs/nfs/fs_context.c @@ -937,6 +937,15 @@ static int nfs23_parse_monolithic(struct fs_context *fc, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_fs_context, which nfs_fill_super * can deal with. @@ -1037,6 +1046,9 @@ static int nfs23_parse_monolithic(struct fs_context *fc, out_invalid_fh: return nfs_invalf(fc, "NFS: invalid root filehandle"); + +out_invalid_data: + return nfs_invalf(fc, "NFS: invalid binary mount data"); } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

1 0

[PATCH OLK-6.6] modpost: Optimize symbol search from linear to binary search
by Hongchen Zhang 11 Mar '24

11 Mar '24

From: Jack Brennen <jbrennen(a)google.com> mainline inclusion from mainline-v6.7-rc1 commit 4074532758c5c367d3fcb8d124150824a254659d category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I97HOU CVE: NA -------------------------------- Modify modpost to use binary search for converting addresses back into symbol references. Previously it used linear search. This change saves a few seconds of wall time for defconfig builds, but can save several minutes on allyesconfigs. Before: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 198.38user 1.27system 3:19.71elapsed After: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 11.91user 0.85system 0:12.78elapsed Signed-off-by: Jack Brennen <jbrennen(a)google.com> Tested-by: Nick Desaulniers <ndesaulniers(a)google.com> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> --- scripts/mod/Makefile | 4 +- scripts/mod/modpost.c | 70 ++------------ scripts/mod/modpost.h | 25 +++++ scripts/mod/symsearch.c | 199 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 232 insertions(+), 66 deletions(-) create mode 100644 scripts/mod/symsearch.c diff --git a/scripts/mod/Makefile b/scripts/mod/Makefile index c9e38ad937fd..3c54125eb373 100644 --- a/scripts/mod/Makefile +++ b/scripts/mod/Makefile @@ -5,7 +5,7 @@ CFLAGS_REMOVE_empty.o += $(CC_FLAGS_LTO) hostprogs-always-y += modpost mk_elfconfig always-y += empty.o -modpost-objs := modpost.o file2alias.o sumversion.o +modpost-objs := modpost.o file2alias.o sumversion.o symsearch.o devicetable-offsets-file := devicetable-offsets.h @@ -16,7 +16,7 @@ targets += $(devicetable-offsets-file) devicetable-offsets.s # dependencies on generated files need to be listed explicitly -$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o: $(obj)/elfconfig.h +$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o $(obj)/symsearch.o: $(obj)/elfconfig.h $(obj)/file2alias.o: $(obj)/$(devicetable-offsets-file) quiet_cmd_elfconfig = MKELF $@ diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index ac4ef3e206bb..e6c8b096362e 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -22,7 +22,6 @@ #include <errno.h> #include "modpost.h" #include "../../include/linux/license.h" -#include "../../include/linux/module_symbol.h" static bool module_enabled; /* Are we using CONFIG_MODVERSIONS? */ @@ -577,11 +576,14 @@ static int parse_elf(struct elf_info *info, const char *filename) *p = TO_NATIVE(*p); } + symsearch_init(info); + return 1; } static void parse_elf_finish(struct elf_info *info) { + symsearch_finish(info); release_file(info->hdr, info->size); } @@ -1050,71 +1052,10 @@ static int secref_whitelist(const char *fromsec, const char *fromsym, return 1; } -/* - * If there's no name there, ignore it; likewise, ignore it if it's - * one of the magic symbols emitted used by current tools. - * - * Otherwise if find_symbols_between() returns those symbols, they'll - * fail the whitelist tests and cause lots of false alarms ... fixable - * only by merging __exit and __init sections into __text, bloating - * the kernel (which is especially evil on embedded platforms). - */ -static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) -{ - const char *name = elf->strtab + sym->st_name; - - if (!name || !strlen(name)) - return 0; - return !is_mapping_symbol(name); -} - -/* Look up the nearest symbol based on the section and the address */ -static Elf_Sym *find_nearest_sym(struct elf_info *elf, Elf_Addr addr, - unsigned int secndx, bool allow_negative, - Elf_Addr min_distance) -{ - Elf_Sym *sym; - Elf_Sym *near = NULL; - Elf_Addr sym_addr, distance; - bool is_arm = (elf->hdr->e_machine == EM_ARM); - - for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { - if (get_secindex(elf, sym) != secndx) - continue; - if (!is_valid_name(elf, sym)) - continue; - - sym_addr = sym->st_value; - - /* - * For ARM Thumb instruction, the bit 0 of st_value is set - * if the symbol is STT_FUNC type. Mask it to get the address. - */ - if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) - sym_addr &= ~1; - - if (addr >= sym_addr) - distance = addr - sym_addr; - else if (allow_negative) - distance = sym_addr - addr; - else - continue; - - if (distance <= min_distance) { - min_distance = distance; - near = sym; - } - - if (min_distance == 0) - break; - } - return near; -} - static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr, unsigned int secndx) { - return find_nearest_sym(elf, addr, secndx, false, ~0); + return symsearch_find_nearest(elf, addr, secndx, false, ~0); } static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) @@ -1127,7 +1068,8 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) * Strive to find a better symbol name, but the resulting name may not * match the symbol referenced in the original code. */ - return find_nearest_sym(elf, addr, get_secindex(elf, sym), true, 20); + return symsearch_find_nearest(elf, addr, get_secindex(elf, sym), + true, 20); } static bool is_executable_section(struct elf_info *elf, unsigned int secndx) diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h index 5f94c2c9f2d9..6413f26fcb6b 100644 --- a/scripts/mod/modpost.h +++ b/scripts/mod/modpost.h @@ -10,6 +10,7 @@ #include <fcntl.h> #include <unistd.h> #include <elf.h> +#include "../../include/linux/module_symbol.h" #include "list.h" #include "elfconfig.h" @@ -128,6 +129,8 @@ struct elf_info { * take shndx from symtab_shndx_start[N] instead */ Elf32_Word *symtab_shndx_start; Elf32_Word *symtab_shndx_stop; + + struct symsearch *symsearch; }; /* Accessor for sym->st_shndx, hides ugliness of "64k sections" */ @@ -154,6 +157,28 @@ static inline unsigned int get_secindex(const struct elf_info *info, return index; } +/* + * If there's no name there, ignore it; likewise, ignore it if it's + * one of the magic symbols emitted used by current tools. + * + * Internal symbols created by tools should be ignored by modpost. + */ +static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) +{ + const char *name = elf->strtab + sym->st_name; + + if (!name || !strlen(name)) + return 0; + return !is_mapping_symbol(name); +} + +/* symsearch.c */ +void symsearch_init(struct elf_info *elf); +void symsearch_finish(struct elf_info *elf); +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance); + /* file2alias.c */ void handle_moddevtable(struct module *mod, struct elf_info *info, Elf_Sym *sym, const char *symname); diff --git a/scripts/mod/symsearch.c b/scripts/mod/symsearch.c new file mode 100644 index 000000000000..aa4ed51f9960 --- /dev/null +++ b/scripts/mod/symsearch.c @@ -0,0 +1,199 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Helper functions for finding the symbol in an ELF which is "nearest" + * to a given address. + */ + +#include "modpost.h" + +struct syminfo { + unsigned int symbol_index; + unsigned int section_index; + Elf_Addr addr; +}; + +/* + * Container used to hold an entire binary search table. + * Entries in table are ascending, sorted first by section_index, + * then by addr, and last by symbol_index. The sorting by + * symbol_index is used to ensure predictable behavior when + * multiple symbols are present with the same address; all + * symbols past the first are effectively ignored, by eliding + * them in symsearch_fixup(). + */ +struct symsearch { + unsigned int table_size; + struct syminfo table[]; +}; + +static int syminfo_compare(const void *s1, const void *s2) +{ + const struct syminfo *sym1 = s1; + const struct syminfo *sym2 = s2; + + if (sym1->section_index > sym2->section_index) + return 1; + if (sym1->section_index < sym2->section_index) + return -1; + if (sym1->addr > sym2->addr) + return 1; + if (sym1->addr < sym2->addr) + return -1; + if (sym1->symbol_index > sym2->symbol_index) + return 1; + if (sym1->symbol_index < sym2->symbol_index) + return -1; + return 0; +} + +static unsigned int symbol_count(struct elf_info *elf) +{ + unsigned int result = 0; + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) + result++; + } + return result; +} + +/* + * Populate the search array that we just allocated. + * Be slightly paranoid here. The ELF file is mmap'd and could + * conceivably change between symbol_count() and symsearch_populate(). + * If we notice any difference, bail out rather than potentially + * propagating errors or crashing. + */ +static void symsearch_populate(struct elf_info *elf, + struct syminfo *table, + unsigned int table_size) +{ + bool is_arm = (elf->hdr->e_machine == EM_ARM); + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) { + if (table_size-- == 0) + fatal("%s: size mismatch\n", __func__); + table->symbol_index = sym - elf->symtab_start; + table->section_index = get_secindex(elf, sym); + table->addr = sym->st_value; + + /* + * For ARM Thumb instruction, the bit 0 of st_value is + * set if the symbol is STT_FUNC type. Mask it to get + * the address. + */ + if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) + table->addr &= ~1; + + table++; + } + } + + if (table_size != 0) + fatal("%s: size mismatch\n", __func__); +} + +/* + * Do any fixups on the table after sorting. + * For now, this just finds adjacent entries which have + * the same section_index and addr, and it propagates + * the first symbol_index over the subsequent entries, + * so that only one symbol_index is seen for any given + * section_index and addr. This ensures that whether + * we're looking at an address from "above" or "below" + * that we see the same symbol_index. + * This does leave some duplicate entries in the table; + * in practice, these are a small fraction of the + * total number of entries, and they are harmless to + * the binary search algorithm other than a few occasional + * unnecessary comparisons. + */ +static void symsearch_fixup(struct syminfo *table, unsigned int table_size) +{ + /* Don't look at index 0, it will never change. */ + for (unsigned int i = 1; i < table_size; i++) { + if (table[i].addr == table[i - 1].addr && + table[i].section_index == table[i - 1].section_index) { + table[i].symbol_index = table[i - 1].symbol_index; + } + } +} + +void symsearch_init(struct elf_info *elf) +{ + unsigned int table_size = symbol_count(elf); + + elf->symsearch = NOFAIL(malloc(sizeof(struct symsearch) + + sizeof(struct syminfo) * table_size)); + elf->symsearch->table_size = table_size; + + symsearch_populate(elf, elf->symsearch->table, table_size); + qsort(elf->symsearch->table, table_size, + sizeof(struct syminfo), syminfo_compare); + + symsearch_fixup(elf->symsearch->table, table_size); +} + +void symsearch_finish(struct elf_info *elf) +{ + free(elf->symsearch); + elf->symsearch = NULL; +} + +/* + * Find the syminfo which is in secndx and "nearest" to addr. + * allow_negative: allow returning a symbol whose address is > addr. + * min_distance: ignore symbols which are further away than this. + * + * Returns a pointer into the symbol table for success. + * Returns NULL if no legal symbol is found within the requested range. + */ +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance) +{ + unsigned int hi = elf->symsearch->table_size; + unsigned int lo = 0; + struct syminfo *table = elf->symsearch->table; + struct syminfo target; + + target.addr = addr; + target.section_index = secndx; + target.symbol_index = ~0; /* compares greater than any actual index */ + while (hi > lo) { + unsigned int mid = lo + (hi - lo) / 2; /* Avoids overflow */ + + if (syminfo_compare(&table[mid], &target) > 0) + hi = mid; + else + lo = mid + 1; + } + + /* + * table[hi], if it exists, is the first entry in the array which + * lies beyond target. table[hi - 1], if it exists, is the last + * entry in the array which comes before target, including the + * case where it perfectly matches the section and the address. + * + * Note -- if the address we're looking up falls perfectly + * in the middle of two symbols, this is written to always + * prefer the symbol with the lower address. + */ + Elf_Sym *result = NULL; + + if (allow_negative && + hi < elf->symsearch->table_size && + table[hi].section_index == secndx && + table[hi].addr - addr <= min_distance) { + min_distance = table[hi].addr - addr; + result = &elf->symtab_start[table[hi].symbol_index]; + } + if (hi > 0 && + table[hi - 1].section_index == secndx && + addr - table[hi - 1].addr <= min_distance) { + result = &elf->symtab_start[table[hi - 1].symbol_index]; + } + return result; +} -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/19] net: hns3: provides some customized interfaces for storage devices
by Jijie Shao 11 Mar '24

11 Mar '24

From: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Hao Chen (2): net: hns3: add support to get/set 1d torus param net: hns3: add support modified tx timeout Jian Shen (2): net: hns3: add extend interface support for read and write phy register net: hns3: add input parameters checking Jie Wang (1): net: hns3: add support PF provides customized interfaces to detect port faults. shaojijie (13): net: hns3: add support customized exception handling interfaces. net: hns3: add supports pfc storm detection and suppression net: hns3: add supports fast reporting of faulty nodes net: hns3: add support clear mac statistics net: hns3: add support configuring function-level interrupt affinity net: hns3: add support query port ext information net: hns3: add support query the presence of optical module net: hns3: add supports configure optical module enable net: hns3: add support config and query serdes lane status net: hns3: add support disable nic clock net: hns3: support set pfc pause trans time net: hns3: add support detect port wire type net: hns3: add support set led wangpeiyang (1): net: hns3: add support set mac state drivers/net/ethernet/hisilicon/hns3/Makefile | 3 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 7 + .../net/ethernet/hisilicon/hns3/hnae3_ext.h | 121 ++ .../hns3/hns3_common/hclge_comm_cmd.c | 1 + .../hns3/hns3_common/hclge_comm_cmd.h | 1 + .../net/ethernet/hisilicon/hns3/hns3_enet.c | 7 +- .../net/ethernet/hisilicon/hns3/hns3_ext.c | 543 ++++++ .../net/ethernet/hisilicon/hns3/hns3_ext.h | 67 + .../hisilicon/hns3/hns3pf/hclge_cmd.h | 14 +- .../hisilicon/hns3/hns3pf/hclge_ext.c | 1490 +++++++++++++++++ .../hisilicon/hns3/hns3pf/hclge_ext.h | 180 ++ .../hisilicon/hns3/hns3pf/hclge_main.c | 58 +- .../hisilicon/hns3/hns3pf/hclge_main.h | 12 +- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 7 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 2 + 16 files changed, 2488 insertions(+), 27 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hnae3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.h -- 2.30.0

2 20

[PATCH openEuler-1.0-LTS] crypto: scomp - fix req->dst buffer overflow
by GUO Zihua 11 Mar '24

11 Mar '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v4.19.306 commit 1142d65c5b881590962ad763f94505b6dd67d2fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I970CO CVE: NA Reference: https://github.com/gregkh/linux/commit/1142d65c5b881590962ad763f94505b6dd67… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: crypto/scompress.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 15641c96ff99..5f3fb6cbf531 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -149,6 +149,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) const int cpu = get_cpu(); u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu); u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu); + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) { @@ -164,6 +165,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0); if (dir) ret = crypto_scomp_compress(scomp, scratch_src, req->slen, @@ -178,6 +181,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 13375/21829] include/linux/uaccess.h:112:17: warning: 'kbrep' may be used uninitialized
by kernel test robot 11 Mar '24

11 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf1b7dd5d431b4248d92755c06e76094bbe2b7b4 commit: c20f651cb5a90254b561f218b967e04ff626853e [13375/21829] vt: vt_ioctl: remove unnecessary console allocation checks config: arm64-randconfig-003-20240308 (https://download.01.org/0day-ci/archive/20240311/202403110630.3gj4ph83-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240311/202403110630.3gj4ph83-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403110630.3gj4ph83-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/termios.h:6, from ./arch/arm64/include/generated/uapi/asm/termios.h:1, from include/uapi/linux/termios.h:6, from include/linux/tty.h:7, from drivers/tty/vt/vt_ioctl.c:15: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_event_wait_ioctl' at drivers/tty/vt/vt_ioctl.c:187:6: include/linux/uaccess.h:112:17: warning: 'vw' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/kernel.h:10, from include/linux/list.h:9, from include/linux/rculist.h:10, from include/linux/sched/signal.h:6, from drivers/tty/vt/vt_ioctl.c:14: include/linux/kasan-checks.h: In function 'vt_event_wait_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:185:30: note: 'vw' declared here 185 | struct vt_event_wait vw; | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:450:7: >> include/linux/uaccess.h:112:17: warning: 'kbrep' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:445:35: note: 'kbrep' declared here 445 | struct kbd_repeat kbrep; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:605:7: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:601:32: note: 'tmp' declared here 601 | struct vt_mode tmp; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:703:7: >> include/linux/uaccess.h:112:17: warning: 'vsa' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:698:39: note: 'vsa' declared here 698 | struct vt_setactivate vsa; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:859:7: include/linux/uaccess.h:112:17: warning: 'v' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:856:35: note: 'v' declared here 856 | struct vt_consize v; | ^ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_fontx_ioctl' at drivers/tty/vt/vt_ioctl.c:246:6, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:936:9: include/linux/uaccess.h:112:17: warning: 'cfdarg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:243:32: note: 'cfdarg' declared here 243 | struct consolefontdesc cfdarg; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:965:7: include/linux/uaccess.h:112:17: warning: 'op' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:352:32: note: 'op' declared here 352 | struct console_font_op op; /* used in multiple places here */ | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_unimap_ioctl' at drivers/tty/vt/vt_ioctl.c:285:6, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:1009:9: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:283:27: note: 'tmp' declared here 283 | struct unimapdesc tmp; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_fontx_ioctl' at drivers/tty/vt/vt_ioctl.c:1090:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1202:9: include/linux/uaccess.h:112:17: warning: 'cfdarg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:1087:39: note: 'cfdarg' declared here 1087 | struct compat_consolefontdesc cfdarg; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_kdfontop_ioctl' at drivers/tty/vt/vt_ioctl.c:1137:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1206:9: include/linux/uaccess.h:112:17: warning: 'op' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:1183:32: note: 'op' declared here 1183 | struct console_font_op op; /* used in multiple places here */ | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_unimap_ioctl' at drivers/tty/vt/vt_ioctl.c:1163:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1211:9: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here vim +/kbrep +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] fix CVE-2023-52527
by Zhengchao Shao 10 Mar '24

