- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1359/1359] drivers/mailbox/phytium_mailbox.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 11 Jan '25

11 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: 1ae9436b02e93f1f2b9cfc10226812197fbfcd04 [1359/1359] mailbox: add phytium mailbox driver config: x86_64-buildonly-randconfig-003-20241231 (https://download.01.org/0day-ci/archive/20250111/202501110053.tHD92bDr-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250111/202501110053.tHD92bDr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501110053.tHD92bDr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/mailbox/phytium_mailbox.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2697/2697] kernel/sched/topology.o: warning: objtool: asym_cpu_capacity_scan()+0x3fb: unreachable instruction
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6aa478cf2617c987fcc37cdc8281a4cd310d86d9 commit: bf98f63d069c5ce91efe999b23f8a399e5e606cc [2697/2697] sched/topology: Rework CPU capacity asymmetry detection config: x86_64-buildonly-randconfig-003-20250110 (https://download.01.org/0day-ci/archive/20250110/202501102347.RosSdNKM-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501102347.RosSdNKM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501102347.RosSdNKM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/sched/topology.o: warning: objtool: asym_cpu_capacity_scan()+0x3fb: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2697/2697] kernel/dma/map_benchmark.o: warning: objtool: map_benchmark_thread()+0x2a1: unreachable instruction
by kernel test robot 10 Jan '25

10 Jan '25

Hi Barry, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6aa478cf2617c987fcc37cdc8281a4cd310d86d9 commit: a61bf6dd77b6030e05a0caf5cd18ec98f5499d9a [2697/2697] dma-mapping: add benchmark support for streaming DMA APIs config: x86_64-buildonly-randconfig-003-20250110 (https://download.01.org/0day-ci/archive/20250110/202501102124.mb3xJ7Vt-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501102124.mb3xJ7Vt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501102124.mb3xJ7Vt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/dma/map_benchmark.o: warning: objtool: map_benchmark_thread()+0x2a1: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2668/2668] fs/cachefiles/xattr.c:37:29: sparse: sparse: symbol 'new_vol_xattr' was not declared. Should it be static?
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6aa478cf2617c987fcc37cdc8281a4cd310d86d9 commit: 62cbbf255badab153207e0a54d04da8c345ae307 [2668/2668] cachefiles: use mainline xattr in ondemand mode config: x86_64-randconfig-121-20250108 (https://download.01.org/0day-ci/archive/20250110/202501101951.YVQo0Jjv-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501101951.YVQo0Jjv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501101951.YVQo0Jjv-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/cachefiles/xattr.c:37:29: sparse: sparse: symbol 'new_vol_xattr' was not declared. Should it be static? >> fs/cachefiles/xattr.c:221:5: sparse: sparse: symbol 'cachefiles_check_old_object_xattr' was not declared. Should it be static? vim +/new_vol_xattr +37 fs/cachefiles/xattr.c 36 > 37 struct cachefiles_vol_xattr new_vol_xattr; 38 39 static int cachefiles_set_new_vol_xattr(struct cachefiles_object *object); 40 static int cachefiles_check_new_vol_xattr(struct cachefiles_object *object); 41 static int cachefiles_set_new_obj_xattr(struct cachefiles_object *object); 42 static int cachefiles_check_new_obj_xattr(struct cachefiles_object *object); 43 44 /* 45 * check the type label