- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 18207/30000] drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 commit: 3ddd74dceeba1f4ea8b20db59276ea3c6eded3d5 [18207/30000] openeuler: net: txgbe: Fix some known bugs, merge net-swift txgbe-1.2.3 out-of-tree config: x86_64-randconfig-123-20240414 (https://download.01.org/0day-ci/archive/20240414/202404142149.v0MRewcl-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404142149.v0MRewcl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404142149.v0MRewcl-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32': >> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32': >> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `fmgr_usr_cmd_op'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32': >> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `flash_erase_chip'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `flash_erase_sector': drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2377: multiple definition of `flash_erase_sector'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_hw.c:2891: first defined here ld: drivers/net/ethernet/netswift/ngbe/ngbe_hw.o: in function `wr32': >> drivers/net/ethernet/netswift/ngbe/ngbe_type.h:2877: multiple definition of `flash_write_dword'; drivers/net/ethernet/netswift/txgbe/txgbe_hw.o:drivers/net/ethernet/netswift/txgbe/txgbe_type.h:3165: first defined here vim +2877 drivers/net/ethernet/netswift/ngbe/ngbe_type.h a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2873 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2874 static inline void a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2875 wr32(struct ngbe_hw *hw, u32 reg, u32 val) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2876 { a5961b4bc6ce09 Duanqiang Wen 2022-12-01 @2877 u8 __iomem *base = READ_ONCE(hw->hw_addr); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2878 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2879 if (unlikely(!base)) a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2880 return; a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2881 a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2882 ngbe_wr32(base + reg, val); a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2883 } a5961b4bc6ce09 Duanqiang Wen 2022-12-01 2884 :::::: The code at line 2877 was first introduced by commit :::::: a5961b4bc6ce09a70902686ecc848a47493a9251 openeuler: net: ngbe: add ngbe module support :::::: TO: Duanqiang Wen <duanqiangwen(a)net-swift.com> :::::: CC: Duanqiang Wen <duanqiangwen(a)net-swift.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/5] cvm feature patches
by hejingxian 14 Apr '24

14 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches: 1. add cvm host feature 2. enable pmu phys irq inject for cvm 3. add bounce buffer feature for cvm guest 4. add lpi support for cvm guest 5. fix kabi for cvm host arch/arm64/configs/defconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/include/asm/cvm_guest.h | 21 + arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 +++ arch/arm64/kvm/Kconfig | 16 + arch/arm64/kvm/Makefile | 5 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 869 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/cvm_guest.c | 91 +++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 10 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/mmu.c | 11 + arch/arm64/mm/pageattr.c | 9 +- drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 13 + include/uapi/linux/kvm.h | 27 + kernel/dma/direct.c | 39 ++ kernel/dma/swiotlb.c | 86 ++- virt/kvm/kvm_main.c | 7 +- 37 files changed, 2765 insertions(+), 43 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/cvm_guest.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

3 7

[openeuler:OLK-5.10 20421/30000] drivers/net/ethernet/nebula-matrix/m1600/debug.c:267:21: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 commit: 01e6e2075c432fde7fb5a66202b41bbd469de620 [20421/30000] Net: m1600: Add m1600-driver for nebula-matrix m1600 series smart NIC. config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240414/202404141531.eh0C6OjT-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404141531.eh0C6OjT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404141531.eh0C6OjT-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/nebula-matrix/m1600/debug.c:267:21: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/nebula-matrix/m1600/debug.c:440:21: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/nebula-matrix/m1600/debug.c:444:21: sparse: sparse: cast removes address space '__iomem' of expression -- >> drivers/net/ethernet/nebula-matrix/m1600/ethtool.c:507:5: sparse: sparse: symbol 'nbl_get_eeprom_len' was not declared. Should it be static? >> drivers/net/ethernet/nebula-matrix/m1600/ethtool.c:643:5: sparse: sparse: symbol 'nbl_query_link_speed' was not declared. Should it be static? -- >> drivers/net/ethernet/nebula-matrix/m1600/main.c:155:6: sparse: sparse: symbol 'nbl_service_task2_schedule' was not declared. Should it be static? >> drivers/net/ethernet/nebula-matrix/m1600/main.c:436:6: sparse: sparse: symbol 'nbl_check_and_set_module_info' was not declared. Should it be static? -- >> drivers/net/ethernet/nebula-matrix/m1600/txrx.c:822:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] buffer_addr @@ got restricted __le64 [usertype] @@ drivers/net/ethernet/nebula-matrix/m1600/txrx.c:822:38: sparse: expected unsigned long long [usertype] buffer_addr drivers/net/ethernet/nebula-matrix/m1600/txrx.c:822:38: sparse: got restricted __le64 [usertype] vim +/__iomem +267 drivers/net/ethernet/nebula-matrix/m1600/debug.c 251 252 /* ring */ 253 static int ring_seq_show(struct seq_file *m, void *v) 254 { 255 int i, j, n; 256 struct nbl_rx_desc *rx_desc; 257 struct nbl_tx_desc *tx_desc; 258 struct nbl_ring *ring = m->private; 259 260 seq_printf(m, "size=%d\n", ring->size); 261 seq_printf(m, "dma=0x%llX\n", (unsigned long long)ring->dma); 262 seq_printf(m, "desc=0x%llX\n", (unsigned long long)ring->desc); 263 seq_printf(m, "desc_num=%d\n", ring->desc_num); 264 seq_printf(m, "local_qid=%d\n", ring->local_qid); 265 seq_printf(m, "queue_index=%d\n", ring->queue_index); 266 seq_printf(m, "notify_addr=0x%llX\n", > 267 (unsigned long long)ring->notify_addr); 268 seq_printf(m, "buf_len=%d\n", ring->buf_len); 269 seq_printf(m, "next_to_use=%d\n", ring->next_to_use); 270 seq_printf(m, "next_to_clean=%d\n", ring->next_to_clean); 271 seq_printf(m, "next_to_alloc=%d\n", ring->next_to_alloc); 272 seq_printf(m, "tail_ptr=%d\n", ring->tail_ptr); 273 if (!ring->desc) { 274 seq_puts(m, "[Unallocated]\n"); 275 return 0; 276 } 277 278 if (ring->local_qid & 1) { 279 tx_desc = (struct nbl_tx_desc *)ring->desc; 280 n = sizeof(struct nbl_tx_desc) / sizeof(u32); 281 for (i = 0; i < ring->desc_num; i++) { 282 seq_printf(m, "[desc-%03d]: ", i); 283 for (j = 0; j < n; j++) 284 seq_printf(m, "%08X ", ((u32 *)tx_desc)[j]); 285 seq_printf(m, "dlen:%d ", tx_desc->data_len); 286 seq_printf(m, "plen:%d ", tx_desc->pkt_len); 287 seq_printf(m, "dd:%d ", tx_desc->dd); 288 seq_printf(m, "eop:%d ", tx_desc->eop); 289 seq_printf(m, "sop:%d ", tx_desc->sop); 290 seq_printf(m, "fwd:%d ", tx_desc->fwd); 291 seq_printf(m, "dp:%d ", tx_desc->dport); 292 seq_printf(m, "dpi:%d ", tx_desc->dport_id); 293 seq_printf(m, "l3c:%d ", tx_desc->l3_checksum); 294 seq_printf(m, "l4c:%d ", tx_desc->l4_checksum); 295 seq_printf(m, "rsslag:%d ", tx_desc->rss_lag); 296 seq_printf(m, "l3_off:%d\n", tx_desc->l3_start_offset); 297 tx_desc++; 298 } 299 } else { 300 rx_desc = (struct nbl_rx_desc *)ring->desc; 301 n = sizeof(struct nbl_rx_desc) / sizeof(u32); 302 for (i = 0; i < ring->desc_num; i++) { 303 seq_printf(m, "[desc-%03d]: ", i); 304 for (j = 0; j < n; j++) 305 seq_printf(m, "%08X ", ((u32 *)rx_desc)[j]); 306 seq_printf(m, "dlen:%d ", rx_desc->data_len); 307 seq_printf(m, "dd:%d ", rx_desc->dd); 308 seq_printf(m, "eop:%d ", rx_desc->eop); 309 seq_printf(m, "sop:%d ", rx_desc->sop); 310 seq_printf(m, "fwd:%d ", rx_desc->fwd); 311 seq_printf(m, "sp:%d ", rx_desc->sport); 312 seq_printf(m, "spi:%d ", rx_desc->sport_id); 313 seq_printf(m, "cks:%d ", rx_desc->checksum_status); 314 seq_printf(m, "ptype:%d ", rx_desc->ptype); 315 seq_printf(m, "lag:%d ", rx_desc->lag); 316 seq_printf(m, "lagid:%d\n", rx_desc->lag_id); 317 rx_desc++; 318 } 319 } 320 321 return 0; 322 } 323 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 11501/30000] arch/arm64/kernel/ipi_nmi.c:38:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'?
by kernel test robot 14 Apr '24

14 Apr '24

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 commit: f86d165bfe5f6248743774bb07af0bd7cff12443 [11501/30000] arm64: Add non nmi ipi backtrace support config: arm64-randconfig-004-20240414 (https://download.01.org/0day-ci/archive/20240414/202404141450.VgXyPZBP-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404141450.VgXyPZBP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404141450.VgXyPZBP-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/ipi_nmi.c: In function 'ipi_cpu_backtrace': >> arch/arm64/kernel/ipi_nmi.c:38:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] 38 | printk_safe_enter(); | ^~~~~~~~~~~~~~~~~ | printk_nmi_enter >> arch/arm64/kernel/ipi_nmi.c:40:9: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] 40 | printk_safe_exit(); | ^~~~~~~~~~~~~~~~ | printk_nmi_exit cc1: some warnings being treated as errors vim +38 arch/arm64/kernel/ipi_nmi.c 35 36 static void ipi_cpu_backtrace(void *info) 37 { > 38 printk_safe_enter(); 39 nmi_cpu_backtrace(get_irq_regs()); > 40 printk_safe_exit(); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20812/22089] include/linux/compiler.h:271:34: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'}
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ab9b23cd7b3e05b3fc38df24e070593493e1d8e2 commit: f26f5f07f639bba2e12d72fb1cac16f5d1d18efc [20812/22089] rfs: annotate lockless accesses to RFS sock flow table config: x86_64-randconfig-102-20240413 (https://download.01.org/0day-ci/archive/20240414/202404141254.h8C8BQzT-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404141254.h8C8BQzT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404141254.h8C8BQzT-lkp@intel.com/ All warnings (new ones prefixed by >>): net/core/dev.c:2287:49: warning: array subscript i is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2287 | new_map->queues[i] = map->queues[i]; | ~~~~~~~~~~~^~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:2287:32: warning: array subscript i is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2287 | new_map->queues[i] = map->queues[i]; | ~~~~~~~~~~~~~~~^~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ In file included from net/core/dev.c:137: In function 'cpu_rmap_lookup_index', inlined from 'set_rps_cpu' at net/core/dev.c:3989:15: include/linux/cpu_rmap.h:47:26: warning: array subscript <unknown> is outside array bounds of 'struct <anonymous>[0]' [-Warray-bounds=] 47 | return rmap->near[cpu].index; | ~~~~~~~~~~^~~~~ include/linux/cpu_rmap.h: In function 'set_rps_cpu': include/linux/cpu_rmap.h:34:25: note: while referencing 'near' 34 | } near[0]; | ^~~~ net/core/dev.c:4003:25: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4003 | rflow = &flow_table->flows[flow_id]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4003:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4003 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ In file included from arch/x86/include/asm/current.h:5, from include/linux/sched.h:12, from include/linux/uaccess.h:5, from net/core/dev.c:75: net/core/dev.c: In function '__get_xps_queue_idx': include/linux/compiler.h:271:34: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ include/linux/rcupdate.h:347:55: note: in expansion of macro 'READ_ONCE' 347 | typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \ | ^~~~~~~~~ include/linux/rcupdate.h:502:9: note: in expansion of macro '__rcu_dereference_check' 502 | __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:560:28: note: in expansion of macro 'rcu_dereference_check' 560 | #define rcu_dereference(p) rcu_dereference_check(p, 0) | ^~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:3618:15: note: in expansion of macro 'rcu_dereference' 3618 | map = rcu_dereference(dev_maps->attr_map[tci]); | ^~~~~~~~~~~~~~~ include/linux/netdevice.h:781:31: note: while referencing 'attr_map' 781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */ | ^~~~~~~~ net/core/dev.c:3623:50: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 3623 | queue_index = map->queues[reciprocal_scale( | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~ 3624 | skb_get_hash(skb), map->len)]; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:3621:50: warning: array subscript 0 is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 3621 | queue_index = map->queues[0]; | ~~~~~~~~~~~^~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c: In function 'rps_may_expire_flow': net/core/dev.c:4144:25: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4144:43: warning: array subscript flow_id is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4144 | rflow = &flow_table->flows[flow_id]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c: In function 'get_rps_cpu': >> include/linux/compiler.h:271:34: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'} [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ net/core/dev.c:4067:25: note: in expansion of macro 'READ_ONCE' 4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]); | ^~~~~~~~~ include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ net/core/dev.c:4067:56: warning: array subscript <unknown> is outside array bounds of 'const u32[0]' {aka 'const unsigned int[]'} [-Warray-bounds=] 4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]); include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE' 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ net/core/dev.c:4067:25: note: in expansion of macro 'READ_ONCE' 4067 | ident = READ_ONCE(sock_flow_table->ents[hash & sock_flow_table->mask]); | ^~~~~~~~~ include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ net/core/dev.c:4076:25: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4076 | rflow = &flow_table->flows[hash & flow_table->mask]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4076:43: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4076 | rflow = &flow_table->flows[hash & flow_table->mask]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4076:43: warning: array subscript <unknown> is outside array bounds of 'struct rps_dev_flow[0]' [-Warray-bounds=] 4076 | rflow = &flow_table->flows[hash & flow_table->mask]; | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:680:29: note: while referencing 'flows' 680 | struct rps_dev_flow flows[0]; | ^~~~~ net/core/dev.c:4108:33: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 4108 | tcpu = map->cpus[reciprocal_scale(hash, map->len)]; | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/netdevice.h:658:13: note: while referencing 'cpus' 658 | u16 cpus[0]; | ^~~~ In file included from include/linux/rculist.h:11, from include/linux/pid.h:5, from include/linux/sched.h:14: net/core/dev.c: In function 'remove_xps_queue': include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] 356 | ((typeof(*p) __force __kernel *)(p)); \ | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:551:9: note: in expansion of macro '__rcu_dereference_protected' 551 | __rcu_dereference_protected((p), (c), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2123:9: note: in expansion of macro 'rcu_dereference_protected' 2123 | rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex)) | ^~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2132:23: note: in expansion of macro 'xmap_dereference' 2132 | map = xmap_dereference(dev_maps->attr_map[tci]); | ^~~~~~~~~~~~~~~~ include/linux/netdevice.h:781:31: note: while referencing 'attr_map' 781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */ | ^~~~~~~~ net/core/dev.c:2137:32: warning: array subscript pos is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2137 | if (map->queues[pos] != index) | ~~~~~~~~~~~^~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:2141:55: warning: array subscript <unknown> is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2141 | map->queues[pos] = map->queues[--map->len]; | ~~~~~~~~~~~^~~~~~~~~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c:2141:36: warning: array subscript pos is outside array bounds of 'u16[0]' {aka 'short unsigned int[]'} [-Warray-bounds=] 2141 | map->queues[pos] = map->queues[--map->len]; | ~~~~~~~~~~~^~~~~ include/linux/netdevice.h:770:13: note: while referencing 'queues' 770 | u16 queues[0]; | ^~~~~~ net/core/dev.c: In function '__netif_set_xps_queue': include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] 356 | ((typeof(*p) __force __kernel *)(p)); \ | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:551:9: note: in expansion of macro '__rcu_dereference_protected' 551 | __rcu_dereference_protected((p), (c), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2123:9: note: in expansion of macro 'rcu_dereference_protected' 2123 | rcu_dereference_protected((P), lockdep_is_held(&xps_map_mutex)) | ^~~~~~~~~~~~~~~~~~~~~~~~~ net/core/dev.c:2430:35: note: in expansion of macro 'xmap_dereference' 2430 | new_map = xmap_dereference(new_dev_maps->attr_map[tci]); | ^~~~~~~~~~~~~~~~ include/linux/netdevice.h:781:31: note: while referencing 'attr_map' 781 | struct xps_map __rcu *attr_map[0]; /* Either CPUs map or RXQs map */ | ^~~~~~~~ include/linux/rcupdate.h:356:10: warning: array subscript tci is outside array bounds of 'struct xps_map *[0]' [-Warray-bounds=] -- In file included from arch/x86/include/asm/atomic.h:5, from include/linux/atomic.h:7, from include/linux/crypto.h:20, from include/crypto/hash.h:16, from net/ipv4/tcp.c:250: In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2: >> include/linux/compiler.h:271:34: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ In file included from include/net/inet_sock.h:23, from include/net/ip.h:31, from include/linux/errqueue.h:6, from net/ipv4/tcp.c:272: include/linux/netdevice.h: In function 'tcp_splice_read': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2: include/linux/netdevice.h:720:42: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 720 | if (READ_ONCE(table->ents[index]) != val) include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE' 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ include/linux/netdevice.h: In function 'tcp_splice_read': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_splice_read' at net/ipv4/tcp.c:803:2: include/linux/netdevice.h:721:47: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 721 | WRITE_ONCE(table->ents[index], val); include/linux/compiler.h:296:29: note: in definition of macro 'WRITE_ONCE' 296 | __write_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h: In function 'tcp_splice_read': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2: >> include/linux/compiler.h:271:34: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^~~~ include/linux/compiler.h:277:22: note: in expansion of macro '__READ_ONCE' 277 | #define READ_ONCE(x) __READ_ONCE(x, 1) | ^~~~~~~~~~~ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ include/linux/netdevice.h: In function 'tcp_zerocopy_receive': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2: include/linux/netdevice.h:720:42: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 720 | if (READ_ONCE(table->ents[index]) != val) include/linux/compiler.h:271:36: note: in definition of macro '__READ_ONCE' 271 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h:720:21: note: in expansion of macro 'READ_ONCE' 720 | if (READ_ONCE(table->ents[index]) != val) | ^~~~~~~~~ include/linux/netdevice.h: In function 'tcp_zerocopy_receive': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ In function 'rps_record_sock_flow', inlined from 'sock_rps_record_flow_hash' at include/net/sock.h:1002:2, inlined from 'sock_rps_record_flow' at include/net/sock.h:1025:4, inlined from 'tcp_zerocopy_receive' at net/ipv4/tcp.c:1791:2: include/linux/netdevice.h:721:47: warning: array subscript index is outside array bounds of 'u32[0]' {aka 'unsigned int[]'} [-Warray-bounds=] 721 | WRITE_ONCE(table->ents[index], val); include/linux/compiler.h:296:29: note: in definition of macro 'WRITE_ONCE' 296 | __write_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/netdevice.h: In function 'tcp_zerocopy_receive': include/linux/netdevice.h:698:17: note: while referencing 'ents' 698 | u32 ents[0] ____cacheline_aligned_in_smp; | ^~~~ .. vim +271 include/linux/compiler.h 230fa253df6352 Christian Borntraeger 2014-11-25 266 d976441f44bc5d Andrey Ryabinin 2015-10-19 267 #define __READ_ONCE(x, check) \ d976441f44bc5d Andrey Ryabinin 2015-10-19 268 ({ \ d976441f44bc5d Andrey Ryabinin 2015-10-19 269 union { typeof(x) __val; char __c[1]; } __u; \ d976441f44bc5d Andrey Ryabinin 2015-10-19 270 if (check) \ d976441f44bc5d Andrey Ryabinin 2015-10-19 @271 __read_once_size(&(x), __u.__c, sizeof(x)); \ d976441f44bc5d Andrey Ryabinin 2015-10-19 272 else \ d976441f44bc5d Andrey Ryabinin 2015-10-19 273 __read_once_size_nocheck(&(x), __u.__c, sizeof(x)); \ 76ebbe78f7390a Will Deacon 2017-10-24 274 smp_read_barrier_depends(); /* Enforce dependency ordering from x */ \ d976441f44bc5d Andrey Ryabinin 2015-10-19 275 __u.__val; \ d976441f44bc5d Andrey Ryabinin 2015-10-19 276 }) d976441f44bc5d Andrey Ryabinin 2015-10-19 277 #define READ_ONCE(x) __READ_ONCE(x, 1) d976441f44bc5d Andrey Ryabinin 2015-10-19 278 :::::: The code at line 271 was first introduced by commit :::::: d976441f44bc5d48635d081d277aa76556ffbf8b compiler, atomics, kasan: Provide READ_ONCE_NOCHECK() :::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 14 Apr '24

14 Apr '24