10 Mar '24

fix CVE-2023-52527. David Howells (1): ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Tom Parkin (1): l2tp: pass correct message length to ip6_append_data net/l2tp/l2tp_ip6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
by Zhengchao Shao 10 Mar '24

10 Mar '24

From: David Howells <dhowells(a)redhat.com> stable inclusion from stable-v5.10.198 commit 96b2e1090397217839fcd6c9b6d8f5d439e705ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2G CVE: CVE-2023-52527 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9d4c75800f61e5d75c1659ba201b6c0c7ead3070 ] Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger than the amount of data in the message iterator. This is because the requested length includes the transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100, MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds the UDP packet itself. Fixes: a32e0eec7042 ("l2tp: introduce L2TPv3 IP encapsulation support for IPv6") Reported-by: syzbot+62cbf263225ae13ff153(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/0000000000001c12b30605378ce8@google.com/ Suggested-by: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> Signed-off-by: David Howells <dhowells(a)redhat.com> cc: Eric Dumazet <edumazet(a)google.com> cc: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> cc: "David S. Miller" <davem(a)davemloft.net> cc: David Ahern <dsahern(a)kernel.org> cc: Paolo Abeni <pabeni(a)redhat.com> cc: Jakub Kicinski <kuba(a)kernel.org> cc: netdev(a)vger.kernel.org cc: bpf(a)vger.kernel.org cc: syzkaller-bugs(a)googlegroups.com Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/l2tp/l2tp_ip6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c index 382124d6f764..9746c624a550 100644 --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c @@ -508,7 +508,6 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) */ if (len > INT_MAX - transhdrlen) return -EMSGSIZE; - ulen = len + transhdrlen; /* Mirror BSD error message compatibility */ if (msg->msg_flags & MSG_OOB) @@ -629,6 +628,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) back_from_confirm: lock_sock(sk); + ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; err = ip6_append_data(sk, ip_generic_getfrag, msg, ulen, transhdrlen, &ipc6, &fl6, (struct rt6_info *)dst, -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION bf1b7dd5d431b4248d92755c06e76094bbe2b7b4
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bf1b7dd5d431b4248d92755c06e76094bbe2b7b4 !5092 wifi: mac80211: fix potential key use-after-free Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- x86_64-buildonly-randconfig-005-20240309 |-- drivers-char-hw_random-zhaoxin-rng.o:warning:objtool:missing-symbol-for-section-.init.text `-- net-can-j1939-main.o:warning:objtool:missing-symbol-for-section-.init.text clang_recent_errors `-- x86_64-buildonly-randconfig-003-20240309 `-- drivers-scsi-scsi_logging.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 730m configs tested: 35 configs skipped: 150 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 gcc arm64 randconfig-003-20240309 gcc arm64 randconfig-004-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 2915e2435fc93e9142e018ee932a37d762aa5d2d
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2915e2435fc93e9142e018ee932a37d762aa5d2d !5063 dccp: fix dccp_v4_err()/dccp_v6_err() again Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 725m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 clang arm64 randconfig-003-20240309 clang arm64 randconfig-004-20240309 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION d34411e46747fbc3ea6a9f6d8a299c46fd6334b0
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: d34411e46747fbc3ea6a9f6d8a299c46fd6334b0 !5059 dm: limit the number of targets and parameter size area Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- x86_64-buildonly-randconfig-004-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-005-20240309 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-002-20240309 | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-003-20240309 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-is-invalid-in-C99-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-is-invalid-in-C99-Werror-Wimplicit-function-declaration |-- arm64-randconfig-004-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-allyesconfig |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true elapsed time: 721m configs tested: 40 configs skipped: 128 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 clang arm64 randconfig-003-20240309 clang arm64 randconfig-004-20240309 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240309 gcc loongarch randconfig-002-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 38 ++++++++++++++++++++++++++++++++++++++ include/net/dst.h | 5 ++--- net/bridge/br_forward.c | 4 ++-- net/bridge/br_input.c | 4 ++-- net/core/dev.c | 14 +++----------- 5 files changed, 47 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP2 0/6] CVE-2024-26586
by Liu Jian 09 Mar '24

09 Mar '24

CVE-2024-26586 sync from PR4690 Amit Cohen (1): mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Christophe JAILLET (1): mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable Ido Schimmel (4): mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() mlxsw: spectrum_acl_tcam: Make fini symmetric to init mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations mlxsw: spectrum_acl_tcam: Fix stack corruption .../mellanox/mlxsw/spectrum_acl_atcam.c | 8 +- .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +- .../mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++++++--------- .../ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +- .../mellanox/mlxsw/spectrum_switchdev.c | 11 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++++++++- 6 files changed, 187 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-22.03-LTS-SP2] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 92a7628560cc..a6697954fd68 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 4409f56fc37e..488893962708 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 196285b0fe46..cb50b1c91aa6 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index b137006f0fd2..d209f989bb70 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -728,7 +731,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -882,7 +886,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -981,6 +985,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1171,7 +1178,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1192,7 +1200,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1373,7 +1381,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1390,7 +1399,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1512,13 +1521,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1548,7 +1559,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1566,7 +1578,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 196285b0fe46..cb50b1c91aa6 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 503a0056b60f..e1e21bbb07eb 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -732,7 +735,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -886,7 +890,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -985,6 +989,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1175,7 +1182,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1196,7 +1204,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1377,7 +1385,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1394,7 +1403,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1516,13 +1525,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1552,7 +1563,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1570,7 +1582,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 92a7628560cc..a6697954fd68 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 4409f56fc37e..488893962708 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c fs/cifs/connect.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 30 ++++++++++++++++++++---------- 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 71c2dd0c7f03..f9abe37c549c 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1597,6 +1597,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 4ca6fd66df03..684dbd580a27 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1079,7 +1079,8 @@ cifs_demultiplex_thread(void *p) if (mids[i] != NULL) { mids[i]->resp_buf_size = server->pdu_size; if ((mids[i]->mid_flags & MID_WAIT_CANCELLED) && - mids[i]->mid_state == MID_RESPONSE_RECEIVED && + (mids[i]->mid_state == MID_RESPONSE_RECEIVED || + mids[i]->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid( mids[i]->resp_buf, diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index eb76f7a59e50..fa83799b3ec0 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -46,6 +46,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -561,7 +563,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -699,7 +702,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -790,6 +793,8 @@ cifs_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst) static void cifs_noop_callback(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } int @@ -912,7 +917,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, midQ[i]->mid); send_cancel(ses->server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->mid_flags |= MID_WAIT_CANCELLED; midQ[i]->callback = DeleteMidQEntry; cancelled_mid[i] = true; @@ -938,7 +944,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1118,7 +1124,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1135,7 +1142,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1254,13 +1261,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(ses->server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((ses->server->tcpStatus != CifsGood) && (ses->server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((ses->server->tcpStatus == CifsGood) || (ses->server->tcpStatus == CifsNew))) { @@ -1290,7 +1299,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1308,7 +1318,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 09 Mar '24

09 Mar '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v4.19.306 commit 71c17ee02538802ceafc830f0736aa35b564e601 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 34be60fe6892..0fffb393415b 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 09 Mar '24

09 Mar '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v4.19.306 commit 1c17ee02538802ceafc830f0736aa35b564e601 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 34be60fe6892..0fffb393415b 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
by Yongqiang Liu 09 Mar '24

09 Mar '24

From: Pin-yen Lin <treapking(a)chromium.org> stable inclusion from stable-v5.10.198 commit 10a18c8bac7f60d32b7af22da03b66f350beee38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXH CVE: CVE-2023-52525 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aef7a0300047e7b4707ea0411dc9597cba108fc8 ] Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc1042 headers. Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Pin-yen Lin <treapking(a)chromium.org> Acked-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Matthew Wang <matthewmwang(a)chromium.org> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/sta_rx.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c index 3c555946cb2c..5b16e330014a 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c @@ -98,7 +98,8 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length); rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off; - if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) { + if (sizeof(rx_pkt_hdr->eth803_hdr) + sizeof(rfc1042_header) + + rx_pkt_off > skb->len) { mwifiex_dbg(priv->adapter, ERROR, "wrong rx packet offset: len=%d, rx_pkt_off=%d\n", skb->len, rx_pkt_off); @@ -107,12 +108,13 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, return -1; } - if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, - sizeof(bridge_tunnel_header))) || - (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, - sizeof(rfc1042_header)) && - ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP && - ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) { + if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len && + ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, + sizeof(rfc1042_header)) && + ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP && + ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX))) { /* * Replace the 803 header and rfc1042 header (llc/snap) with an * EthernetII header, keep the src/dst and snap_type -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 13425/21785] drivers/net/ethernet/huawei/hinic/hinic_main.c:249:23: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'?
by kernel test robot 09 Mar '24

09 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3d10c870b322e5d1a4f8fb923b879a0b73246157 commit: 90f09a01314abe26de1a722d1b51c351d84e1f5b [13425/21785] net/hinic: Add support for X86 Arch config: x86_64-randconfig-015-20240308 (https://download.01.org/0day-ci/archive/20240309/202403091438.ZbJbSAui-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240309/202403091438.ZbJbSAui-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403091438.ZbJbSAui-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/huawei/hinic/hinic_main.c: In function 'hinic_netdev_event': >> drivers/net/ethernet/huawei/hinic/hinic_main.c:249:23: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] 249 | ret = vlan_dev_priv(ndev)->real_dev; | ^~~~~~~~~~~~~ | netdev_priv >> drivers/net/ethernet/huawei/hinic/hinic_main.c:249:42: error: invalid type argument of '->' (have 'int') 249 | ret = vlan_dev_priv(ndev)->real_dev; | ^~ drivers/net/ethernet/huawei/hinic/hinic_main.c:251:49: error: invalid type argument of '->' (have 'int') 251 | ret = vlan_dev_priv(ret)->real_dev; | ^~ drivers/net/ethernet/huawei/hinic/hinic_main.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_main.c:3294:6: warning: no previous prototype for 'nic_event' [-Wmissing-prototypes] 3294 | void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, | ^~~~~~~~~ cc1: some warnings being treated as errors vim +249 drivers/net/ethernet/huawei/hinic/hinic_main.c edd384f682cc29 Aviad Krawczyk 2017-08-21 221 6cb2e756917d12 Xue 2019-01-31 222 #define HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT 2 6cb2e756917d12 Xue 2019-01-31 223 #define HINIC_VLAN_CLEAR_OFFLOAD (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \ 6cb2e756917d12 Xue 2019-01-31 224 NETIF_F_SCTP_CRC | NETIF_F_RXCSUM | \ 6cb2e756917d12 Xue 2019-01-31 225 NETIF_F_ALL_TSO) edd384f682cc29 Aviad Krawczyk 2017-08-21 226 6cb2e756917d12 Xue 2019-01-31 227 int hinic_netdev_event(struct notifier_block *notifier, 6cb2e756917d12 Xue 2019-01-31 228 unsigned long event, void *ptr) edd384f682cc29 Aviad Krawczyk 2017-08-21 229 { 6cb2e756917d12 Xue 2019-01-31 230 struct net_device *ndev = netdev_notifier_info_to_dev(ptr); 6cb2e756917d12 Xue 2019-01-31 231 struct net_device *real_dev, *ret; 6cb2e756917d12 Xue 2019-01-31 232 struct hinic_nic_dev *nic_dev; 6cb2e756917d12 Xue 2019-01-31 233 u16 vlan_depth; 6cb2e756917d12 Xue 2019-01-31 234 6cb2e756917d12 Xue 2019-01-31 235 if (!is_vlan_dev(ndev)) 6cb2e756917d12 Xue 2019-01-31 236 return NOTIFY_DONE; 6cb2e756917d12 Xue 2019-01-31 237 6cb2e756917d12 Xue 2019-01-31 238 dev_hold(ndev); 6cb2e756917d12 Xue 2019-01-31 239 6cb2e756917d12 Xue 2019-01-31 240 switch (event) { 6cb2e756917d12 Xue 2019-01-31 241 case NETDEV_REGISTER: 6cb2e756917d12 Xue 2019-01-31 242 real_dev = vlan_dev_real_dev(ndev); 6cb2e756917d12 Xue 2019-01-31 243 nic_dev = hinic_get_uld_dev_by_ifname(real_dev->name, 6cb2e756917d12 Xue 2019-01-31 244 SERVICE_T_NIC); 6cb2e756917d12 Xue 2019-01-31 245 if (!nic_dev) 6cb2e756917d12 Xue 2019-01-31 246 goto out; 6cb2e756917d12 Xue 2019-01-31 247 6cb2e756917d12 Xue 2019-01-31 248 vlan_depth = 1; 6cb2e756917d12 Xue 2019-01-31 @249 ret = vlan_dev_priv(ndev)->real_dev; 6cb2e756917d12 Xue 2019-01-31 250 while (is_vlan_dev(ret)) { 6cb2e756917d12 Xue 2019-01-31 251 ret = vlan_dev_priv(ret)->real_dev; 6cb2e756917d12 Xue 2019-01-31 252 vlan_depth++; 6cb2e756917d12 Xue 2019-01-31 253 } 6cb2e756917d12 Xue 2019-01-31 254 6cb2e756917d12 Xue 2019-01-31 255 if (vlan_depth == HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 6cb2e756917d12 Xue 2019-01-31 256 ndev->vlan_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 257 } else if (vlan_depth > HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 6cb2e756917d12 Xue 2019-01-31 258 #ifdef HAVE_NDO_SET_FEATURES 6cb2e756917d12 Xue 2019-01-31 259 #ifdef HAVE_RHEL6_NET_DEVICE_OPS_EXT 6cb2e756917d12 Xue 2019-01-31 260 set_netdev_hw_features(ndev, 6cb2e756917d12 Xue 2019-01-31 261 get_netdev_hw_features(ndev) & 6cb2e756917d12 Xue 2019-01-31 262 (~HINIC_VLAN_CLEAR_OFFLOAD)); 6cb2e756917d12 Xue 2019-01-31 263 #else 6cb2e756917d12 Xue 2019-01-31 264 ndev->hw_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 265 #endif 6cb2e756917d12 Xue 2019-01-31 266 #endif 6cb2e756917d12 Xue 2019-01-31 267 ndev->features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 268 } edd384f682cc29 Aviad Krawczyk 2017-08-21 269 6cb2e756917d12 Xue 2019-01-31 270 break; edd384f682cc29 Aviad Krawczyk 2017-08-21 271 6cb2e756917d12 Xue 2019-01-31 272 default: 6cb2e756917d12 Xue 2019-01-31 273 break; 6cb2e756917d12 Xue 2019-01-31 274 }; edd384f682cc29 Aviad Krawczyk 2017-08-21 275 6cb2e756917d12 Xue 2019-01-31 276 out: 6cb2e756917d12 Xue 2019-01-31 277 dev_put(ndev); edd384f682cc29 Aviad Krawczyk 2017-08-21 278 6cb2e756917d12 Xue 2019-01-31 279 return NOTIFY_DONE; edd384f682cc29 Aviad Krawczyk 2017-08-21 280 } 6cb2e756917d12 Xue 2019-01-31 281 #endif edd384f682cc29 Aviad Krawczyk 2017-08-21 282 :::::: The code at line 249 was first introduced by commit :::::: 6cb2e756917d122560e0c52f350682760d004eec net: hinic: Add NIC Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
by Li Huafei 09 Mar '24