on an object 46 * - done using xattrs 47 */ 48 int cachefiles_check_object_type(struct cachefiles_object *object) 49 { 50 struct dentry *dentry = object->dentry; 51 char type[3], xtype[3]; 52 int ret; 53 54 ASSERT(dentry); 55 ASSERT(d_backing_inode(dentry)); 56 57 if (!object->fscache.cookie) 58 strcpy(type, "C3"); 59 else 60 snprintf(type, 3, "%02x", object->fscache.cookie->def->type); 61 62 _enter("%p{%s}", object, type); 63 64 /* attempt to install a type label directly */ 65 ret = vfs_setxattr(dentry, cachefiles_xattr_cache, type, 2, 66 XATTR_CREATE); 67 if (ret == 0) { 68 _debug("SET"); /* we succeeded */ 69 goto error; 70 } 71 72 if (ret != -EEXIST) { 73 pr_err("Can't set xattr on %pd [%lu] (err %d)\n", 74 dentry, d_backing_inode(dentry)->i_ino, 75 -ret); 76 goto error; 77 } 78 79 /* read the current type label */ 80 ret = vfs_getxattr(dentry, cachefiles_xattr_cache, xtype, 3); 81 if (ret < 0) { 82 if (ret == -ERANGE) 83 goto bad_type_length; 84 85 pr_err("Can't read xattr on %pd [%lu] (err %d)\n", 86 dentry, d_backing_inode(dentry)->i_ino, 87 -ret); 88 goto error; 89 } 90 91 /* check the type is what we're expecting */ 92 if (ret != 2) 93 goto bad_type_length; 94 95 if (xtype[0] != type[0] || xtype[1] != type[1]) 96 goto bad_type; 97 98 ret = 0; 99 100 error: 101 _leave(" = %d", ret); 102 return ret; 103 104 bad_type_length: 105 pr_err("Cache object %lu type xattr length incorrect\n", 106 d_backing_inode(dentry)->i_ino); 107 ret = -EIO; 108 goto error; 109 110 bad_type: 111 xtype[2] = 0; 112 pr_err("Cache object %pd [%lu] type %s not %s\n", 113 dentry, d_backing_inode(dentry)->i_ino, 114 xtype, type); 115 ret = -EIO; 116 goto error; 117 } 118 119 /* 120 * set the state xattr on a cache file 121 */ 122 int cachefiles_set_object_xattr(struct cachefiles_object *object, 123 struct cachefiles_xattr *auxdata) 124 { 125 struct dentry *dentry = object->dentry; 126 int ret; 127 128 ASSERT(dentry); 129 130 _enter("%p,#%d", object, auxdata->len); 131 132 /* attempt to install the cache metadata directly */ 133 _debug("SET #%u", auxdata->len); 134 135 clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags); 136 if (data_new_version(object->fscache.cookie)) 137 ret = cachefiles_set_new_obj_xattr(object); 138 else if (volume_new_version(object->fscache.cookie)) 139 ret = cachefiles_set_new_vol_xattr(object); 140 else 141 ret = vfs_setxattr(dentry, cachefiles_xattr_cache, 142 &auxdata->type, auxdata->len, 143 XATTR_CREATE); 144 if (ret < 0 && ret != -ENOMEM) 145 cachefiles_io_error_obj( 146 object, 147 "Failed to set xattr with error %d", ret); 148 149 _leave(" = %d", ret); 150 return ret; 151 } 152 153 /* 154 * update the state xattr on a cache file 155 */ 156 int cachefiles_update_object_xattr(struct cachefiles_object *object, 157 struct cachefiles_xattr *auxdata) 158 { 159 struct dentry *dentry = object->dentry; 160 int ret; 161 162 if (!dentry) 163 return -ESTALE; 164 165 _enter("%p,#%d", object, auxdata->len); 166 167 /* attempt to install the cache metadata directly */ 168 _debug("SET #%u", auxdata->len); 169 170 clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags); 171 ret = vfs_setxattr(dentry, cachefiles_xattr_cache, 172 &auxdata->type, auxdata->len, 173 XATTR_REPLACE); 174 if (ret < 0 && ret != -ENOMEM) 175 cachefiles_io_error_obj( 176 object, 177 "Failed to update xattr with error %d", ret); 178 179 _leave(" = %d", ret); 180 return ret; 181 } 182 183 /* 184 * check the consistency between the backing cache and the FS-Cache cookie 185 */ 186 int cachefiles_check_auxdata(struct cachefiles_object *object) 187 { 188 struct