From: Ryosuke Yasuoka <ryasuoka(a)redhat.com> stable inclusion from stable-v4.19.309 commit ec343a55b687a452f5e87f3b52bf9f155864df65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W CVE: CVE-2024-26805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ] syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as `len` and passed to skb_put_data(). This `len` is based on `skb->end` that is not data offset but buffer offset. The `skb->end` contains data and tailroom. Since the tailroom is not initialized when the new `skb` created, KMSAN detects uninitialized memory area when copying the data. This patch resolved this issue by correct the len from `skb->end` to `skb->len`, which is the actual data offset. BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] sock_read_iter+0x467/0x580 net/socket.c:1136 call_read_iter include/linux/fs.h:2014 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8f6/0xe00 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x93/0xd0 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was stored to memory at: skb_put_data include/linux/skbuff.h:2622 [inline] netlink_to_full_skb net/netlink/af_netlink.c:181 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline] __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 [inline] netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: free_pages_prepare mm/page_alloc.c:1087 [inline] free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347 free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533 release_pages+0x23d3/0x2410 mm/swap.c:1042 free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300 tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392 exit_mmap+0x49e/0xd30 mm/mmap.c:3321 __mmput+0x13f/0x530 kernel/fork.c:1349 mmput+0x8a/0xa0 kernel/fork.c:1371 exit_mm+0x1b8/0x360 kernel/exit.c:567 do_exit+0xd57/0x4080 kernel/exit.c:858 do_group_exit+0x2fd/0x390 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Bytes 3852-3903 of 3904 are uninitialized Memory access of size 3904 starts at ffff88812ea1e000 Data copied to user address 0000000020003280 CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps") Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1] Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index fd0fa4c37a3b..766096493494 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -160,7 +160,7 @@ static inline u32 netlink_group_mask(u32 group) static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb, gfp_t gfp_mask) { - unsigned int len = skb_end_offset(skb); + unsigned int len = skb->len; struct sk_buff *new; new = alloc_skb(len, gfp_mask); -- 2.34.1

2 1

[PATCH OLK-5.10] netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
by Zhengchao Shao 14 Apr '24

14 Apr '24

From: Ryosuke Yasuoka <ryasuoka(a)redhat.com> stable inclusion from stable-v5.10.212 commit f19d1f98e60e68b11fc60839105dd02a30ec0d77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E46W CVE: CVE-2024-26805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd ] syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as `len` and passed to skb_put_data(). This `len` is based on `skb->end` that is not data offset but buffer offset. The `skb->end` contains data and tailroom. Since the tailroom is not initialized when the new `skb` created, KMSAN detects uninitialized memory area when copying the data. This patch resolved this issue by correct the len from `skb->end` to `skb->len`, which is the actual data offset. BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] sock_read_iter+0x467/0x580 net/socket.c:1136 call_read_iter include/linux/fs.h:2014 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8f6/0xe00 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x93/0xd0 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was stored to memory at: skb_put_data include/linux/skbuff.h:2622 [inline] netlink_to_full_skb net/netlink/af_netlink.c:181 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline] __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 [inline] netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: free_pages_prepare mm/page_alloc.c:1087 [inline] free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347 free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533 release_pages+0x23d3/0x2410 mm/swap.c:1042 free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316 tlb_batch_pages_flush mm/mmu_gather.c:98 [inline] tlb_flush_mmu_free mm/mmu_gather.c:293 [inline] tlb_flush_mmu+0x6f5/0x980 mm/mmu_gather.c:300 tlb_finish_mmu+0x101/0x260 mm/mmu_gather.c:392 exit_mmap+0x49e/0xd30 mm/mmap.c:3321 __mmput+0x13f/0x530 kernel/fork.c:1349 mmput+0x8a/0xa0 kernel/fork.c:1371 exit_mm+0x1b8/0x360 kernel/exit.c:567 do_exit+0xd57/0x4080 kernel/exit.c:858 do_group_exit+0x2fd/0x390 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3c/0x50 kernel/exit.c:1030 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Bytes 3852-3903 of 3904 are uninitialized Memory access of size 3904 starts at ffff88812ea1e000 Data copied to user address 0000000020003280 CPU: 1 PID: 5043 Comm: syz-executor297 Not tainted 6.7.0-rc5-syzkaller-00047-g5bd7ef53ffe5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps") Reported-and-tested-by: syzbot+34ad5fab48f7bf510349(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=34ad5fab48f7bf510349 [1] Signed-off-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240221074053.1794118-1-ryasuoka@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netlink/af_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index e3f34dccc97a..b1e2d3fa522e 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -157,7 +157,7 @@ static inline u32 netlink_group_mask(u32 group) static struct sk_buff *netlink_to_full_skb(const struct sk_buff *skb, gfp_t gfp_mask) { - unsigned int len = skb_end_offset(skb); + unsigned int len = skb->len; struct sk_buff *new; new = alloc_skb(len, gfp_mask); -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
by Zhengchao Shao 14 Apr '24