09 Mar '24

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v4.19.297 commit 44481b244fcaa2b895a53081d6204c574720c38c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P85 CVE: CVE-2023-52478 --------------------------- commit dac501397b9d81e4782232c39f94f4307b137452 upstream. hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() and if a "device-connected" packet is received by the hw when the thread running hidpp_connect_event() from probe() is waiting on the hw, then a second thread running hidpp_connect_event() will be started from the workqueue. This opens the following races (note the below code is simplified): 1. Retrieving + printing the protocol (harmless race): if (!hidpp->protocol_major) { hidpp_root_get_protocol_version() hidpp->protocol_major = response.rap.params[0]; } We can actually see this race hit in the dmesg in the abrt output attached to rhbz#2227968: [ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. [ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. Testing with extra logging added has shown that after this the 2 threads take turn grabbing the hw access mutex (send_mutex) so they ping-pong through all the other TOCTOU cases managing to hit all of them: 2. Updating the name to the HIDPP name (harmless race): if (hidpp->name == hdev->name) { ... hidpp->name = new_name; } 3. Initializing the power_supply class for the battery (problematic!): hidpp_initialize_battery() { if (hidpp->battery.ps) return 0; probe_battery(); /* Blocks, threads take turns executing this */ hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); } 4. Creating delayed input_device (potentially problematic): if (hidpp->delayed_input) return; hidpp->delayed_input = hidpp_allocate_input(hdev); The really big problem here is 3. Hitting the race leads to the following sequence: hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); ... hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); So now we have registered 2 power supplies for the same battery, which looks a bit weird from userspace's pov but this is not even the really big problem. Notice how: 1. This is all devm-maganaged 2. The hidpp->battery.desc struct is shared between the 2 power supplies 3. hidpp->battery.desc.properties points to the result from the second devm_kmemdup() This causes a use after free scenario on USB disconnect of the receiver: 1. The last registered power supply class device gets unregistered 2. The memory from the last devm_kmemdup() call gets freed, hidpp->battery.desc.properties now points to freed memory 3. The first registered power supply class device gets unregistered, this involves sending a remove uevent to userspace which invokes power_supply_uevent() to fill the uevent data 4. power_supply_uevent() uses hidpp->battery.desc.properties which now points to freed memory leading to backtraces like this one: Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08 ... Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0 ... Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0x10d/0x1d0 Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0 Sep 22 20:01:35 eric kernel: kobject_uevent_env+0x291/0x680 Sep 22 20:01:35 eric kernel: power_supply_unregister+0x8e/0xa0 Sep 22 20:01:35 eric kernel: release_nodes+0x3d/0xb0 Sep 22 20:01:35 eric kernel: devres_release_group+0xfc/0x130 Sep 22 20:01:35 eric kernel: hid_device_remove+0x56/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: logi_dj_remove+0x9a/0x100 [hid_logitech_dj 5c91534a0ead2b65e04dd799a0437e3b99b21bc4] Sep 22 20:01:35 eric kernel: hid_device_remove+0x44/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: usbhid_disconnect+0x47/0x60 [usbhid 727dcc1c0b94e6b4418727a468398ac3bca492f3] Sep 22 20:01:35 eric kernel: usb_unbind_interface+0x90/0x270 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? kobject_put+0xa0/0x1d0 Sep 22 20:01:35 eric kernel: usb_disable_device+0xcd/0x1e0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xde/0x2c0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xc3/0x2c0 Sep 22 20:01:35 eric kernel: hub_event+0xe80/0x1c10 There have been quite a few bug reports (see Link tags) about this crash. Fix all the TOCTOU issues, including the really bad power-supply related system crash on USB disconnect, by making probe() use the workqueue for running hidpp_connect_event() too, so that it can never run more then once. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227221 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2242189 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412#c58 Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20231005182638.3776-1-hdegoede@redhat.com Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/hid/hid-logitech-hidpp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index 504e8917b06f..eda8833b8c7f 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -3080,7 +3080,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) /* Allow incoming packets */ hid_device_io_start(hdev); - hidpp_connect_event(hidpp); + schedule_work(&hidpp->work); + flush_work(&hidpp->work); return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] wifi: mac80211: fix potential key use-after-free
by Dong Chenchen 09 Mar '24

09 Mar '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v5.12-rc6 commit 31db78a4923ef5e2008f2eed321811ca79e7f71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASP CVE: CVE-2023-52530 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add(). Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall without changing anything") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/cfg.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/mac80211/cfg.c | 3 +++ net/mac80211/key.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index c6a7f1c99abc..70126518ad16 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -509,6 +509,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, sta->cipher_scheme = cs; err = ieee80211_key_link(key, sdata, sta); + /* KRACK protection, shouldn't happen but just silently accept key */ + if (err == -EALREADY) + err = 0; out_unlock: mutex_unlock(&local->sta_mtx); diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 6a72c33679ba..6b089594a9f3 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -843,7 +843,7 @@ int ieee80211_key_link(struct ieee80211_key *key, */ if (ieee80211_key_identical(sdata, old_key, key)) { ieee80211_key_free_unused(key); - ret = 0; + ret = -EALREADY; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: fix potential key use-after-free
by Dong Chenchen 09 Mar '24

09 Mar '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v5.12-rc6 commit 31db78a4923ef5e2008f2eed321811ca79e7f71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASP CVE: CVE-2023-52530 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add(). Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall without changing anything") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/cfg.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/mac80211/cfg.c | 3 +++ net/mac80211/key.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index e46944500cfa..2201923238ed 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -457,6 +457,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, sta->cipher_scheme = cs; err = ieee80211_key_link(key, sdata, sta); + /* KRACK protection, shouldn't happen but just silently accept key */ + if (err == -EALREADY) + err = 0; out_unlock: mutex_unlock(&local->sta_mtx); diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 6775d6cb7d3d..017a9d2b5cec 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -681,7 +681,7 @@ int ieee80211_key_link(struct ieee80211_key *key, */ if (ieee80211_key_identical(sdata, old_key, key)) { ieee80211_key_free_unused(key); - ret = 0; + ret = -EALREADY; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v1 0/6] Fix CVE-2023-52514
by Wei Li 09 Mar '24

09 Mar '24

This series is meant to fix CVE-2023-52514, with 5 LTS patches which are depended on but not backported before. Sean Christopherson (6): x86/reboot: Force all cpus to exit VMX root if VMX is supported x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/reboot: VMCLEAR active VMCSes before emergency reboot arch/x86/include/asm/kexec.h | 2 - arch/x86/include/asm/reboot.h | 4 ++ arch/x86/include/asm/virtext.h | 16 ++++- arch/x86/kernel/crash.c | 47 +------------ arch/x86/kernel/reboot.c | 121 ++++++++++++++++++++++++--------- arch/x86/kernel/smp.c | 6 +- arch/x86/kvm/vmx.c | 12 +--- 7 files changed, 112 insertions(+), 96 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS] drm: bridge/panel: Cleanup connector on bridge detach
by Guo Mengqi 09 Mar '24

09 Mar '24

From: Paul Cercueil <paul(a)crapouillou.net> stable inclusion from stable-v5.10.37 commit ce450934a00cf896e648fde08d0bd1426653d7a2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOL CVE: CVE-2021-47063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream. If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects in the call to drm_mode_config_cleanup(). However, since our drm_connector is devm-allocated, by the time drm_mode_config_cleanup() will be called, our connector will be long gone. Therefore, the connector must be cleaned up when the bridge is detached to avoid use-after-free conditions. v2: Cleanup connector only if it was created v3: Add FIXME v4: (Use connector->dev) directly in if() block Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.") Cc: <stable(a)vger.kernel.org> # 4.12+ Cc: Andrzej Hajda <a.hajda(a)samsung.com> Cc: Neil Armstrong <narmstrong(a)baylibre.com> Cc: Laurent Pinchart <Laurent.pinchart(a)ideasonboard.com> Cc: Jonas Karlman <jonas(a)kwiboo.se> Cc: Jernej Skrabec <jernej.skrabec(a)siol.net> Signed-off-by: Paul Cercueil <paul(a)crapouillou.net> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/gpu/drm/bridge/panel.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/bridge/panel.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c index 7cbaba213ef6..dbeaf1257668 100644 --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -92,6 +92,17 @@ static int panel_bridge_attach(struct drm_bridge *bridge) static void panel_bridge_detach(struct drm_bridge *bridge) { struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge); + struct drm_connector *connector = &panel_bridge->connector; + + /* + * Cleanup the connector if we know it was initialized. + * + * FIXME: This wouldn't be needed if the panel_bridge structure was + * allocated with drmm_kzalloc(). This might be tricky since the + * drm_device pointer can only be retrieved when the bridge is attached. + */ + if (connector->dev) + drm_connector_cleanup(connector); drm_panel_detach(panel_bridge->panel); } -- 2.17.1

2 1

[PATCH OLK-5.10 0/3] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS] uio_hv_generic: Fix a memory leak in error handling paths
by Guo Mengqi 09 Mar '24

09 Mar '24

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v5.10.40 commit d84b5e912212b05f6b5bde9f682046accfbe0354 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GH CVE: CVE-2021-47071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3ee098f96b8b6c1a98f7f97915f8873164e6af9d upstream. If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be updated and 'hv_uio_cleanup()' in the error handling path will not be able to free the corresponding buffer. In such a case, we need to free the buffer explicitly. Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Link: https://lore.kernel.org/r/4fdaff557deef6f0475d02ba7922ddbaa1ab08a6.16205440… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio_hv_generic.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c index 170fa1f8f00e..b58e7c582d3f 100644 --- a/drivers/uio/uio_hv_generic.c +++ b/drivers/uio/uio_hv_generic.c @@ -250,8 +250,10 @@ hv_uio_probe(struct hv_device *dev, ret = vmbus_establish_gpadl(dev->channel, pdata->recv_buf, RECV_BUFFER_SIZE, &pdata->recv_gpadl); - if (ret) + if (ret) { + vfree(pdata->recv_buf); goto fail_close; + } /* put Global Physical Address Label in name */ snprintf(pdata->recv_name, sizeof(pdata->recv_name), @@ -271,8 +273,10 @@ hv_uio_probe(struct hv_device *dev, ret = vmbus_establish_gpadl(dev->channel, pdata->send_buf, SEND_BUFFER_SIZE, &pdata->send_gpadl); - if (ret) + if (ret) { + vfree(pdata->send_buf); goto fail_close; + } snprintf(pdata->send_name, sizeof(pdata->send_name), "send:%u", pdata->send_gpadl); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/3] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

Fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] RDMA/rxe: Return CQE error if invalid lkey was supplied
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v5.13-rc3 commit dc07628bd2bbc1da768e265192c28ebd301f509d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956FT CVE: CVE-2021-47076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. [leonro@vm ~]$ mkt test test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0xb11/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_responder+0x5532/0x7620 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0x9c8/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_requester+0x1efd/0x58c0 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_post_send+0x998/0x1860 [rdma_rxe] ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs] ib_uverbs_write+0x847/0xc80 [ib_uverbs] vfs_write+0x1c5/0x840 ksys_write+0x176/0x1d0 do_syscall_64+0x3f/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/11e7b553f3a6f5371c6bb3f57c494bb52b88af99.16207117… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Acked-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/sw/rxe/rxe_comp.c --- drivers/infiniband/sw/rxe/rxe_comp.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c index 0a1e6393250b..aa73a54ea070 100644 --- a/drivers/infiniband/sw/rxe/rxe_comp.c +++ b/drivers/infiniband/sw/rxe/rxe_comp.c @@ -346,13 +346,15 @@ static inline enum comp_state do_read(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, payload_addr(pkt), payload_size(pkt), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; + } if (wqe->dma.resid == 0 && (pkt->mask & RXE_END_MASK)) return COMPST_COMP_ACK; - else - return COMPST_UPDATE_COMP; + + return COMPST_UPDATE_COMP; } static inline enum comp_state do_atomic(struct rxe_qp *qp, @@ -366,10 +368,12 @@ static inline enum comp_state do_atomic(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, &atomic_orig, sizeof(u64), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; - else - return COMPST_COMP_ACK; + } + + return COMPST_COMP_ACK; } static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/rxe: Return CQE error if invalid lkey was supplied
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v5.13-rc3 commit dc07628bd2bbc1da768e265192c28ebd301f509d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956FT CVE: CVE-2021-47076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. [leonro@vm ~]$ mkt test test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0xb11/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_responder+0x5532/0x7620 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0x9c8/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_requester+0x1efd/0x58c0 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_post_send+0x998/0x1860 [rdma_rxe] ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs] ib_uverbs_write+0x847/0xc80 [ib_uverbs] vfs_write+0x1c5/0x840 ksys_write+0x176/0x1d0 do_syscall_64+0x3f/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/11e7b553f3a6f5371c6bb3f57c494bb52b88af99.16207117… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Acked-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/sw/rxe/rxe_comp.c --- drivers/infiniband/sw/rxe/rxe_comp.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c index ea089cb091ad..5c2bc22bc9d6 100644 --- a/drivers/infiniband/sw/rxe/rxe_comp.c +++ b/drivers/infiniband/sw/rxe/rxe_comp.c @@ -373,13 +373,15 @@ static inline enum comp_state do_read(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, payload_addr(pkt), payload_size(pkt), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; + } if (wqe->dma.resid == 0 && (pkt->mask & RXE_END_MASK)) return COMPST_COMP_ACK; - else - return COMPST_UPDATE_COMP; + + return COMPST_UPDATE_COMP; } static inline enum comp_state do_atomic(struct rxe_qp *qp, @@ -393,10 +395,12 @@ static inline enum comp_state do_atomic(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, &atomic_orig, sizeof(u64), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; - else - return COMPST_COMP_ACK; + } + + return COMPST_COMP_ACK; } static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2021-47074
by Li Nan 09 Mar '24

09 Mar '24

v3: change bugzilla url. v2: add CVE tag to first patch. Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] x86/reboot: VMCLEAR active VMCSes before emergency reboot
by Wei Li 09 Mar '24

09 Mar '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.6-rc1 commit b23c83ad2c638420ec0608a9de354507c41bec29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2J CVE: CVE-2023-52514 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- VMCLEAR active VMCSes before any emergency reboot, not just if the kernel may kexec into a new kernel after a crash. Per Intel's SDM, the VMX architecture doesn't require the CPU to flush the VMCS cache on INIT. If an emergency reboot doesn't RESET CPUs, cached VMCSes could theoretically be kept and only be written back to memory after the new kernel is booted, i.e. could effectively corrupt memory after reboot. Opportunistically remove the setting of the global pointer to NULL to make checkpatch happy. Cc: Andrew Cooper <Andrew.Cooper3(a)citrix.com> Link: https://lore.kernel.org/r/20230721201859.2307736-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- arch/x86/include/asm/kexec.h | 2 -- arch/x86/include/asm/reboot.h | 2 ++ arch/x86/kernel/crash.c | 31 ------------------------------- arch/x86/kernel/reboot.c | 22 ++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.c | 9 ++------- 5 files changed, 26 insertions(+), 40 deletions(-) diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h index 3533ede83b42..5f5b83bdaa3e 100644 --- a/arch/x86/include/asm/kexec.h +++ b/arch/x86/include/asm/kexec.h @@ -209,8 +209,6 @@ extern void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages); #endif -typedef void crash_vmclear_fn(void); -extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; extern void kdump_nmi_shootdown_cpus(void); #ifdef CONFIG_KEXEC_CORE diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h index bc5b4d788c08..2551baec927d 100644 --- a/arch/x86/include/asm/reboot.h +++ b/arch/x86/include/asm/reboot.h @@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type); #define MRR_BIOS 0 #define MRR_APM 1 +typedef void crash_vmclear_fn(void); +extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; void cpu_emergency_disable_virtualization(void); typedef void (*nmi_shootdown_cb)(int, struct pt_regs*); diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c index bd4b566ec917..1247cdafe353 100644 --- a/arch/x86/kernel/crash.c +++ b/arch/x86/kernel/crash.c @@ -48,27 +48,6 @@ struct crash_memmap_data { unsigned int type; }; -/* - * This is used to VMCLEAR all VMCSs loaded on the - * processor. And when loading kvm_intel module, the - * callback function pointer will be assigned. - * - * protected by rcu. - */ -crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss = NULL; -EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss); - -static inline void cpu_crash_vmclear_loaded_vmcss(void) -{ - crash_vmclear_fn *do_vmclear_operation = NULL; - - rcu_read_lock(); - do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss); - if (do_vmclear_operation) - do_vmclear_operation(); - rcu_read_unlock(); -} - /* * When the crashkernel option is specified, only use the low * 1M for the real mode trampoline. @@ -88,11 +67,6 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs) { crash_save_cpu(regs, cpu); - /* - * VMCLEAR VMCSs loaded on all cpus if needed. - */ - cpu_crash_vmclear_loaded_vmcss(); - /* * Disable Intel PT to stop its logging */ @@ -146,11 +120,6 @@ void native_machine_crash_shutdown(struct pt_regs *regs) crash_smp_send_stop(); - /* - * VMCLEAR VMCSs loaded on this cpu if needed. - */ - cpu_crash_vmclear_loaded_vmcss(); - cpu_emergency_disable_virtualization(); /* diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c index 52c77932c4d2..970296f4403b 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -787,6 +787,26 @@ void machine_crash_shutdown(struct pt_regs *regs) } #endif +/* + * This is used to VMCLEAR all VMCSs loaded on the + * processor. And when loading kvm_intel module, the + * callback function pointer will be assigned. + * + * protected by rcu. + */ +crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; +EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss); + +static inline void cpu_crash_vmclear_loaded_vmcss(void) +{ + crash_vmclear_fn *do_vmclear_operation = NULL; + + rcu_read_lock(); + do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss); + if (do_vmclear_operation) + do_vmclear_operation(); + rcu_read_unlock(); +} /* This is the CPU performing the emergency shutdown work. */ int crashing_cpu = -1; @@ -798,6 +818,8 @@ int crashing_cpu = -1; */ void cpu_emergency_disable_virtualization(void) { + cpu_crash_vmclear_loaded_vmcss(); + cpu_emergency_vmxoff(); cpu_emergency_svm_disable(); } diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 74a717ca46e7..ff783fed0fd0 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -40,7 +40,7 @@ #include <asm/idtentry.h> #include <asm/io.h> #include <asm/irq_remapping.h> -#include <asm/kexec.h> +#include <asm/reboot.h> #include <asm/perf_event.h> #include <asm/mce.h> #include <asm/mmu_context.h> @@ -780,7 +780,6 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx, return ret; } -#ifdef CONFIG_KEXEC_CORE static void crash_vmclear_local_loaded_vmcss(void) { int cpu = raw_smp_processor_id(); @@ -790,7 +789,6 @@ static void crash_vmclear_local_loaded_vmcss(void) loaded_vmcss_on_cpu_link) vmcs_clear(v->vmcs); } -#endif /* CONFIG_KEXEC_CORE */ static void __loaded_vmcs_clear(void *arg) { @@ -8514,10 +8512,8 @@ static void vmx_cleanup_l1d_flush(void) static void vmx_exit(void) { -#ifdef CONFIG_KEXEC_CORE RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL); synchronize_rcu(); -#endif kvm_exit(); @@ -8612,10 +8608,9 @@ static int __init vmx_init(void) pi_init_cpu(cpu); } -#ifdef CONFIG_KEXEC_CORE rcu_assign_pointer(crash_vmclear_loaded_vmcss, crash_vmclear_local_loaded_vmcss); -#endif + vmx_check_vmcs12_offsets(); /* -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

Fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/rxe: Clear all QP fields if creation failed
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v4.19.192 commit f3783c415bf6d2ead3d7aa2c38802bbe10723646 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GP CVE: CVE-2021-47078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 67f29896fdc83298eed5a6576ff8f9873f709228 ] rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled with garbage and caused tot the following error. refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55 RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800 R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000 FS: 00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] kref_put include/linux/kref.h:64 [inline] rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805 execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327 rxe_elem_release+0x9f/0x180 drivers/infiniband/sw/rxe/rxe_pool.c:391 kref_put include/linux/kref.h:65 [inline] rxe_create_qp+0x2cd/0x310 drivers/infiniband/sw/rxe/rxe_verbs.c:425 _ib_create_qp drivers/infiniband/core/core_priv.h:331 [inline] ib_create_named_qp+0x2ad/0x1370 drivers/infiniband/core/verbs.c:1231 ib_create_qp include/rdma/ib_verbs.h:3644 [inline] create_mad_qp+0x177/0x2d0 drivers/infiniband/core/mad.c:2920 ib_mad_port_open drivers/infiniband/core/mad.c:3001 [inline] ib_mad_init_device+0xd6f/0x1400 drivers/infiniband/core/mad.c:3092 add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:717 enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1331 ib_register_device drivers/infiniband/core/device.c:1413 [inline] ib_register_device+0x7c7/0xa50 drivers/infiniband/core/device.c:1365 rxe_register_device+0x3d5/0x4a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1147 rxe_add+0x12fe/0x16d0 drivers/infiniband/sw/rxe/rxe.c:247 rxe_net_add+0x8c/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:503 rxe_newlink drivers/infiniband/sw/rxe/rxe.c:269 [inline] rxe_newlink+0xb7/0xe0 drivers/infiniband/sw/rxe/rxe.c:250 nldev_newlink+0x30e/0x550 drivers/infiniband/core/nldev.c:1555 rdma_nl_rcv_msg+0x36d/0x690 drivers/infiniband/core/netlink.c:195 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x2ee/0x430 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/7bf8d548764d406dbbbaf4b574960ebfd5af8387.16207179… Reported-by: syzbot+36a7f280de4e11c6f04e(a)syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Reviewed-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c index c58452daffc7..4c0caca6da50 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c +++ b/drivers/infiniband/sw/rxe/rxe_qp.c @@ -249,6 +249,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, if (err) { kvfree(qp->sq.queue->buf); kfree(qp->sq.queue); + qp->sq.queue = NULL; return err; } @@ -302,6 +303,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, if (err) { kvfree(qp->rq.queue->buf); kfree(qp->rq.queue); + qp->rq.queue = NULL; return err; } } @@ -362,6 +364,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, err2: rxe_queue_cleanup(qp->sq.queue); err1: + qp->pd = NULL; + qp->rcq = NULL; + qp->scq = NULL; + qp->srq = NULL; + if (srq) rxe_drop_ref(srq); rxe_drop_ref(scq); -- 2.34.1

2 1

[PATCH OLK-5.10] net: rds: Fix possible NULL-pointer dereference
by Zhengchao Shao 09 Mar '24

09 Mar '24

From: Artem Chernyshev <artem.chernyshev(a)red-soft.ru> stable inclusion from stable-v5.10.198 commit f515112e833791001aaa8ab886af3ca78503617f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATK CVE: CVE-2023-52573 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f1d95df0f31048f1c59092648997686e3f7d9478 ] In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: fd261ce6a30e ("rds: rdma: update rdma transport for tos") Signed-off-by: Artem Chernyshev <artem.chernyshev(a)red-soft.ru> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/rds/rdma_transport.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c index 5f741e51b4ba..bb38124a5d3d 100644 --- a/net/rds/rdma_transport.c +++ b/net/rds/rdma_transport.c @@ -86,10 +86,12 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id, break; case RDMA_CM_EVENT_ADDR_RESOLVED: - rdma_set_service_type(cm_id, conn->c_tos); - /* XXX do we need to clean up if this fails? */ - ret = rdma_resolve_route(cm_id, + if (conn) { + rdma_set_service_type(cm_id, conn->c_tos); + /* XXX do we need to clean up if this fails? */ + ret = rdma_resolve_route(cm_id, RDS_RDMA_RESOLVE_TIMEOUT_MS); + } break; case RDMA_CM_EVENT_ROUTE_RESOLVED: -- 2.34.1

2 1

[PATCH OLK-5.10] dccp: fix dccp_v4_err()/dccp_v6_err() again
by Ziyang Xuan 09 Mar '24

09 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.198 commit 60d73c62e3e4464f375758b6f2459c13d46465b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT6 CVE: CVE-2023-52577 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6af289746a636f71f4c0535a9801774118486c7a ] dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions). syzbot reported: BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Fixes: 977ad86c2a1b ("dccp: Fix out of bounds access in DCCP error handler") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Jann Horn <jannh(a)google.com> Reviewed-by: Jann Horn <jannh(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/dccp/ipv4.c | 9 ++------- net/dccp/ipv6.c | 9 ++------- 2 files changed, 4 insertions(+), 14 deletions(-) diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c index 398dc3e47d0c8..f2a0a4e6dd748 100644 --- a/net/dccp/ipv4.c +++ b/net/dccp/ipv4.c @@ -243,13 +243,8 @@ static int dccp_v4_err(struct sk_buff *skb, u32 info) int err; struct net *net = dev_net(skb->dev); - /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, - * which is in byte 7 of the dccp header. - * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. - * - * Later on, we want to access the sequence number fields, which are - * beyond 8 bytes, so we have to pskb_may_pull() ourselves. - */ + if (!pskb_may_pull(skb, offset + sizeof(*dh))) + return -EINVAL; dh = (struct dccp_hdr *)(skb->data + offset); if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) return -EINVAL; diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index bfe11e96af7c9..6d6bbd43a1419 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -76,13 +76,8 @@ static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, __u64 seq; struct net *net = dev_net(skb->dev); - /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, - * which is in byte 7 of the dccp header. - * Our caller (icmpv6_notify()) already pulled 8 bytes for us. - * - * Later on, we want to access the sequence number fields, which are - * beyond 8 bytes, so we have to pskb_may_pull() ourselves. - */ + if (!pskb_may_pull(skb, offset + sizeof(*dh))) + return -EINVAL; dh = (struct dccp_hdr *)(skb->data + offset); if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10] team: fix null-ptr-deref when team device type is changed
by Ziyang Xuan 09 Mar '24

09 Mar '24

stable inclusion from stable-v5.10.198 commit b44dd92e2afd89eb6e9d27616858e72a67bdc1a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATZ CVE: CVE-2023-52574 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 492032760127251e5540a5716a70996bacf2a3fd ] Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q] ... Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x150 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? vlan_dev_hard_header+0x35/0x140 [8021q] ? vlan_dev_hard_header+0x8e/0x140 [8021q] neigh_connected_output+0xb2/0x100 ip6_finish_output2+0x1cb/0x520 ? nf_hook_slow+0x43/0xc0 ? ip6_mtu+0x46/0x80 ip6_finish_output+0x2a/0xb0 mld_sendpack+0x18f/0x250 mld_ifc_work+0x39/0x160 process_one_work+0x1e6/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 [1] $ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}' $ ip link add name t-dummy type dummy $ ip link add link t-dummy name t-dummy.100 type vlan id 100 $ ip link add name t-nlmon type nlmon $ ip link set t-nlmon master team0 $ ip link set t-nlmon nomaster $ ip link set t-dummy up $ ip link set team0 up $ ip link set t-dummy.100 down $ ip link set t-dummy.100 master team0 When enslave a vlan device to team device and team device type is changed from non-ether to ether, header_ops of team device is changed to vlan_header_ops. That is incorrect and will trigger null-ptr-deref for vlan->real_dev in vlan_dev_hard_header() because team device is not a vlan device. Cache eth_header_ops in team_setup(), then assign cached header_ops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug. Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Suggested-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20230918123011.1884401-1-william.xuanziyang@huawe… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/team/team.c | 10 +++++++++- include/linux/if_team.h | 2 ++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 721b536ce8861..97a77dabed64c 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2122,7 +2122,12 @@ static const struct ethtool_ops team_ethtool_ops = { static void team_setup_by_port(struct net_device *dev, struct net_device *port_dev) { - dev->header_ops = port_dev->header_ops; + struct team *team = netdev_priv(dev); + + if (port_dev->type == ARPHRD_ETHER) + dev->header_ops = team->header_ops_cache; + else + dev->header_ops = port_dev->header_ops; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; dev->needed_headroom = port_dev->needed_headroom; @@ -2169,8 +2174,11 @@ static int team_dev_type_check_change(struct net_device *dev, static void team_setup(struct net_device *dev) { + struct team *team = netdev_priv(dev); + ether_setup(dev); dev->max_mtu = ETH_MAX_MTU; + team->header_ops_cache = dev->header_ops; dev->netdev_ops = &team_netdev_ops; dev->ethtool_ops = &team_ethtool_ops; diff --git a/include/linux/if_team.h b/include/linux/if_team.h index 5dd1657947b75..762c77d13e7dd 100644 --- a/include/linux/if_team.h +++ b/include/linux/if_team.h @@ -189,6 +189,8 @@ struct team { struct net_device *dev; /* associated netdevice */ struct team_pcpu_stats __percpu *pcpu_stats; + const struct header_ops *header_ops_cache; + struct mutex lock; /* used for overall locking, e.g. port lists write */ /* -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS eac3c6a044aaf481751d9f7fb4b6096ae431e167
by kernel test robot 09 Mar '24

09 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: eac3c6a044aaf481751d9f7fb4b6096ae431e167 !5046 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. Warning reports: https://lore.kernel.org/oe-kbuild-all/202403090244.2pF6BywY-lkp@intel.com Unverified Warning (likely false positive, please contact us if interested): drivers/tty/n_gsm.c:2067:2-8: preceding lock on line 2044 Warning ids grouped by kconfigs: clang_recent_errors |-- x86_64-randconfig-103-20240308 | `-- drivers-tty-n_gsm.c:preceding-lock-on-line `-- x86_64-randconfig-r131-20240304 |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-flags-got-int-flags `-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-initializer-(different-base-types)-expected-int-flags-got-restricted-gfp_t elapsed time: 881m configs tested: 11 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 gcc arm64 randconfig-003-20240309 gcc arm64 randconfig-004-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15642/21783] kernel/sched/topology.c:1624:32: sparse: sparse: incorrect type in initializer (different base types)
by kernel test robot 09 Mar '24

09 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: eac3c6a044aaf481751d9f7fb4b6096ae431e167 commit: b3cf6ed8fbc01dda9fe93f5d4c1877a68d344678 [15642/21783] sched/topology: Provide cfs_overload_cpus bitmap config: x86_64-randconfig-r131-20240304 (https://download.01.org/0day-ci/archive/20240309/202403090244.2pF6BywY-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240309/202403090244.2pF6BywY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403090244.2pF6BywY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/topology.c:11:15: sparse: sparse: symbol 'sched_domains_tmpmask' was not declared. Should it be static? kernel/sched/topology.c:12:15: sparse: sparse: symbol 'sched_domains_tmpmask2' was not declared. Should it be static? >> kernel/sched/topology.c:1624:32: sparse: sparse: incorrect type in initializer (different base types) @@ expected int flags @@ got restricted gfp_t @@ kernel/sched/topology.c:1624:32: sparse: expected int flags kernel/sched/topology.c:1624:32: sparse: got restricted gfp_t >> kernel/sched/topology.c:1632:61: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted gfp_t [usertype] flags @@ got int flags @@ kernel/sched/topology.c:1632:61: sparse: expected restricted gfp_t [usertype] flags kernel/sched/topology.c:1632:61: sparse: got int flags kernel/sched/topology.c:428:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:428:9: sparse: struct sparsemask [noderef] __rcu * kernel/sched/topology.c:428:9: sparse: struct sparsemask * kernel/sched/topology.c:429:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:429:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:429:9: sparse: struct sched_domain * kernel/sched/topology.c:432:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:432:9: sparse: struct sched_domain_shared [noderef] __rcu * kernel/sched/topology.c:432:9: sparse: struct sched_domain_shared * kernel/sched/topology.c:435:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:435:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:435:9: sparse: struct sched_domain * kernel/sched/topology.c:438:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:438:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:438:9: sparse: struct sched_domain * kernel/sched/topology.c:485:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:485:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:485:9: sparse: struct sched_domain * kernel/sched/topology.c: note: in included file: kernel/sched/sched.h:1206:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1206:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1206:9: sparse: struct sched_domain * kernel/sched/sched.h:1219:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1219:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1219:9: sparse: struct sched_domain * kernel/sched/sched.h:1206:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1206:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1206:9: sparse: struct sched_domain * In file included from kernel/sched/topology.c:5: In file included from kernel/sched/sched.h:39: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/topology.c:5: kernel/sched/sched.h:1169:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1169 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. vim +1624 kernel/sched/topology.c 1618 1619 static int sd_llc_alloc(struct sched_domain *sd) 1620 { 1621 struct sched_domain_shared *sds = sd->shared; 1622 struct cpumask *span = sched_domain_span(sd); 1623 int nid = cpu_to_node(cpumask_first(span)); > 1624 int flags = __GFP_ZERO | GFP_KERNEL; 1625 struct sparsemask *mask; 1626 1627 /* 1628 * Allocate the bitmap if not already allocated. This is called for 1629 * every CPU in the LLC but only allocates once per sd_llc_shared. 1630 */ 1631 if (!sds->cfs_overload_cpus) { > 1632 mask = sparsemask_alloc_node(nr_cpu_ids, 3, flags, nid); 1633 if (!mask) 1634 return 1; 1635 sds->cfs_overload_cpus = mask; 1636 } 1637 1638 return 0; 1639 } 1640 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION bba41c2321f7449ec0a8140042c2ba34a0bef88d
by kernel test robot 09 Mar '24

09 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: bba41c2321f7449ec0a8140042c2ba34a0bef88d !5021 LoongArch: fix some known issue and update defconfig Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-004-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-r111-20240227 | `-- kernel-sched-fair.c:sparse:sparse:symbol-qos_smt_expell_switch-was-not-declared.-Should-it-be-static |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-defconfig | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-002-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-003-20240308 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-005-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-006-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-001-20240308 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-001-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-003-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-001-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-004-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-randconfig-002-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 723m configs tested: 24 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240308 clang arm64 randconfig-002-20240308 clang arm64 randconfig-003-20240308 clang arm64 randconfig-004-20240308 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240308 gcc loongarch randconfig-002-20240308 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240308 clang x86_64 buildonly-randconfig-002-20240308 gcc x86_64 buildonly-randconfig-003-20240308 gcc x86_64 buildonly-randconfig-004-20240308 clang x86_64 buildonly-randconfig-005-20240308 gcc x86_64 buildonly-randconfig-006-20240308 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240308 gcc x86_64 randconfig-002-20240308 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.6-rc5 commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/core/neighbour.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 778be5866d0a..3f1520755282 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -855,7 +855,9 @@ static void neigh_periodic_work(struct work_struct *work) if (refcount_read(&n->refcnt) == 1 && (state == NUD_FAILED || time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); n->dead = 1; write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH OLK-6.6] dm: limit the number of targets and parameter size area
by Li Lingfeng 08 Mar '24