cachefiles_xattr *auxbuf; 189 enum fscache_checkaux validity; 190 struct dentry *dentry = object->dentry; 191 ssize_t xlen; 192 int ret; 193 194 ASSERT(dentry); 195 ASSERT(d_backing_inode(dentry)); 196 ASSERT(object->fscache.cookie->def->check_aux); 197 198 auxbuf = kmalloc(sizeof(struct cachefiles_xattr) + 512, GFP_KERNEL); 199 if (!auxbuf) 200 return -ENOMEM; 201 202 xlen = vfs_getxattr(dentry, cachefiles_xattr_cache, 203 &auxbuf->type, 512 + 1); 204 ret = -ESTALE; 205 if (xlen < 1 || 206 auxbuf->type != object->fscache.cookie->def->type) 207 goto error; 208 209 xlen--; 210 validity = fscache_check_aux(&object->fscache, &auxbuf->data, xlen, 211 i_size_read(d_backing_inode(dentry))); 212 if (validity != FSCACHE_CHECKAUX_OKAY) 213 goto error; 214 215 ret = 0; 216 error: 217 kfree(auxbuf); 218 return ret; 219 } 220 > 221 int cachefiles_check_old_object_xattr(struct cachefiles_object *object, 222 struct cachefiles_xattr *auxdata) 223 { 224 struct cachefiles_xattr *auxbuf; 225 unsigned int len = sizeof(struct cachefiles_xattr) + 512; 226 struct dentry *dentry = object->dentry; 227 int ret; 228 229 auxbuf = kmalloc(len, cachefiles_gfp); 230 if (!auxbuf) 231 return -ENOMEM; 232 233 /* read the current type label */ 234 ret = vfs_getxattr(dentry, cachefiles_xattr_cache, 235 &auxbuf->type, 512 + 1); 236 if (ret < 0) 237 goto error; 238 239 /* check the on-disk object */ 240 if (ret < 1) { 241 pr_err("Cache object %lu xattr length incorrect\n", 242 d_backing_inode(dentry)->i_ino); 243 goto stale; 244 } 245 246 if (auxbuf->type != auxdata->type) 247 goto stale; 248 249 auxbuf->len = ret; 250 251 /* consult the netfs */ 252 if (object->fscache.cookie->def->check_aux) { 253 enum fscache_checkaux result; 254 unsigned int dlen; 255 256 dlen = auxbuf->len - 1; 257 258 _debug("checkaux %s #%u", 259 object->fscache.cookie->def->name, dlen); 260 261 result = fscache_check_aux(&object->fscache, 262 &auxbuf->data, dlen, 263 i_size_read(d_backing_inode(dentry))); 264 265 switch (result) { 266 /* entry okay as is */ 267 case FSCACHE_CHECKAUX_OKAY: 268 goto okay; 269 270 /* entry requires update */ 271 case FSCACHE_CHECKAUX_NEEDS_UPDATE: 272 break; 273 274 /* entry requires deletion */ 275 case FSCACHE_CHECKAUX_OBSOLETE: 276 goto stale; 277 278 default: 279 BUG(); 280 } 281 282 /* update the current label */ 283 ret = vfs_setxattr(dentry, cachefiles_xattr_cache, 284 &auxdata->type, auxdata->len, 285 XATTR_REPLACE); 286 if (ret < 0) { 287 cachefiles_io_error_obj(object, 288 "Can't update xattr on %lu" 289 " (error %d)", 290 d_backing_inode(dentry)->i_ino, -ret); 291 goto error; 292 } 293 } 294 295 okay: 296 ret = 0; 297 298 error: 299 kfree(auxbuf); 300 return ret; 301 302 stale: 303 ret = -ESTALE; 304 goto error; 305 } 306 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1817/1817] drivers/irqchip/irq-loongson-eiointc.c:199:13: warning: unused variable 'cores'
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 628e30bc9a3c48a6ab38868cb77fc6497d6ebaa5 commit: c0d9a87efd7845c763e936a5bd9c482c62f8ceb4 [1817/1817] LoongArch: eiointc: fix ext irq route error config: loongarch-randconfig-001-20250110 (https://download.01.org/0day-ci/archive/20250110/202501101806.25f5zC4M-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501101806.25f5zC4M-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501101806.25f5zC4M-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/irqchip/irq-loongson-eiointc.c: In function 'eiointc_router_init': >> drivers/irqchip/irq-loongson-eiointc.c:199:13: warning: unused variable 'cores' [-Wunused-variable] 199 | int cores = (cpu_has_hypervisor ? MAX_CORES_PER_EIO_NODE : CORES_PER_EIO_NODE); | ^~~~~ drivers/irqchip/irq-loongson-eiointc.c: At top level: drivers/irqchip/irq-loongson-eiointc.c:380:12: warning: no previous prototype for 'pch_pic_parse_madt' [-Wmissing-prototypes] 380 | int __init pch_pic_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:393:12: warning: no previous prototype for 'pch_msi_parse_madt' [-Wmissing-prototypes] 393 | int __init pch_msi_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c: In function 'pch_msi_parse_madt': drivers/irqchip/irq-loongson-eiointc.c:401:58: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 401 | node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:401:58: note: each undeclared identifier is reported only once for each function it appears in drivers/irqchip/irq-loongson-eiointc.c: In function 'eiointc_acpi_init': drivers/irqchip/irq-loongson-eiointc.c:507:45: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 507 | node = acpi_eiointc->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ vim +/cores +199 drivers/irqchip/irq-loongson-eiointc.c dd281e1a1a937e Huacai Chen 2022-07-20 192 dd281e1a1a937e Huacai Chen 2022-07-20 193 static int eiointc_router_init(unsigned int cpu) dd281e1a1a937e Huacai Chen 2022-07-20 194 { dd281e1a1a937e Huacai Chen 2022-07-20 195 int i, bit; dd281e1a1a937e Huacai Chen 2022-07-20 196 uint32_t data; dd281e1a1a937e Huacai Chen 2022-07-20 197 uint32_t node = cpu_to_eio_node(cpu); 2e99b73afde188 Bibo Mao 2023-08-11 198 int index = eiointc_index(node); 6379cda0d97b5b liuyun 2023-12-02 @199 int cores = (cpu_has_hypervisor ? MAX_CORES_PER_EIO_NODE : CORES_PER_EIO_NODE); dd281e1a1a937e Huacai Chen 2022-07-20 200 dd281e1a1a937e Huacai Chen 2022-07-20 201 if (index < 0) { dd281e1a1a937e Huacai Chen 2022-07-20 202 pr_err("Error: invalid nodemap!\n"); dd281e1a1a937e Huacai Chen 2022-07-20 203 return -1; dd281e1a1a937e Huacai Chen 2022-07-20 204 } dd281e1a1a937e Huacai Chen 2022-07-20 205 c0d9a87efd7845 wanghongliang 2025-01-07 206 if (!test_bit(node, (&extioi_node_maps)->bits)) { dd281e1a1a937e Huacai Chen 2022-07-20 207 eiointc_enable(); dd281e1a1a937e Huacai Chen 2022-07-20 208 a3f1132c4c6be3 Binbin Zhou 2023-05-05 209 for (i = 0; i < eiointc_priv[0]->vec_count / 32; i++) { dd281e1a1a937e Huacai Chen 2022-07-20 210 data = (((1 << (i * 2 + 1)) << 16) | (1 << (i * 2))); dd281e1a1a937e Huacai Chen 2022-07-20 211 iocsr_write32(data, EIOINTC_REG_NODEMAP + i * 4); dd281e1a1a937e Huacai Chen 2022-07-20 212 } dd281e1a1a937e Huacai Chen 2022-07-20 213 a3f1132c4c6be3 Binbin Zhou 2023-05-05 214 for (i = 0; i < eiointc_priv[0]->vec_count / 32 / 4; i++) { dd281e1a1a937e Huacai Chen 2022-07-20 215 bit = BIT(1 + index); /* Route to IP[1 + index] */ dd281e1a1a937e Huacai Chen 2022-07-20 216 data = bit | (bit << 8) | (bit << 16) | (bit << 24); dd281e1a1a937e Huacai Chen 2022-07-20 217 iocsr_write32(data, EIOINTC_REG_IPMAP + i * 4); dd281e1a1a937e Huacai Chen 2022-07-20 218 } dd281e1a1a937e Huacai Chen 2022-07-20 219 a3f1132c4c6be3 Binbin Zhou 2023-05-05 220 for (i = 0; i < eiointc_priv[0]->vec_count / 4; i++) { dd281e1a1a937e Huacai Chen 2022-07-20 221 /* Route to Node-0 Core-0 */ 5d97cff72f91f4 Bibo Mao 2024-03-13 222 if (eiointc_priv[index]->cpu_encoded) 5d97cff72f91f4 Bibo Mao 2024-03-13 223 bit = cpu_logical_map(0); 5d97cff72f91f4 Bibo Mao 2024-03-13 224 else if (index == 0) 5d97cff72f91f4 Bibo Mao 2024-03-13 225 bit = BIT(cpu_logical_map(0)); dd281e1a1a937e Huacai Chen 2022-07-20 226 else c0d9a87efd7845 wanghongliang 2025-01-07 227 bit = (eiointc_priv[index]->node << 4) | c0d9a87efd7845 