14 Apr '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.210 commit 9489e214ea8f2a90345516016aa51f2db3a8cc2f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E49K CVE: CVE-2024-26808 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01acb2e8666a6529697141a6017edbf206921913 upstream. Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale reference to netdevice remains in the hook list. Fixes: 60a3815da702 ("netfilter: add inet ingress support") Cc: stable(a)vger.kernel.org Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nft_chain_filter.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c index 7a9aa57b195b..a18582a4ecf3 100644 --- a/net/netfilter/nft_chain_filter.c +++ b/net/netfilter/nft_chain_filter.c @@ -358,9 +358,10 @@ static int nf_tables_netdev_event(struct notifier_block *this, unsigned long event, void *ptr) { struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct nft_base_chain *basechain; struct nftables_pernet *nft_net; - struct nft_table *table; struct nft_chain *chain, *nr; + struct nft_table *table; struct nft_ctx ctx = { .net = dev_net(dev), }; @@ -372,7 +373,8 @@ static int nf_tables_netdev_event(struct notifier_block *this, nft_net = net_generic(ctx.net, nf_tables_net_id); mutex_lock(&nft_net->commit_mutex); list_for_each_entry(table, &nft_net->tables, list) { - if (table->family != NFPROTO_NETDEV) + if (table->family != NFPROTO_NETDEV && + table->family != NFPROTO_INET) continue; ctx.family = table->family; @@ -381,6 +383,11 @@ static int nf_tables_netdev_event(struct notifier_block *this, if (!nft_is_base_chain(chain)) continue; + basechain = nft_base_chain(chain); + if (table->family == NFPROTO_INET && + basechain->ops.hooknum != NF_INET_INGRESS) + continue; + ctx.chain = chain; nft_netdev_event(event, dev, &ctx); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 2211/22089] mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]'
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ab9b23cd7b3e05b3fc38df24e070593493e1d8e2 commit: 08c9196f65d268e1f8dccde138d4644c427bde76 [2211/22089] mm/swap: use nr_node_ids for avail_lists in swap_info_struct config: x86_64-randconfig-102-20240413 (https://download.01.org/0day-ci/archive/20240414/202404140751.A9FJ6Yan-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404140751.A9FJ6Yan-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404140751.A9FJ6Yan-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/swapfile.c: In function '__del_from_avail_list': mm/swapfile.c:615:17: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 615 | plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/swapfile.c:15: include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from arch/x86/include/asm/bug.h:83, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:9, from mm/swapfile.c:8: mm/swapfile.c: In function 'add_to_avail_list': mm/swapfile.c:648:43: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 648 | WARN_ON(!plist_node_empty(&p->avail_lists[nid])); | ^~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:122:32: note: in definition of macro 'WARN_ON' 122 | int __ret_warn_on = !!(condition); \ | ^~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/sched.h:19, from include/linux/ioprio.h:5, from include/linux/fs.h:39, from include/linux/huge_mm.h:8, from include/linux/mm.h:499: In function 'plist_node_empty', inlined from 'add_to_avail_list' at mm/swapfile.c:648:3: include/linux/plist.h:223:16: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 223 | return list_empty(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'add_to_avail_list': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c: In function '_enable_swap_info': mm/swapfile.c:2460:47: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2460 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2458:47: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2458 | p->avail_lists[i].prio = 1; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2455:39: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2455 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c: In function 'alloc_swap_info': mm/swapfile.c:2860:17: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2860:48: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3: include/linux/plist.h:137:9: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 137 | INIT_LIST_HEAD(&node->prio_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'alloc_swap_info': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3: include/linux/plist.h:138:9: warning: array subscript i is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 138 | INIT_LIST_HEAD(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'alloc_swap_info': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/asm-generic/bug.h:18: mm/swapfile.c: In function 'get_swap_pages': >> mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:582:21: note: in expansion of macro 'list_next_entry' 582 | n = list_next_entry(pos, member); \ | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/preempt.h:11, from include/linux/spinlock.h:51, from include/linux/mmzone.h:8, from include/linux/gfp.h:6, from include/linux/mm.h:10: >> include/linux/list.h:583:14: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 583 | &pos->member != (head); \ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:972:17: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 972 | plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:1016:38: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 1016 | if (plist_node_empty(&next->avail_lists[node])) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_empty', inlined from 'get_swap_pages' at mm/swapfile.c:1016:7: >> include/linux/plist.h:223:16: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 223 | return list_empty(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'get_swap_pages': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ >> mm/swapfile.c:970:81: warning: array subscript pfo_ret__ is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:584:27: note: in expansion of macro 'list_next_entry' 584 | pos = n, n = list_next_entry(n, member)) | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2576:52: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2576 | if (si->avail_lists[nid].prio != 1) | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2577:56: warning: array subscript nid is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2577 | si->avail_lists[nid].prio--; | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.o: warning: objtool: __swap_info_get()+0x97: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: _swap_info_get()+0xe4: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: __swap_duplicate()+0x92: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: unuse_vma()+0xfe: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: get_swap_pages()+0x55: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: setup_swap_map_and_extents()+0x641: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: read_swap_header()+0x196: sibling call from callable instruction with modified stack frame mm/swapfile.o: warning: objtool: __se_sys_swapon()+0x6cb: sibling call from callable instruction with modified stack frame vim +970 mm/swapfile.c ^1da177e4c3f41 Linus Torvalds 2005-04-16 942 5d5e8f19544a35 Huang Ying 2018-08-21 943 int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size) ^1da177e4c3f41 Linus Torvalds 2005-04-16 944 { 5d5e8f19544a35 Huang Ying 2018-08-21 945 unsigned long size = swap_entry_size(entry_size); adfab836f4908d Dan Streetman 2014-06-04 946 struct swap_info_struct *si, *next; 36005bae205da3 Tim Chen 2017-02-22 947 long avail_pgs; 36005bae205da3 Tim Chen 2017-02-22 948 int n_ret = 0; a2468cc9bfdff6 Aaron Lu 2017-09-06 949 int node; ^1da177e4c3f41 Linus Torvalds 2005-04-16 950 38d8b4e6bdc872 Huang Ying 2017-07-06 951 /* Only single cluster request supported */ 5d5e8f19544a35 Huang Ying 2018-08-21 952 WARN_ON_ONCE(n_goal > 1 && size == SWAPFILE_CLUSTER); 38d8b4e6bdc872 Huang Ying 2017-07-06 953 5d5e8f19544a35 Huang Ying 2018-08-21 954 avail_pgs = atomic_long_read(&nr_swap_pages) / size; 36005bae205da3 Tim Chen 2017-02-22 955 if (avail_pgs <= 0) fb4f88dcabdc71 Hugh Dickins 2005-09-03 956 goto noswap; 36005bae205da3 Tim Chen 2017-02-22 957 36005bae205da3 Tim Chen 2017-02-22 958 if (n_goal > SWAP_BATCH) 36005bae205da3 Tim Chen 2017-02-22 959 n_goal = SWAP_BATCH; 36005bae205da3 Tim Chen 2017-02-22 960 36005bae205da3 Tim Chen 2017-02-22 961 if (n_goal > avail_pgs) 36005bae205da3 Tim Chen 2017-02-22 962 n_goal = avail_pgs; 36005bae205da3 Tim Chen 2017-02-22 963 5d5e8f19544a35 Huang Ying 2018-08-21 964 atomic_long_sub(n_goal * size, &nr_swap_pages); ^1da177e4c3f41 Linus Torvalds 2005-04-16 965 18ab4d4ced0817 Dan Streetman 2014-06-04 966 spin_lock(&swap_avail_lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 967 18ab4d4ced0817 Dan Streetman 2014-06-04 968 start_over: a2468cc9bfdff6 Aaron Lu 2017-09-06 969 node = numa_node_id(); a2468cc9bfdff6 Aaron Lu 2017-09-06 @970 plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { 18ab4d4ced0817 Dan Streetman 2014-06-04 971 /* requeue si to after same-priority siblings */ a2468cc9bfdff6 Aaron Lu 2017-09-06 972 plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); 18ab4d4ced0817 Dan Streetman 2014-06-04 973 spin_unlock(&swap_avail_lock); ec8acf20afb853 Shaohua Li 2013-02-22 974 spin_lock(&si->lock); adfab836f4908d Dan Streetman 2014-06-04 975 if (!si->highest_bit || !(si->flags & SWP_WRITEOK)) { 18ab4d4ced0817 Dan Streetman 2014-06-04 976 spin_lock(&swap_avail_lock); a2468cc9bfdff6 Aaron Lu 2017-09-06 977 if (plist_node_empty(&si->avail_lists[node])) { ec8acf20afb853 Shaohua Li 2013-02-22 978 spin_unlock(&si->lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 979 goto nextsi; 18ab4d4ced0817 Dan Streetman 2014-06-04 980 } 18ab4d4ced0817 Dan Streetman 2014-06-04 981 WARN(!si->highest_bit, 18ab4d4ced0817 Dan Streetman 2014-06-04 982 "swap_info %d in list but !highest_bit\n", 18ab4d4ced0817 Dan Streetman 2014-06-04 983 si->type); 18ab4d4ced0817 Dan Streetman 2014-06-04 984 WARN(!(si->flags & SWP_WRITEOK), 18ab4d4ced0817 Dan Streetman 2014-06-04 985 "swap_info %d in list but !SWP_WRITEOK\n", 18ab4d4ced0817 Dan Streetman 2014-06-04 986 si->type); a2468cc9bfdff6 Aaron Lu 2017-09-06 987 __del_from_avail_list(si); 18ab4d4ced0817 Dan Streetman 2014-06-04 988 spin_unlock(&si->lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 989 goto nextsi; adfab836f4908d Dan Streetman 2014-06-04 990 } 5d5e8f19544a35 Huang Ying 2018-08-21 991 if (size == SWAPFILE_CLUSTER) { f0eea189e8e969 Huang Ying 2017-09-06 992 if (!(si->flags & SWP_FILE)) 38d8b4e6bdc872 Huang Ying 2017-07-06 993 n_ret = swap_alloc_cluster(si, swp_entries); f0eea189e8e969 Huang Ying 2017-09-06 994 } else 36005bae205da3 Tim Chen 2017-02-22 995 n_ret = scan_swap_map_slots(si, SWAP_HAS_CACHE, 36005bae205da3 Tim Chen 2017-02-22 996 n_goal, swp_entries); ec8acf20afb853 Shaohua Li 2013-02-22 997 spin_unlock(&si->lock); 5d5e8f19544a35 Huang Ying 2018-08-21 998 if (n_ret || size == SWAPFILE_CLUSTER) 36005bae205da3 Tim Chen 2017-02-22 999 goto check_out; 18ab4d4ced0817 Dan Streetman 2014-06-04 1000 pr_debug("scan_swap_map of si %d failed to find offset\n", 18ab4d4ced0817 Dan Streetman 2014-06-04 1001 si->type); 36005bae205da3 Tim Chen 2017-02-22 1002 18ab4d4ced0817 Dan Streetman 2014-06-04 1003 spin_lock(&swap_avail_lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 1004 nextsi: adfab836f4908d Dan Streetman 2014-06-04 1005 /* adfab836f4908d Dan Streetman 2014-06-04 1006 * if we got here, it's likely that si was almost full before, adfab836f4908d Dan Streetman 2014-06-04 1007 * and since scan_swap_map() can drop the si->lock, multiple adfab836f4908d Dan Streetman 2014-06-04 1008 * callers probably all tried to get a page from the same si 18ab4d4ced0817 Dan Streetman 2014-06-04 1009 * and it filled up before we could get one; or, the si filled 18ab4d4ced0817 Dan Streetman 2014-06-04 1010 * up between us dropping swap_avail_lock and taking si->lock. 18ab4d4ced0817 Dan Streetman 2014-06-04 1011 * Since we dropped the swap_avail_lock, the swap_avail_head 18ab4d4ced0817 Dan Streetman 2014-06-04 1012 * list may have been modified; so if next is still in the 36005bae205da3 Tim Chen 2017-02-22 1013 * swap_avail_head list then try it, otherwise start over 36005bae205da3 Tim Chen 2017-02-22 1014 * if we have not gotten any slots. adfab836f4908d Dan Streetman 2014-06-04 1015 */ a2468cc9bfdff6 Aaron Lu 2017-09-06 1016 if (plist_node_empty(&next->avail_lists[node])) 18ab4d4ced0817 Dan Streetman 2014-06-04 1017 goto start_over; ^1da177e4c3f41 Linus Torvalds 2005-04-16 1018 } fb4f88dcabdc71 Hugh Dickins 2005-09-03 1019 18ab4d4ced0817 Dan Streetman 2014-06-04 1020 spin_unlock(&swap_avail_lock); 18ab4d4ced0817 Dan Streetman 2014-06-04 1021 36005bae205da3 Tim Chen 2017-02-22 1022 check_out: 36005bae205da3 Tim Chen 2017-02-22 1023 if (n_ret < n_goal) 5d5e8f19544a35 Huang Ying 2018-08-21 1024 atomic_long_add((long)(n_goal - n_ret) * size, 38d8b4e6bdc872 Huang Ying 2017-07-06 1025 &nr_swap_pages); fb4f88dcabdc71 Hugh Dickins 2005-09-03 1026 noswap: 36005bae205da3 Tim Chen 2017-02-22 1027 return n_ret; 36005bae205da3 Tim Chen 2017-02-22 1028 } 36005bae205da3 Tim Chen 2017-02-22 1029 :::::: The code at line 970 was first introduced by commit :::::: a2468cc9bfdff6139f59ca896671e5819ff5f94a swap: choose swap device according to numa node :::::: TO: Aaron Lu <aaron.lu(a)intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 6341/30000] drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 14 Apr '24

14 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4134526a9cfd552230ec7a66a1738a9066d9a0c6 commit: a5b9149cc6ef0e581c7289b01bf2bf3c2ad98248 [6341/30000] Huawei BMA: Adding Huawei BMA driver: host_kbox_drv config: x86_64-randconfig-122-20240413 (https://download.01.org/0day-ci/archive/20240414/202404140648.3413VbmQ-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240414/202404140648.3413VbmQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404140648.3413VbmQ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:42:6: sparse: sparse: symbol 'kbox_write_to_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:120:27: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:111:6: sparse: sparse: symbol 'kbox_read_from_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:179:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:172:6: sparse: sparse: symbol 'kbox_memset_pci' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char *user_buf @@ got char [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: expected char *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: got char [noderef] __user *data >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got char *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: got char *user_buf >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const *user_buf @@ got char const [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: expected char const *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: got char const [noderef] __user *data >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got char const *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: got char const *user_buf vim +/__iomem +51 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c 41 42 void kbox_write_to_pci(void __iomem *dest, const void *src, int len, 43 unsigned long offset) 44 { 45 union char_int_transfer_u transfer = { }; 46 int idx = 0; 47 int j = 0; 48 int four_byte_len = 0; 49 int left_len = 0; 50 char *src_temp = (char *)src; > 51 char *dest_temp = (char *)dest; 52 int first_write_num = 0; 53 54 if ((offset % KBOX_RW_UNIT) != 0) { 55 transfer.data_int = 56 *(int *)(dest_temp + offset - (offset % KBOX_RW_UNIT)); 57 58 rmb();/* memory barriers. */ 59 first_write_num = 60 ((len + (offset % KBOX_RW_UNIT)) > 61 KBOX_RW_UNIT) ? (KBOX_RW_UNIT - 62 (offset % KBOX_RW_UNIT)) : len; 63 for (idx = (int)(offset % KBOX_RW_UNIT); 64 idx < (int)(first_write_num + (offset % KBOX_RW_UNIT)); 65 idx++) { 66 if (!src_temp) 67 return; 68 69 transfer.data_char[idx] = *src_temp; 70 src_temp++; 71 } 72 *(int *)(dest_temp + offset - (offset % KBOX_RW_UNIT)) = 73 transfer.data_int; 74 wmb();/* memory barriers. */ 75 len -= first_write_num; 76 offset += first_write_num; 77 } 78 79 four_byte_len = (len / KBOX_RW_UNIT); 80 left_len = (len % KBOX_RW_UNIT); 81 for (idx = 0; idx < four_byte_len; idx++) { 82 for (j = 0; j < KBOX_RW_UNIT; j++) { 83 if (!src_temp) 84 return; 85 86 transfer.data_char[j] = *src_temp; 87 src_temp++; 88 } 89 *(int *)(dest_temp + offset) = transfer.data_int; 90 wmb();/* memory barriers. */ 91 offset += KBOX_RW_UNIT; 92 } 93 94 if (left_len != 0) { 95 transfer.data_int = *(int *)(dest_temp + offset); 96 rmb();/* memory barriers. */ 97 for (idx = 0; idx < left_len; idx++) { 98 if (!src_temp) 99 return; 100 101 transfer.data_char[idx] = *src_temp; 102 src_temp++; 103 } 104 *(int *)(dest_temp + offset) = transfer.data_int; 105 wmb();/* memory barriers. */ 106 } 107 108 udelay(1); 109 } 110 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0