08 Mar '24

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit bd504bcfec41a503b32054da5472904b404341a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YCAG CVE: CVE-2024-23851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kvmalloc function fails with a warning if the size is larger than INT_MAX. The warning was triggered by a syscall testing robot. In order to avoid the warning, this commit limits the number of targets to 1048576 and the size of the parameter area to 1073741824. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-core.h | 2 ++ drivers/md/dm-ioctl.c | 3 ++- drivers/md/dm-table.c | 9 +++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h index 095b9b49aa82..e6757a30dcca 100644 --- a/drivers/md/dm-core.h +++ b/drivers/md/dm-core.h @@ -22,6 +22,8 @@ #include "dm-ima.h" #define DM_RESERVED_MAX_IOS 1024 +#define DM_MAX_TARGETS 1048576 +#define DM_MAX_TARGET_PARAMS 1024 struct dm_io; diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 5efe0193b2e8..3bda85ad73ec 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1952,7 +1952,8 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern minimum_data_size - sizeof(param_kernel->version))) return -EFAULT; - if (param_kernel->data_size < minimum_data_size) { + if (unlikely(param_kernel->data_size < minimum_data_size) || + unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) { DMERR("Invalid data size in the ioctl structure: %u", param_kernel->data_size); return -EINVAL; diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c index 37b48f63ae6a..fd84e06670e8 100644 --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -129,7 +129,12 @@ static int alloc_targets(struct dm_table *t, unsigned int num) int dm_table_create(struct dm_table **result, blk_mode_t mode, unsigned int num_targets, struct mapped_device *md) { - struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL); + struct dm_table *t; + + if (num_targets > DM_MAX_TARGETS) + return -EOVERFLOW; + + t = kzalloc(sizeof(*t), GFP_KERNEL); if (!t) return -ENOMEM; @@ -144,7 +149,7 @@ int dm_table_create(struct dm_table **result, blk_mode_t mode, if (!num_targets) { kfree(t); - return -ENOMEM; + return -EOVERFLOW; } if (alloc_targets(t, num_targets)) { -- 2.31.1

2 1

[PATCH OLK-5.10] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.198 commit 2ea52a2fb8e87067e26bbab4efb8872639240eb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd ] While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 3b642c412cf3..15267428c4f8 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -935,7 +935,9 @@ static void neigh_periodic_work(struct work_struct *work) (state == NUD_FAILED || !time_in_range_open(jiffies, n->used, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); neigh_mark_dead(n); write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.6-rc5 commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 778be5866d0a..3f1520755282 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -855,7 +855,9 @@ static void neigh_periodic_work(struct work_struct *work) if (refcount_read(&n->refcnt) == 1 && (state == NUD_FAILED || time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); n->dead = 1; write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH OLK-6.6] erofs: fix handling kern_mount() failure
by Zizhi Wo 08 Mar '24

08 Mar '24

From: Al Viro <viro(a)zeniv.linux.org.uk> mainline inclusion from mainline-v6.8-rc6 commit 2c88c16dc20e88dd54d2f6f4d01ae1dce6cc9654 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I971F0 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if you have a variable that holds NULL or a pointer to live struct mount, do not shove ERR_PTR() into it - not if you later treat "not NULL" as "holds a pointer to object". Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/fscache.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c index 87ff35bff8d5..1052f75d1dfa 100644 --- a/fs/erofs/fscache.c +++ b/fs/erofs/fscache.c @@ -381,11 +381,12 @@ static int erofs_fscache_init_domain(struct super_block *sb) goto out; if (!erofs_pseudo_mnt) { - erofs_pseudo_mnt = kern_mount(&erofs_fs_type); - if (IS_ERR(erofs_pseudo_mnt)) { - err = PTR_ERR(erofs_pseudo_mnt); + struct vfsmount *mnt = kern_mount(&erofs_fs_type); + if (IS_ERR(mnt)) { + err = PTR_ERR(mnt); goto out; } + erofs_pseudo_mnt = mnt; } domain->volume = sbi->volume; -- 2.39.2

2 1

[PATCH OLK-5.10] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 08 Mar '24

08 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..a9e97d8d2bad 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -78,9 +78,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,8 +170,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + /* There is no msc corresponding to the CPU */ + if (!d) continue; cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 08 Mar '24

08 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..eb7110c4ec0c 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -71,6 +71,7 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, num_partid = mpam_sysprops_num_partid(); comp = NULL; + list_for_each_entry(comp_iter, &class->components, class_list) { if (cpumask_test_cpu(cpu, &comp_iter->fw_affinity)) { comp = comp_iter; @@ -78,9 +79,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,8 +171,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + /* There is no msc corresponding to the CPU */ + if (!d) continue; cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 08 Mar '24

08 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..eb7110c4ec0c 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -71,6 +71,7 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, num_partid = mpam_sysprops_num_partid(); comp = NULL; + list_for_each_entry(comp_iter, &class->components, class_list) { if (cpumask_test_cpu(cpu, &comp_iter->fw_affinity)) { comp = comp_iter; @@ -78,9 +79,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,8 +171,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + /* There is no msc corresponding to the CPU */ + if (!d) continue; cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V3 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 08 Mar '24

08 Mar '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. The commit b0b598ee08f9 (filemap: remove use of wait bookmarks) said the overly long list of waiters on a locked page was solved by commit: 9a1ea439b16b ("mm: put_and_wait_on_page_locked() while page is migrated"). But actually the problem was solved by another commit: 3510ca20ece0 ("Minor page waitqueue cleanups"), so we can remove the bookmark flag now to solve the softlockup problem. Changes in V3: - fixed incorrect mainline patch adaptation: wake_fags -> wake_flags. - Readapt __wake_up_common_lock() Changes in V2: - modified the commit message. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 3 --- kernel/sched/wait.c | 57 ++++++-------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 8 insertions(+), 73 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] dm: limit the number of targets and parameter size area
by Li Lingfeng 08 Mar '24

08 Mar '24

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit bd504bcfec41a503b32054da5472904b404341a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YCAG CVE: CVE-2024-23851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kvmalloc function fails with a warning if the size is larger than INT_MAX. The warning was triggered by a syscall testing robot. In order to avoid the warning, this commit limits the number of targets to 1048576 and the size of the parameter area to 1073741824. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Conflicts: drivers/md/dm-core.h drivers/md/dm-ioctl.c drivers/md/dm-table.c commit 91ccbbac1747 ("dm ima: measure data on table load") add "dm ima.h"; commit 8b211aaccb91 ("dm: add two stage requeue mechanism") add "struct dm_io;"; commit 249bed821b4d ("dm ioctl: Avoid double-fetch of version") delete second copy of version; commit dbdcc906d978 ("dm ioctl: log an error if the ioctl structure is corrupted") add log of error when check data_size fail; commit 05bdb9965305 ("block: replace fmode_t with a block-specific type for block open flags") change the type of mode and num_targets. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-core.h | 2 ++ drivers/md/dm-ioctl.c | 3 ++- drivers/md/dm-table.c | 9 +++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h index 595e87e03d43..ed7285836692 100644 --- a/drivers/md/dm-core.h +++ b/drivers/md/dm-core.h @@ -19,6 +19,8 @@ #include "dm.h" #define DM_RESERVED_MAX_IOS 1024 +#define DM_MAX_TARGETS 1048576 +#define DM_MAX_TARGET_PARAMS 1024 struct dm_kobject_holder { struct kobject kobj; diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index b95f8c4ed6e9..ea519c4fa7b3 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1771,7 +1771,8 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern if (copy_from_user(param_kernel, user, minimum_data_size)) return -EFAULT; - if (param_kernel->data_size < minimum_data_size) + if (unlikely(param_kernel->data_size < minimum_data_size) || + unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) return -EINVAL; secure_data = param_kernel->flags & DM_SECURE_DATA_FLAG; diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c index 78627402b5fb..eb95b5ce7b8f 100644 --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -144,7 +144,12 @@ static int alloc_targets(struct dm_table *t, unsigned int num) int dm_table_create(struct dm_table **result, fmode_t mode, unsigned num_targets, struct mapped_device *md) { - struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL); + struct dm_table *t; + + if (num_targets > DM_MAX_TARGETS) + return -EOVERFLOW; + + t = kzalloc(sizeof(*t), GFP_KERNEL); if (!t) return -ENOMEM; @@ -158,7 +163,7 @@ int dm_table_create(struct dm_table **result, fmode_t mode, if (!num_targets) { kfree(t); - return -ENOMEM; + return -EOVERFLOW; } if (alloc_targets(t, num_targets)) { -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS v2 0/2] CVE-2021-47074
by Li Nan 08 Mar '24

08 Mar '24

v2: add CVE tag to first patch. Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 00/77] vsva patches
by Kunkun Jiang 08 Mar '24

08 Mar '24

vsva patches Jason Gunthorpe (58): iommu/arm-smmu-v3: Make STE programming independent of the callers iommu/arm-smmu-v3: Consolidate the STE generation for abort/bypass iommu/arm-smmu-v3: Move the STE generation for S1 and S2 domains into functions iommu/arm-smmu-v3: Build the whole STE in arm_smmu_make_s2_domain_ste() iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev iommu/arm-smmu-v3: Compute the STE only once for each master iommu/arm-smmu-v3: Do not change the STE twice during arm_smmu_attach_dev() iommu/arm-smmu-v3: Put writing the context descriptor in the right order iommu/arm-smmu-v3: Pass smmu_domain to arm_enable/disable_ats() iommu/arm-smmu-v3: Remove arm_smmu_master->domain iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA iommu/arm-smmu-v3: Add a global static IDENTITY domain iommu/arm-smmu-v3: Add a global static BLOCKED domain iommu/arm-smmu-v3: Use the identity/blocked domain during release iommu/arm-smmu-v3: Pass arm_smmu_domain and arm_smmu_device to finalize iommu/arm-smmu-v3: Convert to domain_alloc_paging() iommu/arm-smmu-v3: Add cpu_to_le64() around STRTAB_STE_0_V iommu/arm-smmu-v3: Do not allow a SVA domain to be set on the wrong PASID iommu/arm-smmu-v3: Do not ATC invalidate the entire domain iommu/arm-smmu-v3: Add a type for the CD entry iommu/arm-smmu-v3: Add an ops indirection to the STE code iommu/arm-smmu-v3: Make CD programming use arm_smmu_write_entry() iommu/arm-smmu-v3: Consolidate clearing a CD table entry iommu/arm-smmu-v3: Move the CD generation for S1 domains into a function iommu/arm-smmu-v3: Move allocation of the cdtable into arm_smmu_get_cd_ptr() iommu/arm-smmu-v3: Allocate the CD table entry in advance iommu/arm-smmu-v3: Move the CD generation for SVA into a function iommu/arm-smmu-v3: Build the whole CD in arm_smmu_make_s1_cd() iommu/arm-smmu-v3: Start building a generic PASID layer iommu/arm-smmu-v3: Make smmu_domain->devices into an allocated list iommu/arm-smmu-v3: Make changing domains be hitless for ATS iommu/arm-smmu-v3: Add ssid to struct arm_smmu_master_domain iommu/arm-smmu-v3: Keep track of valid CD entries in the cd_table iommu/arm-smmu-v3: Thread SSID through the arm_smmu_attach_*() interface iommu/arm-smmu-v3: Make SVA allocate a normal arm_smmu_domain iommu/arm-smmu-v3: Keep track of arm_smmu_master_domain for SVA iommu: Add ops->domain_alloc_sva() iommu/arm-smmu-v3: Put the SVA mmu notifier in the smmu_domain iommu/arm-smmu-v3: Consolidate freeing the ASID/VMID iommu/arm-smmu-v3: Move the arm_smmu_asid_xa to per-smmu like vmid iommu/arm-smmu-v3: Bring back SVA BTM support iommu/arm-smmu-v3: Allow IDENTITY/BLOCKED to be set while PASID is used iommu/arm-smmu-v3: Allow a PASID to be set when RID is IDENTITY/BLOCKED iommu/arm-smmu-v3: Allow setting a S1 domain to a PASID iommu/arm-smmu-v3: Split struct arm_smmu_strtab_cfg.strtab iommu/arm-smmu-v3: Split struct arm_smmu_ctx_desc_cfg.cdtab iommu/arm-smmu-v3: Do not use devm for the cd table allocations iommu/arm-smmu-v3: Remove arm_smmu_ctx_desc & arm_smmu_s2_cfg iommu/arm-smmu-v3: Consolidate cache tag allocation iommu/arm-smmu-v3: Replace arm_smmu_tlb_inv_asid with arm_smmu_tlb_inv_all_s1 iommu/arm-smmu-v3: Create arm_smmu_tlb_inv_range_s1() iommu/arm-smmu-v3: Make arm_smmu_tlb_inv_range_s2() iommu/arm-smmu-v3: Add the limit logic to arm_smmu_tlb_inv_range_s2() vfio: Remove VFIO_TYPE1_NESTING_IOMMU iommu/arm-smmu-v3: Implement IOMMU_HWPT_ALLOC_NEST_PARENT iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED iommu/arm-smmu-v3: Add unit tests for arm_smmu_write_entry iommu/arm-smmu-v3: Use the new rb tree helpers Liu Yi L (2): vfio/pci: Emulate PASID/PRI capability for VFs vfio/pci: Expose PCIe PASID capability to userspace Lu Baolu (8): iommu: Add iopf domain attach/detach/replace interface iommu/sva: Use iopf domain attach/detach interface iommufd: Add fault and response message definitions iommufd: Add iommufd fault object iommufd: Associate fault object with iommufd_hw_pgtable iommufd: IOPF-capable hw page table attach/detach/replace iommufd/selftest: Add IOPF support for mock device iommufd/selftest: Add coverage for IOPF test Nicolin Chen (7): iommu/arm-smmu-v3: Support IOMMU_GET_HW_INFO via struct arm_smmu_hw_info iommu/arm-smmu-v3: Implement arm_smmu_get_msi_mapping_domain iommu/arm-smmu-v3: Add CMDQ_OP_TLBI_NH_VAA and CMDQ_OP_TLBI_NH_ALL iommu/arm-smmu-v3: Add a helper queue_ncmds iommu/arm-smmu-v3: Link user SID and physical SID iommu/arm-smmu-v3: Add arm_smmu_cache_invalidate_user Hack: iommu/arm-smmu-v3: Enable ATS for identity domains Robin Murphy (1): iommu/dma: Support MSIs through nested domains Shameer Kolothum (1): vfio/pci: Fix for wrong CAP IDs drivers/iommu/Kconfig | 12 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 2 + .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 658 +++-- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c | 423 +++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2305 ++++++++++++----- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 183 +- drivers/iommu/arm/arm-smmu/arm-smmu.c | 16 - drivers/iommu/dma-iommu.c | 18 +- drivers/iommu/io-pgfault.c | 215 +- drivers/iommu/iommu-sva.c | 63 +- drivers/iommu/iommu.c | 10 - drivers/iommu/iommufd/Makefile | 1 + drivers/iommu/iommufd/device.c | 16 +- drivers/iommu/iommufd/fault.c | 391 +++ drivers/iommu/iommufd/hw_pagetable.c | 36 +- drivers/iommu/iommufd/iommufd_private.h | 41 + drivers/iommu/iommufd/iommufd_test.h | 8 + drivers/iommu/iommufd/main.c | 6 + drivers/iommu/iommufd/selftest.c | 63 + drivers/iommu/iommufd/vfio_compat.c | 7 +- drivers/vfio/pci/vfio_pci_config.c | 325 ++- drivers/vfio/vfio_iommu_type1.c | 12 +- include/linux/iommu.h | 50 +- include/uapi/linux/iommufd.h | 166 ++ include/uapi/linux/vfio.h | 2 +- tools/testing/selftests/iommu/iommufd.c | 17 + .../selftests/iommu/iommufd_fail_nth.c | 2 +- tools/testing/selftests/iommu/iommufd_utils.h | 83 +- 28 files changed, 3925 insertions(+), 1206 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c create mode 100644 drivers/iommu/iommufd/fault.c -- 2.27.0

2 78

[openeuler:openEuler-1.0-LTS 15383/21781] fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1c33d0b3f9230be83d0a9b8b7b292861cfd72534 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [15383/21781] etmem: add etmem-scan feature config: x86_64-randconfig-r131-20240304 (https://download.01.org/0day-ci/archive/20240308/202403081509.2XWi5xzk-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403081509.2XWi5xzk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403081509.2XWi5xzk-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __user *buf @@ got void *buf @@ fs/proc/etmem_scan.c:244:18: sparse: expected void [noderef] __user *buf fs/proc/etmem_scan.c:244:18: sparse: got void *buf >> fs/proc/etmem_scan.c:1032:40: sparse: sparse: incorrect type in assignment (incompatible argument 2 (different address spaces)) @@ expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) @@ got long ( * )( ... ) @@ fs/proc/etmem_scan.c:1032:40: sparse: expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) fs/proc/etmem_scan.c:1032:40: sparse: got long ( * )( ... ) In file included from fs/proc/etmem_scan.c:2: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +244 fs/proc/etmem_scan.c 240 241 static void setup_page_idle_ctrl(struct page_idle_ctrl *pic, void *buf, 242 int buf_size, unsigned int flags) 243 { > 244 pic->buf = buf; 245 pic->buf_size = buf_size; 246 pic->bytes_copied = 0; 247 pic->next_hva = 0; 248 pic->gpa_to_hva = 0; 249 pic->restart_gpa = 0; 250 pic->last_va = 0; 251 pic->flags = flags; 252 } 253 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 08 Mar '24