wanghongliang 2025-01-07 228 BIT(cpu_logical_map(smp_processor_id()) % c0d9a87efd7845 wanghongliang 2025-01-07 229 CORES_PER_EIO_NODE); dd281e1a1a937e Huacai Chen 2022-07-20 230 dd281e1a1a937e Huacai Chen 2022-07-20 231 data = bit | (bit << 8) | (bit << 16) | (bit << 24); dd281e1a1a937e Huacai Chen 2022-07-20 232 iocsr_write32(data, EIOINTC_REG_ROUTE + i * 4); dd281e1a1a937e Huacai Chen 2022-07-20 233 } dd281e1a1a937e Huacai Chen 2022-07-20 234 a3f1132c4c6be3 Binbin Zhou 2023-05-05 235 for (i = 0; i < eiointc_priv[0]->vec_count / 32; i++) { dd281e1a1a937e Huacai Chen 2022-07-20 236 data = 0xffffffff; dd281e1a1a937e Huacai Chen 2022-07-20 237 iocsr_write32(data, EIOINTC_REG_ENABLE + i * 4); c0d9a87efd7845 wanghongliang 2025-01-07 238 iocsr_write32(0, EIOINTC_REG_BOUNCE + i * 4); dd281e1a1a937e Huacai Chen 2022-07-20 239 } c0d9a87efd7845 wanghongliang 2025-01-07 240 c0d9a87efd7845 wanghongliang 2025-01-07 241 set_bit(node, (&extioi_node_maps)->bits); dd281e1a1a937e Huacai Chen 2022-07-20 242 } dd281e1a1a937e Huacai Chen 2022-07-20 243 dd281e1a1a937e Huacai Chen 2022-07-20 244 return 0; dd281e1a1a937e Huacai Chen 2022-07-20 245 } dd281e1a1a937e Huacai Chen 2022-07-20 246 :::::: The code at line 199 was first introduced by commit :::::: 6379cda0d97b5b38da0c1599b57ab764fb307cc2 LoongArch: Fix virtual machine startup error :::::: TO: liuyun <liuyun(a)loongson.cn> :::::: CC: Hongchen Zhang <zhanghongchen(a)loongson.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
by Heyuan Wang 10 Jan '25

10 Jan '25

From: Suraj Sonawane <surajsonawane0215(a)gmail.com> mainline inclusion from mainline-v6.13-rc3 commit 265e98f72bac6c41a4492d3e30a8e5fd22fe0779 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMX CVE: CVE-2024-56662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459 The issue occurs in cmd_to_func when the call_pkg->nd_reserved2 array is accessed without verifying that call_pkg points to a buffer that is appropriately sized as a struct nd_cmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space. To address this, a check was added in acpi_nfit_ctl() to ensure that buf is not NULL and that buf_len is less than sizeof(*call_pkg) before accessing it. This ensures safe access to the members of call_pkg, including the nd_reserved2 array. Reported-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7534f060ebda6b8b51b3 Tested-by: syzbot+7534f060ebda6b8b51b3(a)syzkaller.appspotmail.com Fixes: ebe9f6f19d80 ("acpi/nfit: Fix bus command validation") Signed-off-by: Suraj Sonawane <surajsonawane0215(a)gmail.com> Reviewed-by: Alison Schofield <alison.schofield(a)intel.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://patch.msgid.link/20241118162609.29063-1-surajsonawane0215@gmail.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Conflicts: drivers/acpi/nfit/core.c [ Miss commit 6450ddbd5d8e ] Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/nfit/core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c index 77ed2f255146..e94f3d94c0b2 100644 --- a/drivers/acpi/nfit/core.c +++ b/drivers/acpi/nfit/core.c @@ -440,8 +440,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm, if (cmd_rc) *cmd_rc = -EINVAL; - if (cmd == ND_CMD_CALL) + if (cmd == ND_CMD_CALL) { + if (!buf || buf_len < sizeof(*call_pkg)) + return -EINVAL; + call_pkg = buf; + } + func = cmd_to_func(nfit_mem, cmd, call_pkg); if (func < 0) return func; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1359/1359] drivers/scsi/spraid/spraid_main.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 10 Jan '25