08 Mar '24

From: tangyuchen <tangyuchen5(a)huawei.com> v2 -> v3 - fix compile error - bind to correct issue url v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP our recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 ++++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 173 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 378 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
by Zeng Heng 08 Mar '24

08 Mar '24

From: Vincent Pelletier <plr.vincent(a)gmail.com> mainline inclusion from mainline-v5.16-rc8 commit b1e0887379422975f237d43d8839b751a6bcf154 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947SJ CVE: CVE-2021-46933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported): /sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb84 r6:c3a12260 r5:bf54d014 r4:c229f000 [ 1946.646273] [<bf547d74>] (ffs_fs_kill_sb [usb_f_fs]) from [<c0326d50>] (deactivate_locked_super+0x54/0x9c) [ 1946.664893] r5:bf54d014 r4:c229f000 [ 1946.672921] [<c0326cfc>] (deactivate_locked_super) from [<c0326df8>] (deactivate_super+0x60/0x64) [ 1946.690722] r5:c2a09000 r4:c229f000 [ 1946.698706] [<c0326d98>] (deactivate_super) from [<c0349a28>] (cleanup_mnt+0xe4/0x14c) [ 1946.715553] r5:c2a09000 r4:00000000 [ 1946.723528] [<c0349944>] (cleanup_mnt) from [<c0349b08>] (__cleanup_mnt+0x1c/0x20) [ 1946.739922] r7:c0dfcb84 r6:c3a12260 r5:c3a126fc r4:00000000 [ 1946.750088] [<c0349aec>] (__cleanup_mnt) from [<c0143d10>] (task_work_run+0x84/0xb8) [ 1946.766602] [<c0143c8c>] (task_work_run) from [<c010bdc8>] (do_work_pending+0x470/0x56c) [ 1946.783540] r7:5ac3c35a r6:c0d0424c r5:c200bfb0 r4:c200a000 [ 1946.793614] [<c010b958>] (do_work_pending) from [<c01000c0>] (slow_work_pending+0xc/0x20) [ 1946.810553] Exception stack(0xc200bfb0 to 0xc200bff8) [ 1946.820129] bfa0: 00000000 00000000 000000aa b5e21430 [ 1946.837104] bfc0: bef867a0 00000001 bef86840 00000034 bef86838 bef86790 bef86794 bef867a0 [ 1946.854125] bfe0: 00000000 bef86798 b67b7a1c b6d626a4 60000010 b5a23760 [ 1946.865335] r10:00000000 r9:c200a000 r8:c0100224 r7:00000034 r6:bef86840 r5:00000001 [ 1946.881914] r4:bef867a0 [ 1946.888793] ---[ end trace 7387f2a9725b28d0 ]--- Fixes: 5e33f6fdf735 ("usb: gadget: ffs: add eventfd notification about ffs events") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Vincent Pelletier <plr.vincent(a)gmail.com> Link: https://lore.kernel.org/r/f79eeea29f3f98de6782a064ec0f7351ad2f598f.16397939… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/usb/gadget/function/f_fs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 2050993fb58b..221aee81f012 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1698,11 +1698,15 @@ static void ffs_data_clear(struct ffs_data *ffs) BUG_ON(ffs->gadget); - if (ffs->epfiles) + if (ffs->epfiles) { ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); + ffs->epfiles = NULL; + } - if (ffs->ffs_eventfd) + if (ffs->ffs_eventfd) { eventfd_ctx_put(ffs->ffs_eventfd); + ffs->ffs_eventfd = NULL; + } kfree(ffs->raw_descs_data); kfree(ffs->raw_strings); @@ -1715,7 +1719,6 @@ static void ffs_data_reset(struct ffs_data *ffs) ffs_data_clear(ffs); - ffs->epfiles = NULL; ffs->raw_descs_data = NULL; ffs->raw_descs = NULL; ffs->raw_strings = NULL; -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] bugfix for pbha
by Wupeng Ma 08 Mar '24

08 Mar '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Use corrent pte val in arch_vm_get_page_prot. Use subsequent bits to improve future compatibility for pbha. Ma Wupeng (2): arm64: mm: Use corrent pte val in arch_vm_get_page_prot arm64: mm: Use subsequent bits to improve future compatibility for pbha arch/arm64/include/asm/mman.h | 2 +- arch/arm64/include/uapi/asm/mman.h | 2 +- include/linux/mm.h | 4 +++- include/uapi/asm-generic/mman-common.h | 2 +- tools/include/uapi/asm-generic/mman-common.h | 1 + 5 files changed, 7 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 08 Mar '24

08 Mar '24

v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 ++++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 173 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 378 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 08 Mar '24

08 Mar '24

v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 +++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 174 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 1acb6ad947eee3676d09c5626001d3bc1b69b9ce
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 1acb6ad947eee3676d09c5626001d3bc1b69b9ce !4990 vt: fix memory overlapping when deleting chars in the buffer elapsed time: 746m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 70c98c7d4aac402e0ad746c4312d808d7495c50b
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 70c98c7d4aac402e0ad746c4312d808d7495c50b !5004 nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() Warning reports: https://lore.kernel.org/oe-kbuild-all/202403080622.uNLahRYD-lkp@intel.com Warning ids grouped by kconfigs: clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode `-- x86_64-randconfig-121-20240307 `-- arch-x86-kernel-cpu-common.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__percpu-got-unsigned-short elapsed time: 732m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 28904/30000] arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 70c98c7d4aac402e0ad746c4312d808d7495c50b commit: f4128ae8e6ff03b4c805707fe75d0345797f7f53 [28904/30000] sched: Add cluster scheduler level for x86 config: x86_64-randconfig-121-20240307 (https://download.01.org/0day-ci/archive/20240308/202403080622.uNLahRYD-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080622.uNLahRYD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080622.uNLahRYD-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got unsigned short * @@ arch/x86/kernel/cpu/common.c:92:16: sparse: expected void const [noderef] __percpu *__vpp_verify arch/x86/kernel/cpu/common.c:92:16: sparse: got unsigned short * arch/x86/kernel/cpu/common.c:1901:1: sparse: sparse: symbol 'fixed_percpu_data' redeclared with different type (different address spaces): arch/x86/kernel/cpu/common.c:1901:1: sparse: struct fixed_percpu_data [addressable] [noderef] [toplevel] __percpu fixed_percpu_data arch/x86/kernel/cpu/common.c: note: in included file (through arch/x86/include/asm/cpufeature.h, arch/x86/include/asm/thread_info.h, include/linux/thread_bits.h, ...): arch/x86/include/asm/processor.h:470:1: sparse: note: previously declared as: arch/x86/include/asm/processor.h:470:1: sparse: struct fixed_percpu_data extern [addressable] [toplevel] fixed_percpu_data arch/x86/kernel/cpu/common.c:144:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:145:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:146:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:147:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:148:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:149:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/include/asm/processor.h:474:31: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got char ( * )[40] @@ arch/x86/include/asm/processor.h:474:31: sparse: expected void const [noderef] __percpu *__vpp_verify arch/x86/include/asm/processor.h:474:31: sparse: got char ( * )[40] vim +92 arch/x86/kernel/cpu/common.c f8b64d08dde271 Borislav Petkov 2018-04-27 89 6f01df96c462b7 Kim Phillips 2021-08-17 90 u16 get_llc_id(unsigned int cpu) 6f01df96c462b7 Kim Phillips 2021-08-17 91 { 6f01df96c462b7 Kim Phillips 2021-08-17 @92 return per_cpu(cpu_llc_id, cpu); 6f01df96c462b7 Kim Phillips 2021-08-17 93 } 6f01df96c462b7 Kim Phillips 2021-08-17 94 EXPORT_SYMBOL_GPL(get_llc_id); 6f01df96c462b7 Kim Phillips 2021-08-17 95 :::::: The code at line 92 was first introduced by commit :::::: 6f01df96c462b77915b27d404152c47e75e879cf x86/cpu: Add get_llc_id() helper function :::::: TO: Kim Phillips <kim.phillips(a)amd.com> :::::: CC: Xie Haocheng <haocheng.xie(a)amd.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 97ba28f60ba0c12d39b4d3032121317ffebc06ba
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 97ba28f60ba0c12d39b4d3032121317ffebc06ba !5024 v2 vmemmap optimize bugfix Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403080243.ondrgrmr-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403080412.gcDr9v5Q-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: expecting prototype for rnp_set_rxfh(). Prototype was for rnp_set_rxnfc() instead drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1856: warning: expecting prototype for rnp_tet_rxfh(). Prototype was for rnp_get_rxfh() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2013: warning: expecting prototype for rnp_write_eitr(). Prototype was for rnp_write_eitr_rx() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1175: warning: expecting prototype for rnp_mbx_stat_mark(). Prototype was for rnp_link_stat_mark() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:823: warning: expecting prototype for rnp_mbx_link_event_eanble(). Prototype was for rnp_mbx_link_event_enable() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1135: warning: expecting prototype for rnp_init_hw_n10(). Prototype was for rnp_init_hw_ops_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: expecting prototype for rnp_write_uc_addr_list(). Prototype was for rnp_write_uc_addr_list_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:3270: warning: expecting prototype for rnpm_device_supports_autoneg_fc(). Prototype was for rnp_device_supports_autoneg_fc() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: expecting prototype for rnp_fc_mode_n10(). Prototype was for rnp_mac_fc_mode_n10() instead Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-r111-20240227 | `-- mm-memcontrol.c:sparse:sparse:symbol-hisi_oom_recover-was-not-declared.-Should-it-be-static `-- loongarch-allmodconfig |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 740m configs tested: 10 configs skipped: 94 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3862/3876] drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 97ba28f60ba0c12d39b4d3032121317ffebc06ba commit: 455d45ae080810ae554f5e586adb9004230f9f70 [3862/3876] drivers: initial support for rnp drivers from Mucse Technology config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240308/202403080412.gcDr9v5Q-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080412.gcDr9v5Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080412.gcDr9v5Q-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_mbx_get_temp': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1105:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1105 | int err; | ^~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: At top level: drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:5: warning: no previous prototype for 'rnp_fw_reg_read' [-Wmissing-prototypes] 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_fw_reg_read': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1145:13: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1145 | int value; | ^~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_mbx_reg_write': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:602:9: warning: 'build_writereg_req' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=] 602 | build_writereg_req(&req, NULL, fw_reg, 4, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:602:9: note: referencing argument 5 of type 'int[4]' In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960, from drivers/net/ethernet/mucse/rnp/rnp.h:20, from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:799:20: note: in a call to function 'build_writereg_req' 799 | static inline void build_writereg_req(struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~ In file included from include/linux/string.h:294, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from arch/loongarch/include/asm/processor.h:9, from arch/loongarch/include/asm/thread_info.h:15, from include/linux/thread_bits.h:32, from include/linux/thread_info.h:16, from include/asm-generic/preempt.h:5, from ./arch/loongarch/include/generated/asm/preempt.h:1, from include/linux/preempt.h:79, from include/linux/spinlock.h:56, from include/linux/wait.h:9, from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:4: In function 'fortify_memcpy_chk', inlined from 'rnp_mbx_phy_read' at drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1386:3: include/linux/fortify-string.h:592:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnp/rnp_n10.c:458: warning: Function parameter or member 'sriov_flag' not described in 'rnp_eth_update_rss_key_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:1135: warning: expecting prototype for rnp_init_hw_n10(). Prototype was for rnp_init_hw_ops_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: Function parameter or member 'hw' not described in 'rnp_write_uc_addr_list_n10' drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: Function parameter or member 'sriov_flag' not described in 'rnp_write_uc_addr_list_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: expecting prototype for rnp_write_uc_addr_list(). Prototype was for rnp_write_uc_addr_list_n10() instead >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:3270: warning: expecting prototype for rnpm_device_supports_autoneg_fc(). Prototype was for rnp_device_supports_autoneg_fc() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: Function parameter or member 'mac' not described in 'rnp_mac_fc_mode_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: expecting prototype for rnp_fc_mode_n10(). Prototype was for rnp_mac_fc_mode_n10() instead -- >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:823: warning: expecting prototype for rnp_mbx_link_event_eanble(). Prototype was for rnp_mbx_link_event_enable() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value0' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value1' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value2' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value3' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1024: warning: Function parameter or member 'info' not described in 'rnp_mbx_get_capability' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1024: warning: Excess function parameter 'rnp_info' description in 'rnp_mbx_get_capability' >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1175: warning: expecting prototype for rnp_mbx_stat_mark(). Prototype was for rnp_link_stat_mark() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1414: warning: Function parameter or member 'adv' not described in 'rnp_mbx_phy_link_set' -- drivers/net/ethernet/mucse/rnp/rnp_main.c:175:6: warning: no previous prototype for 'rnp_unmap_and_free_tx_resource' [-Wmissing-prototypes] 175 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:670:5: warning: no previous prototype for 'rnp_rx_ring_reinit' [-Wmissing-prototypes] 670 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:6: warning: no previous prototype for 'rnp_write_eitr_rx' [-Wmissing-prototypes] 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:3176:6: warning: no previous prototype for 'rnp_vlan_stags_flag' [-Wmissing-prototypes] 3176 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:3580:5: warning: no previous prototype for 'rnp_xmit_nop_frame_ring' [-Wmissing-prototypes] 3580 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:4842:6: warning: no previous prototype for 'rnp_service_timer' [-Wmissing-prototypes] 4842 | void rnp_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:4950:6: warning: no previous prototype for 'rnp_service_task' [-Wmissing-prototypes] 4950 | void rnp_service_task(struct work_struct *work) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:5972:5: warning: no previous prototype for 'rnp_delete_knode' [-Wmissing-prototypes] 5972 | int rnp_delete_knode(struct net_device *dev, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6061:5: warning: no previous prototype for 'rnp_config_knode' [-Wmissing-prototypes] 6061 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6120:5: warning: no previous prototype for 'rnp_setup_tc_cls_u32' [-Wmissing-prototypes] 6120 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6197:6: warning: no previous prototype for 'rnp_do_reset' [-Wmissing-prototypes] 6197 | void rnp_do_reset(struct net_device *netdev) | ^~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6452:6: warning: no previous prototype for 'rnp_assign_netdev_ops' [-Wmissing-prototypes] 6452 | void rnp_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6628:5: warning: no previous prototype for 'rnp_can_rpu_start' [-Wmissing-prototypes] 6628 | int rnp_can_rpu_start(struct rnp_adapter *adapter) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c: In function 'rnp_request_msix_irqs': >> drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] 2402 | sizeof(q_vector->name) - 1, "%s-%s-%d-%d", | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2401:25: note: 'snprintf' output between 10 and 37 bytes into a destination of size 24 2401 | snprintf(q_vector->name, | ^~~~~~~~~~~~~~~~~~~~~~~~ 2402 | sizeof(q_vector->name) - 1, "%s-%s-%d-%d", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2403 | netdev->name, "TxRx", i, q_vector->v_idx); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Function parameter or member 'rnp_queue' not described in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Function parameter or member 'rnp_msix_vector' not described in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Excess function parameter 'queue' description in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Excess function parameter 'msix_vector' description in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:288: warning: Function parameter or member 'napi_budget' not described in 'rnp_clean_tx_irq' drivers/net/ethernet/mucse/rnp/rnp_main.c:672: warning: Function parameter or member 'adapter' not described in 'rnp_rx_ring_reinit' drivers/net/ethernet/mucse/rnp/rnp_main.c:1130: warning: Excess function parameter 'skb' description in 'rnp_is_non_eop' >> drivers/net/ethernet/mucse/rnp/rnp_main.c:2013: warning: expecting prototype for rnp_write_eitr(). Prototype was for rnp_write_eitr_rx() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Function parameter or member 'adapter' not described in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Excess function parameter 'netdev' description in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Excess function parameter 'maxrate' description in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:3779: warning: Function parameter or member 'txqueue' not described in 'rnp_tx_timeout' drivers/net/ethernet/mucse/rnp/rnp_main.c:3888: warning: Function parameter or member 'adapter' not described in 'rnp_setup_tx_resources' drivers/net/ethernet/mucse/rnp/rnp_main.c:3981: warning: Function parameter or member 'adapter' not described in 'rnp_setup_rx_resources' drivers/net/ethernet/mucse/rnp/rnp_main.c:4643: warning: Excess function parameter 'link_speed' description in 'rnp_watchdog_update_link' drivers/net/ethernet/mucse/rnp/rnp_main.c:4843: warning: Function parameter or member 't' not described in 'rnp_service_timer' drivers/net/ethernet/mucse/rnp/rnp_main.c:4843: warning: Excess function parameter 'data' description in 'rnp_service_timer' drivers/net/ethernet/mucse/rnp/rnp_main.c:5903: warning: Function parameter or member 'dev' not described in 'rnp_setup_tc' drivers/net/ethernet/mucse/rnp/rnp_main.c:5903: warning: Excess function parameter 'netdev' description in 'rnp_setup_tc' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Function parameter or member 'adapter' not described in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Function parameter or member 'subdevice_id' not described in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Excess function parameter 'hw' description in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Excess function parameter 'subdev_id' description in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:7056: warning: Function parameter or member 'id' not described in 'rnp_probe' drivers/net/ethernet/mucse/rnp/rnp_main.c:7056: warning: Excess function parameter 'ent' description in 'rnp_probe' -- drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:179: warning: Function parameter or member 'data' not described in 'rnp_reg_test' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:466: warning: Function parameter or member 'dev' not described in 'rnp_get_ts_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:466: warning: Excess function parameter 'netdev' description in 'rnp_get_ts_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:527: warning: Function parameter or member 'dev' not described in 'rnp_get_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:527: warning: Excess function parameter 'netdev' description in 'rnp_get_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:561: warning: Function parameter or member 'dev' not described in 'rnp_set_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:561: warning: Excess function parameter 'netdev' description in 'rnp_set_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:600: warning: Function parameter or member 'dev' not described in 'rnp_get_module_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:600: warning: Excess function parameter 'netdev' description in 'rnp_get_module_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:653: warning: Function parameter or member 'dev' not described in 'rnp_get_module_eeprom' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:653: warning: Excess function parameter 'netdev' description in 'rnp_get_module_eeprom' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:700: warning: Function parameter or member 'ker' not described in 'rnp_get_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:700: warning: Function parameter or member 'extack' not described in 'rnp_get_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:725: warning: Function parameter or member 'ker' not described in 'rnp_set_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:725: warning: Function parameter or member 'extack' not described in 'rnp_set_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'coal' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'kernel_coal' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'extack' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Excess function parameter 'cmd' description in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Excess function parameter 'ec' description in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Function parameter or member 'kernel_coal' not described in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Function parameter or member 'extack' not described in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Excess function parameter 'cmd' description in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: Function parameter or member 'dev' not described in 'rnp_set_rxnfc' >> drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: expecting prototype for rnp_set_rxfh(). Prototype was for rnp_set_rxnfc() instead >> drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1856: warning: expecting prototype for rnp_tet_rxfh(). Prototype was for rnp_get_rxfh() instead vim +2402 drivers/net/ethernet/mucse/rnp/rnp_main.c 2378 2379 /** 2380 * rnp_request_msix_irqs - Initialize MSI-X interrupts 2381 * @adapter: board private structure 2382 * 2383 * rnp_request_msix_irqs allocates MSI-X vectors and requests 2384 * interrupts from the kernel. 2385 **/ 2386 static int rnp_request_msix_irqs(struct rnp_adapter *adapter) 2387 { 2388 struct net_device *netdev = adapter->netdev; 2389 int err; 2390 int i = 0; 2391 2392 DPRINTK(IFUP, INFO, "[%s] num_q_vectors:%d\n", __func__, 2393 adapter->num_q_vectors); 2394 2395 for (i = 0; i < adapter->num_q_vectors; i++) { 2396 struct rnp_q_vector *q_vector = adapter->q_vector[i]; 2397 struct msix_entry *entry = 2398 &adapter->msix_entries[i + adapter->q_vector_off]; 2399 2400 if (q_vector->tx.ring && q_vector->rx.ring) { 2401 snprintf(q_vector->name, > 2402 sizeof(q_vector->name) - 1, "%s-%s-%d-%d", 2403 netdev->name, "TxRx", i, q_vector->v_idx); 2404 } else { 2405 WARN(!(q_vector->tx.ring && q_vector->rx.ring), 2406 "%s vector%d tx rx is null, v_idx:%d\n", 2407 netdev->name, i, q_vector->v_idx); 2408 /* skip this unused q_vector */ 2409 continue; 2410 } 2411 err = request_irq(entry->vector, &rnp_msix_clean_rings, 0, 2412 q_vector->name, q_vector); 2413 if (err) { 2414 e_err(probe, 2415 "%s:request_irq failed for MSIX interrupt:%d", 2416 netdev->name, entry->vector); 2417 e_err(probe, "Error: %d\n", err); 2418 goto free_queue_irqs; 2419 } 2420 /* register for affinity change notifications */ 2421 q_vector->affinity_notify.notify = rnp_irq_affinity_notify; 2422 q_vector->affinity_notify.release = 2423 rnp_irq_affinity_release; 2424 irq_set_affinity_notifier(entry->vector, 2425 &q_vector->affinity_notify); 2426 DPRINTK(IFUP, INFO, "[%s] set %s affinity_mask\n", 2427 __func__, q_vector->name); 2428 2429 irq_set_affinity_hint(entry->vector, 2430 &q_vector->affinity_mask); 2431 } 2432 2433 return 0; 2434 2435 free_queue_irqs: 2436 while (i) { 2437 i--; 2438 irq_set_affinity_hint( 2439 adapter->msix_entries[i + adapter->q_vector_off].vector, 2440 NULL); 2441 free_irq(adapter->msix_entries[i + adapter->q_vector_off].vector, 2442 adapter->q_vector[i]); 2443 irq_set_affinity_notifier( 2444 adapter->msix_entries[i + adapter->q_vector_off].vector, 2445 NULL); 2446 irq_set_affinity_hint( 2447 adapter->msix_entries[i + adapter->q_vector_off].vector, 2448 NULL); 2449 } 2450 return err; 2451 } 2452 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3862/3876] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable'
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 97ba28f60ba0c12d39b4d3032121317ffebc06ba commit: 455d45ae080810ae554f5e586adb9004230f9f70 [3862/3876] drivers: initial support for rnp drivers from Mucse Technology config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240308/202403080243.ondrgrmr-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 503c55e17037436dcd45ac69dea8967e67e3f5e8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080243.ondrgrmr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080243.ondrgrmr-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:9: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:571:18: warning: array index 0 is past the end of the array (that has type 'char[0]', cast to 'int *') [-Warray-bounds] 571 | ret = ((int *)(cookie->priv))[0]; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:60:2: note: array 'priv' declared here 60 | char priv[0]; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1105:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1105 | int err; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1145:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1145 | int value; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:5: warning: no previous prototype for function 'rnp_fw_reg_read' [-Wmissing-prototypes] 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ | static >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1519:18: warning: array index 0 is past the end of the array (that has type 'char[0]', cast to 'int *') [-Warray-bounds] 1519 | ret = ((int *)(cookie->priv))[0]; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:60:2: note: array 'priv' declared here 60 | char priv[0]; | ^ In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:4: In file included from include/linux/wait.h:9: In file included from include/linux/spinlock.h:63: In file included from include/linux/lockdep.h:14: In file included from include/linux/smp.h:13: In file included from include/linux/cpumask.h:12: In file included from include/linux/bitmap.h:11: In file included from include/linux/string.h:294: include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^ 12 warnings generated. vim +/rnp_mbx_lldp_all_ports_enable +1456 drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c 1455 > 1456 int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) 1457 { 1458 struct mbx_fw_cmd_req req; 1459 int err; 1460 1461 if (!hw->fw_lldp_ablity) 1462 return -EOPNOTSUPP; 1463 1464 memset(&req, 0, sizeof(req)); 1465 1466 build_lldp_ctrl_set(&req, LLDP_TX_ALL_LANES, enable); 1467 1468 err = rnp_mbx_write_posted_locked(hw, &req); 1469 return err; 1470 } 1471 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
by Zeng Heng 07 Mar '24

07 Mar '24

From: Vincent Pelletier <plr.vincent(a)gmail.com> mainline inclusion from mainline-v5.16-rc8 commit b1e0887379422975f237d43d8839b751a6bcf154 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96S0P CVE: CVE-2021-46933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported): /sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb84 r6:c3a12260 r5:bf54d014 r4:c229f000 [ 1946.646273] [<bf547d74>] (ffs_fs_kill_sb [usb_f_fs]) from [<c0326d50>] (deactivate_locked_super+0x54/0x9c) [ 1946.664893] r5:bf54d014 r4:c229f000 [ 1946.672921] [<c0326cfc>] (deactivate_locked_super) from [<c0326df8>] (deactivate_super+0x60/0x64) [ 1946.690722] r5:c2a09000 r4:c229f000 [ 1946.698706] [<c0326d98>] (deactivate_super) from [<c0349a28>] (cleanup_mnt+0xe4/0x14c) [ 1946.715553] r5:c2a09000 r4:00000000 [ 1946.723528] [<c0349944>] (cleanup_mnt) from [<c0349b08>] (__cleanup_mnt+0x1c/0x20) [ 1946.739922] r7:c0dfcb84 r6:c3a12260 r5:c3a126fc r4:00000000 [ 1946.750088] [<c0349aec>] (__cleanup_mnt) from [<c0143d10>] (task_work_run+0x84/0xb8) [ 1946.766602] [<c0143c8c>] (task_work_run) from [<c010bdc8>] (do_work_pending+0x470/0x56c) [ 1946.783540] r7:5ac3c35a r6:c0d0424c r5:c200bfb0 r4:c200a000 [ 1946.793614] [<c010b958>] (do_work_pending) from [<c01000c0>] (slow_work_pending+0xc/0x20) [ 1946.810553] Exception stack(0xc200bfb0 to 0xc200bff8) [ 1946.820129] bfa0: 00000000 00000000 000000aa b5e21430 [ 1946.837104] bfc0: bef867a0 00000001 bef86840 00000034 bef86838 bef86790 bef86794 bef867a0 [ 1946.854125] bfe0: 00000000 bef86798 b67b7a1c b6d626a4 60000010 b5a23760 [ 1946.865335] r10:00000000 r9:c200a000 r8:c0100224 r7:00000034 r6:bef86840 r5:00000001 [ 1946.881914] r4:bef867a0 [ 1946.888793] ---[ end trace 7387f2a9725b28d0 ]--- Fixes: 5e33f6fdf735 ("usb: gadget: ffs: add eventfd notification about ffs events") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Vincent Pelletier <plr.vincent(a)gmail.com> Link: https://lore.kernel.org/r/f79eeea29f3f98de6782a064ec0f7351ad2f598f.16397939… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/usb/gadget/function/f_fs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 2050993fb58b..221aee81f012 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1698,11 +1698,15 @@ static void ffs_data_clear(struct ffs_data *ffs) BUG_ON(ffs->gadget); - if (ffs->epfiles) + if (ffs->epfiles) { ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); + ffs->epfiles = NULL; + } - if (ffs->ffs_eventfd) + if (ffs->ffs_eventfd) { eventfd_ctx_put(ffs->ffs_eventfd); + ffs->ffs_eventfd = NULL; + } kfree(ffs->raw_descs_data); kfree(ffs->raw_strings); @@ -1715,7 +1719,6 @@ static void ffs_data_reset(struct ffs_data *ffs) ffs_data_clear(ffs); - ffs->epfiles = NULL; ffs->raw_descs_data = NULL; ffs->raw_descs = NULL; ffs->raw_strings = NULL; -- 2.25.1

2 1

[PATCH OLK-6.6 0/8] cpuset featrue
by Chen Ridong 07 Mar '24

07 Mar '24

Harshit Mogalapalli (1): cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check() Kamalesh Babulal (1): cgroup/cpuset: Fix retval in update_cpumask() Waiman Long (6): cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 cgroup/cpuset: Add cpuset.cpus.exclusive for v2 cgroup/cpuset: Introduce remote partition cgroup/cpuset: Check partition conflict with housekeeping setup cgroup/cpuset: Enable invalid to valid local partition transition cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() kernel/cgroup/cpuset.c | 1306 ++++++++++++++++++++++++++++++---------- 1 file changed, 975 insertions(+), 331 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 V3 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 07 Mar '24

07 Mar '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Changes in V3: - corrected the wrong bugzilla number in commit message. Changes in V2: - fixed incorrect mainline patch adaptation of WQ_FLAG_{CUSTOM, DONE}. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 7 ++---- kernel/sched/wait.c | 57 +++++++------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 74 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] net/sched: act_ct: fix wild memory access when clearing fragments
by Zhengchao Shao 07 Mar '24

07 Mar '24

From: Davide Caratti <dcaratti(a)redhat.com> mainline inclusion from mainline-v5.13-rc1 commit f77bd544a6bbe69aa50d9ed09f13494cf36ff806 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JMO CVE: CVE-2021-47014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS. Fixes: ae372cb1750f ("net/sched: act_ct: fix restore the qdisc_skb_cb after defrag") Fixes: 7baf2429a1a9 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support") Reported-by: Shuang Li <shuali(a)redhat.com> Signed-off-by: Davide Caratti <dcaratti(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_ct.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_ct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 2d41d866de3e..35668ce0b4a8 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -735,7 +735,8 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, #endif } - *qdisc_skb_cb(skb) = cb; + if (err != -EINPROGRESS) + *qdisc_skb_cb(skb) = cb; skb_clear_hash(skb); skb->ignore_df = 1; return err; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 07 Mar '24

07 Mar '24

From: tangyuchen <tangyuchen5(a)huawei.com> v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 +++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 174 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS V2 0/2] Fix CVE-2021-47047
by Guan Jing 07 Mar '24

07 Mar '24

fix CVE-2021-47047 Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS V1 0/2] fix dma_map_single fails
by Guan Jing 07 Mar '24

07 Mar '24

fix dma_map_single fails Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Fixed CVE-2021-47037
by Zheng Zengkai 07 Mar '24

07 Mar '24

Q6afe-clocks driver can get reprobed. For example if the APR services are restarted after the firmware crash. However currently Q6afe-clocks driver will oops because hw.init will get cleared during first _probe call. Rewrite the driver to fill the clock data at runtime rather than using big static array of clocks. This issue was identified as CVE-2021-47037. Backport patches from linux 5.13-rc1 to fix this CVE. Dmitry Baryshkov (1): ASoC: q6afe-clocks: fix reprobing of the driver Srinivas Kandagatla (1): ASoC: q6afe-clocks: fix warning on symbol scope sound/soc/qcom/qdsp6/q6afe-clocks.c | 209 ++++++++++++++-------------- sound/soc/qcom/qdsp6/q6afe.c | 2 +- sound/soc/qcom/qdsp6/q6afe.h | 2 +- 3 files changed, 108 insertions(+), 105 deletions(-) -- 2.20.1

2 3

[PATCH v2 OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS] ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
by Liu Jian 07 Mar '24

07 Mar '24

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v4.19.191 commit 25a87b1f566b5eb2af2857a928f0e2310d900976 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCD CVE: CVE-2021-46998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 643001b47adc844ae33510c4bb93c236667008a3 ] In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if some error happens, the skb will be freed by dev_kfree_skb(skb). But the freed skb is still used in skb_tx_timestamp(skb). My patch makes enic_queue_wq_skb() return error and goto spin_unlock() incase of error. The solution is provided by Govind. See https://lkml.org/lkml/2021/4/30/961. Fixes: fb7516d42478e ("enic: add sw timestamp support") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Acked-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/cisco/enic/enic_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c index 733d9172425b..f8e82bc55f0f 100644 --- a/drivers/net/ethernet/cisco/enic/enic_main.c +++ b/drivers/net/ethernet/cisco/enic/enic_main.c @@ -803,7 +803,7 @@ static inline int enic_queue_wq_skb_encap(struct enic *enic, struct vnic_wq *wq, return err; } -static inline void enic_queue_wq_skb(struct enic *enic, +static inline int enic_queue_wq_skb(struct enic *enic, struct vnic_wq *wq, struct sk_buff *skb) { unsigned int mss = skb_shinfo(skb)->gso_size; @@ -849,6 +849,7 @@ static inline void enic_queue_wq_skb(struct enic *enic, wq->to_use = buf->next; dev_kfree_skb(skb); } + return err; } /* netif_tx_lock held, process context with BHs disabled, or BH */ @@ -892,7 +893,8 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, return NETDEV_TX_BUSY; } - enic_queue_wq_skb(enic, wq, skb); + if (enic_queue_wq_skb(enic, wq, skb)) + goto error; if (vnic_wq_desc_avail(wq) < MAX_SKB_FRAGS + ENIC_DESC_MAX_SPLITS) netif_tx_stop_queue(txq); @@ -900,6 +902,7 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, if (!skb->xmit_more || netif_xmit_stopped(txq)) vnic_wq_doorbell(wq); +error: spin_unlock(&enic->wq_lock[txq_map]); return NETDEV_TX_OK; -- 2.34.1

2 1

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-22.03-LTS-SP2] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH 1/2] mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes
by Yuan Can 07 Mar '24

07 Mar '24

mainline inclusion from mainline commit 2eaa6c2abb9dd55041a05c20c451790c124d5cf0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96CYK CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- The decreasing of hugetlb pages number failed with the following message given: sh: page allocation failure: order:0, mode:0x204cc0(GFP_KERNEL|__GFP_RETRY_MAYFAIL|__GFP_THISNODE) CPU: 1 PID: 112 Comm: sh Not tainted 6.5.0-rc7-... #45 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.6+0x84/0xe4 show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x24 warn_alloc+0x100/0x1bc __alloc_pages_slowpath.constprop.107+0xa40/0xad8 __alloc_pages+0x244/0x2d0 hugetlb_vmemmap_restore+0x104/0x1e4 __update_and_free_hugetlb_folio+0x44/0x1f4 update_and_free_hugetlb_folio+0x20/0x68 update_and_free_pages_bulk+0x4c/0xac set_max_huge_pages+0x198/0x334 nr_hugepages_store_common+0x118/0x178 nr_hugepages_store+0x18/0x24 kobj_attr_store+0x18/0x2c sysfs_kf_write+0x40/0x54 kernfs_fop_write_iter+0x164/0x1dc vfs_write+0x3a8/0x460 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.1+0x6c/0xe4 do_el0_svc+0x38/0x94 el0_svc+0x28/0x74 el0t_64_sync_handler+0xa0/0xc4 el0t_64_sync+0x174/0x178 Mem-Info: ... The reason is that the hugetlb pages being released are allocated from movable nodes, and with hugetlb_optimize_vmemmap enabled, vmemmap pages need to be allocated from the same node during the hugetlb pages releasing. With GFP_KERNEL and __GFP_THISNODE set, allocating from movable node is always failed. Fix this problem by removing __GFP_THISNODE. Link: https://lkml.kernel.org/r/20230905124503.24899-1-yuancan@huawei.com Fixes: ad2fa3717b74 ("mm: hugetlb: alloc the vmemmap pages associated with each HugeTLB page") Signed-off-by: Yuan Can <yuancan(a)huawei.com> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Mike Kravetz <mike.kravetz(a)oracle.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb_vmemmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c index 90aee2cd3dab..b3bc59160003 100644 --- a/mm/hugetlb_vmemmap.c +++ b/mm/hugetlb_vmemmap.c @@ -381,7 +381,7 @@ static int vmemmap_remap_free(unsigned long start, unsigned long end, static int alloc_vmemmap_page_list(unsigned long start, unsigned long end, struct list_head *list) { - gfp_t gfp_mask = GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_THISNODE; + gfp_t gfp_mask = GFP_KERNEL | __GFP_RETRY_MAYFAIL; unsigned long nr_pages = (end - start) >> PAGE_SHIFT; int nid = page_to_nid((struct page *)start); struct page *page, *next; -- 2.17.1

1 1

[PATCH OLK-5.10] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 2644e97ceb4e48ac50ba90491e02bc6db6eec979
by kernel test robot 07 Mar '24

07 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2644e97ceb4e48ac50ba90491e02bc6db6eec979 !4925 v2 btrfs: do not ASSERT() if the newly created subvolume already got read Warning: (recently discovered and may have been fixed) drivers/net/ethernet/huawei/hinic/hinic_lld.c:956:33: warning: 'strncpy' output may be truncated copying 15 bytes from a string of length 15 [-Wstringop-truncation] Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240306 `-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 1034m configs tested: 11 configs skipped: 133 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240307 gcc arm64 randconfig-002-20240307 gcc arm64 randconfig-003-20240307 gcc arm64 randconfig-004-20240307 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f1e6c574c7e9942b39f099e93601ea84a6c4f737
by kernel test robot 07 Mar '24

07 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f1e6c574c7e9942b39f099e93601ea84a6c4f737 !4930 erofs: fix lz4 inplace decompression Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240306 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-003-20240306 | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-platform-mpam-mpam_devices.c:error:implicit-declaration-of-function-__acpi_get_mem_attribute | `-- drivers-platform-mpam-mpam_devices.c:error:incompatible-types-when-assigning-to-type-pgprot_t-from-type-int |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-001-20240306 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- loongarch-randconfig-002-20240306 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-002-20240306 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-004-20240306 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 978m configs tested: 16 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240306 gcc arm64 randconfig-002-20240306 clang arm64 randconfig-003-20240306 gcc arm64 randconfig-004-20240306 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240306 gcc loongarch randconfig-002-20240306 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46984
by Li Nan 06 Mar '24

06 Mar '24

Li Nan (1): kyber: fix kabi broken in ->bio_merge() Omar Sandoval (1): kyber: fix out of bounds access when preempted block/kyber-iosched.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47074
by Li Nan 06 Mar '24

06 Mar '24

Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/1] Fixed CVE-2023-52504
by Zheng Zengkai 06 Mar '24

06 Mar '24

Considering that CONFIG_X86_5LEVEL is enabled in openEuler-1.0-LTS, Backport 4.19.297 LTS patch to fix CVE-2023-52504. https://nvd.nist.gov/vuln/detail/CVE-2023-52504 Kirill A. Shutemov (1): x86/alternatives: Disable KASAN in apply_alternatives() arch/x86/kernel/alternative.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) -- 2.20.1

2 2

[PATCH openEuler-1.0-LTS 1/2] nvme-loop: don't put ctrl on nvme_init_ctrl error
by Li Nan 06 Mar '24

06 Mar '24

From: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> mainline inclusion from mainline-v5.10-rc1 commit 1401fcc4e3da97c44dcc7cbf538c07e24768d791 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I956G7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function nvme_init_ctrl() gets the ctrl reference & when it fails it does put the ctrl reference in the error unwind code. When creating loop ctrl in nvme_loop_create_ctrl() if nvme_init_ctrl() returns non zero (i.e. error) value it jumps to the "out_put_ctrl" label which calls nvme_put_ctrl(), that will lead to douple ctrl put in error unwind path. Update nvme_loop_create_ctrl() such that this patch removes the "out_put_ctrl" label, add a new "out" label after nvme_put_ctrl() in error unwind path and jump to newly added label when nvme_init_ctrl() call retuns an error. Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflict: Commit 64d452b3560b and b6cec06d19d9 changed context. Does not affect the logic of this patch. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/nvme/target/loop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c index 1eee21310dee..985479f10597 100644 --- a/drivers/nvme/target/loop.c +++ b/drivers/nvme/target/loop.c @@ -608,7 +608,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops, 0 /* no quirks, we're perfect! */); if (ret) - goto out_put_ctrl; + goto out; ret = -ENOMEM; @@ -661,8 +661,8 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, kfree(ctrl->queues); out_uninit_ctrl: nvme_uninit_ctrl(&ctrl->ctrl); -out_put_ctrl: nvme_put_ctrl(&ctrl->ctrl); +out: if (ret > 0) ret = -EIO; return ERR_PTR(ret); -- 2.39.2

2 2

[PATCH openEuler-1.0-LTS] soundwire: stream: fix memory leak in stream config error path
by Zhu Wang 06 Mar '24

06 Mar '24

From: Rander Wang <rander.wang(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit 48f17f96a81763c7c8bf5500460a359b9939359f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOP CVE: CVE-2021-47020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak. Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") Signed-off-by: Rander Wang <rander.wang(a)intel.com> Reviewed-by: Keyon Jie <yang.jie(a)intel.com> Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.inte… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- drivers/soundwire/stream.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 907a548645b7..42bc701e2304 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, } ret = sdw_config_stream(&slave->dev, stream, stream_config, true); - if (ret) + if (ret) { + /* + * sdw_release_master_stream will release s_rt in slave_rt_list in + * stream_error case, but s_rt is only added to slave_rt_list + * when sdw_config_stream is successful, so free s_rt explicitly + * when sdw_config_stream is failed. + */ + kfree(s_rt); goto stream_error; + } list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 1/1] soundwire: stream: fix memory leak in stream config error path
by Zhu Wang 06 Mar '24

06 Mar '24

From: Rander Wang <rander.wang(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit 48f17f96a81763c7c8bf5500460a359b9939359f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOP CVE: CVE-2021-47020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak. Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") Signed-off-by: Rander Wang <rander.wang(a)intel.com> Reviewed-by: Keyon Jie <yang.jie(a)intel.com> Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.inte… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- drivers/soundwire/stream.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 907a548645b7..42bc701e2304 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, } ret = sdw_config_stream(&slave->dev, stream, stream_config, true); - if (ret) + if (ret) { + /* + * sdw_release_master_stream will release s_rt in slave_rt_list in + * stream_error case, but s_rt is only added to slave_rt_list + * when sdw_config_stream is successful, so free s_rt explicitly + * when sdw_config_stream is failed. + */ + kfree(s_rt); goto stream_error; + } list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
by Zeng Heng 06 Mar '24

06 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95A33 CVE: NA ---------------------------------------- When the monitor is created, the configuration should follow its parent's configuration, instead of the last used configuration, or that would lead to misconfiguration of monitor group. Fixes: 08127bbfcfae ("mpam: update monitor rmid and group configuration") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 7659b29e6fe3..e89683a27a98 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -229,6 +229,8 @@ static void resctrl_group_resync_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, @@ -287,6 +289,8 @@ static void resctrl_group_update_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, -- 2.25.1

2 1

[PATCH OLK-5.10] mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
by Zeng Heng 06 Mar '24

06 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95A33 CVE: NA ---------------------------------------- When the monitor is created, the configuration should follow its parent's configuration, instead of the last used configuration, or that would lead to misconfiguration of monitor group. Fixes: 08127bbfcfae ("mpam: update monitor rmid and group configuration") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 08d7b002517d..dc9716b3fd5a 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -225,6 +225,8 @@ static void resctrl_group_resync_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, @@ -285,6 +287,8 @@ static void resctrl_group_update_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, -- 2.25.1

2 1

[PATCH v3 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 06 Mar '24

06 Mar '24

From: Shao Denghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. Shao Denghui (3): workqueue: add member for NUMA aware order workqueue and implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance Add kernel compilation configuration options Kconfig | 2 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/iscsi_tcp.c | 13 +++++++++++++ drivers/scsi/libiscsi.c | 24 ++++++++++++++++++++++-- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 21 +++++++++++++++++++-- lib/Kconfig.openeuler | 8 ++++++++ 9 files changed, 68 insertions(+), 4 deletions(-) create mode 100644 lib/Kconfig.openeuler -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS] bnxt_en: Fix RX consumer index logic in the error path.
by Ziyang Xuan 06 Mar '24

06 Mar '24

From: Michael Chan <michael.chan(a)broadcom.com> mainline inclusion from mainline-v5.13-rc1 commit bbd6f0a948139970f4a615dff189d9a503681a39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94J1Q CVE: CVE-2021-47015 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In bnxt_rx_pkt(), the RX buffers are expected to complete in order. If the RX consumer index indicates an out of order buffer completion, it means we are hitting a hardware bug and the driver will abort all remaining RX packets and reset the RX ring. The RX consumer index that we pass to bnxt_discard_rx() is not correct. We should be passing the current index (tmp_raw_cons) instead of the old index (raw_cons). This bug can cause us to be at the wrong index when trying to abort the next RX packet. It can crash like this: #0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007 #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232 #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e #3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978 #4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0 #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24 #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12 #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5 [exception RIP: bnxt_rx_pkt+237] RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213 RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000 RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000 RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0 R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 Fixes: a1b0e4e684e9 ("bnxt_en: Improve RX consumer index validity check.") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Reviewed-by: Andy Gospodarek <gospo(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 2f61175f5655a..25104ad935404 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -1547,12 +1547,14 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons, cons = rxcmp->rx_cmp_opaque; if (unlikely(cons != rxr->rx_next_cons)) { - int rc1 = bnxt_discard_rx(bp, bnapi, raw_cons, rxcmp); + int rc1 = bnxt_discard_rx(bp, bnapi, &tmp_raw_cons, rxcmp); netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", cons, rxr->rx_next_cons); bnxt_sched_reset(bp, rxr); - return rc1; + if (rc1) + return rc1; + goto next_rx_no_prod_no_len; } rx_buf = &rxr->rx_buf_ring[cons]; data = rx_buf->data; -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] CVE-2023-52568
by Chen Ridong 06 Mar '24

06 Mar '24

*** BLURB HERE *** Haitao Huang (1): x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race arch/x86/kernel/cpu/sgx/encl.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] vt: fix memory overlapping when deleting chars in the buffer
by Yi Yang 06 Mar '24

06 Mar '24

From: Yangxi Xiang <xyangxi5(a)gmail.com> mainline inclusion from mainline-v5.19-rc7 commit 39cdb68c64d84e71a4a717000b6e5de208ee60cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATI CVE: CVE-2022-48627 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buffer overlaps with the source buffer. The line buffer is not always broken, because the memcpy utilizes the hardware acceleration, whose result is not deterministic. Fix this problem by using replacing the scr_memcpyw with scr_memmovew. Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Signed-off-by: Yangxi Xiang <xyangxi5(a)gmail.com> Link: https://lore.kernel.org/r/20220628093322.5688-1-xyangxi5@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/tty/vt/vt.c Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 20565603a365..163186cbfe79 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -855,7 +855,7 @@ static void delete_char(struct vc_data *vc, unsigned int nr) unsigned short *p = (unsigned short *) vc->vc_pos; vc_uniscr_delete(vc, nr); - scr_memcpyw(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2); + scr_memmovew(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2); scr_memsetw(p + vc->vc_cols - vc->vc_x - nr, vc->vc_video_erase_char, nr * 2); vc->vc_need_wrap = 0; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] nvme-loop: fix memory leak in nvme_loop_create_ctrl()
by Li Nan 06 Mar '24

06 Mar '24

From: Wu Bo <wubo40(a)huawei.com> mainline inclusion from mainline-v5.13-rc3 commit 03504e3b54cc8118cc26c064e60a0b00c2308708 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956G7 CVE: CVE-2021-47074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl() fails, the loop ctrl should be freed before jumping to the "out" label. Fixes: 3a85a5de29ea ("nvme-loop: add a NVMe loopback host driver") Signed-off-by: Wu Bo <wubo40(a)huawei.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflict: In mainline, commit 64d452b3560b and b6cec06d19d9 changed context. Does not affect the logic of this patch. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/nvme/target/loop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c index 1eee21310dee..a8d15fd6ebe9 100644 --- a/drivers/nvme/target/loop.c +++ b/drivers/nvme/target/loop.c @@ -607,8 +607,10 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops, 0 /* no quirks, we're perfect! */); - if (ret) + if (ret) { + kfree(ctrl); goto out_put_ctrl; + } ret = -ENOMEM; -- 2.39.2

2 1

[PATCH OLK-5.10] ieee802154: ca8210: Fix a potential UAF in ca8210_probe
by Yu Liao 06 Mar '24

06 Mar '24

From: Dinghao Liu <dinghao.liu(a)zju.edu.cn> stable inclusion from stable-v5.10.199 commit 55e06850c7894f00d41b767c5f5665459f83f58f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASM CVE: CVE-2023-52510 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f990874b1c98fe8e57ee9385669f501822979258 ] If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock(). Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: Dinghao Liu <dinghao.liu(a)zju.edu.cn> Message-ID: <20231007033049.22353-1-dinghao.liu(a)zju.edu.cn> Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/net/ieee802154/ca8210.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index 1c5d70c60354..0ce426c0c0bf 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -2783,7 +2783,6 @@ static int ca8210_register_ext_clock(struct spi_device *spi) struct device_node *np = spi->dev.of_node; struct ca8210_priv *priv = spi_get_drvdata(spi); struct ca8210_platform_data *pdata = spi->dev.platform_data; - int ret = 0; if (!np) return -EFAULT; @@ -2800,18 +2799,8 @@ static int ca8210_register_ext_clock(struct spi_device *spi) dev_crit(&spi->dev, "Failed to register external clk\n"); return PTR_ERR(priv->clk); } - ret = of_clk_add_provider(np, of_clk_src_simple_get, priv->clk); - if (ret) { - clk_unregister(priv->clk); - dev_crit( - &spi->dev, - "Failed to register external clock as clock provider\n" - ); - } else { - dev_info(&spi->dev, "External clock set as clock provider\n"); - } - return ret; + return of_clk_add_provider(np, of_clk_src_simple_get, priv->clk); } /** @@ -2823,8 +2812,8 @@ static void ca8210_unregister_ext_clock(struct spi_device *spi) { struct ca8210_priv *priv = spi_get_drvdata(spi); - if (!priv->clk) - return + if (IS_ERR_OR_NULL(priv->clk)) + return; of_clk_del_provider(spi->dev.of_node); clk_unregister(priv->clk); -- 2.25.1

2 1

[PATCH OLK-5.10] net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
by Zhang Xiaoxu 06 Mar '24

06 Mar '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v5.10.198 commit 30bc4d7aebe33904b0f2d3aad4b4a9c6029ad0c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXT CVE: CVE-2023-52528 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e9c65989920f7c28775ec4e0c11b483910fb67b8 ] syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] BUG: KMSAN: uninit-value in smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 CPU: 0 PID: 8696 Comm: kworker/0:3 Not tainted 5.8.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 usbnet_probe+0x1152/0x3f90 drivers/net/usb/usbnet.c:1737 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Local variable ----buf.i87@smsc75xx_bind created at: __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 This issue is caused because usbnet_read_cmd() reads less bytes than requested (zero byte in the reproducer). In this case, 'buf' is not properly filled. This patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads less bytes than requested. Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") Reported-and-tested-by: syzbot+6966546b78d050bb0b5d(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6966546b78d050bb0b5d Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20230923173549.3284502-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/net/usb/smsc75xx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c index fb1389bd0939..6310841aeac7 100644 --- a/drivers/net/usb/smsc75xx.c +++ b/drivers/net/usb/smsc75xx.c @@ -90,7 +90,9 @@ static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index, ret = fn(dev, USB_VENDOR_REQUEST_READ_REGISTER, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, index, &buf, 4); - if (unlikely(ret < 0)) { + if (unlikely(ret < 4)) { + ret = ret < 0 ? ret : -ENODATA; + netdev_warn(dev->net, "Failed to read reg index 0x%08x: %d\n", index, ret); return ret; -- 2.34.1

2 1