10 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: bb9f019c483389f48183be55d92dbb21769fa55a [1359/1359] scsi:spraid: support Ramaxel's spraid driver config: x86_64-buildonly-randconfig-003-20241231 (https://download.01.org/0day-ci/archive/20250110/202501101652.3vzOXHJz-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250110/202501101652.3vzOXHJz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501101652.3vzOXHJz-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/scsi/spraid/spraid_main.c:25: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> drivers/scsi/spraid/spraid_main.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] bpf: Call free_htab_elem() after htab_unlock_bucket()
by Xiaomeng Zhang 10 Jan '25

10 Jan '25

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit b9e9ed90b10c82a4e9d4d70a2890f06bfcdd3b78 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANW CVE: CVE-2024-56592 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- For htab of maps, when the map is removed from the htab, it may hold the last reference of the map. bpf_map_fd_put_ptr() will invoke bpf_map_free_id() to free the id of the removed map element. However, bpf_map_fd_put_ptr() is invoked while holding a bucket lock (raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock (spinlock_t), triggering the following lockdep warning: ============================= [ BUG: Invalid wait context ] 6.11.0-rc4+ #49 Not tainted ----------------------------- test_maps/4881 is trying to lock: ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70 other info that might help us debug this: context-{5:5} 2 locks held by test_maps/4881: #0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270 #1: ffff888149ced148 (&htab->lockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80 stack backtrace: CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... Call Trace: <TASK> dump_stack_lvl+0x6e/0xb0 dump_stack+0x10/0x20 __lock_acquire+0x73e/0x36c0 lock_acquire+0x182/0x450 _raw_spin_lock_irqsave+0x43/0x70 bpf_map_free_id.part.0+0x21/0x70 bpf_map_put+0xcf/0x110 bpf_map_fd_put_ptr+0x9a/0xb0 free_htab_elem+0x69/0xe0 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 bpf_map_update_value+0x266/0x380 __sys_bpf+0x21bb/0x36b0 __x64_sys_bpf+0x45/0x60 x64_sys_call+0x1b2a/0x20d0 do_syscall_64+0x5d/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e One way to fix the lockdep warning is using raw_spinlock_t for map_idr_lock as well. However, bpf_map_alloc_id() invokes idr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a similar lockdep warning because the slab's lock (s->cpu_slab->lock) is still a spinlock. Instead of changing map_idr_lock's type, fix the issue by invoking htab_put_fd_value() after htab_unlock_bucket(). However, only deferring the invocation of htab_put_fd_value() is not enough, because the old map pointers in htab of maps can not be saved during batched deletion. Therefore, also defer the invocation of free_htab_elem(), so these to-be-freed elements could be linked together similar to lru map. There are four callers for ->map_fd_put_ptr: (1) alloc_htab_elem() (through htab_put_fd_value()) It invokes ->map_fd_put_ptr() under a raw_spinlock_t. The invocation of htab_put_fd_value() can not simply move after htab_unlock_bucket(), because the old element has already been stashed in htab->extra_elems. It may be reused immediately after htab_unlock_bucket() and the invocation of htab_put_fd_value() after htab_unlock_bucket() may release the newly-added element incorrectly. Therefore, saving the map pointer of the old element for htab of maps before unlocking the bucket and releasing the map_ptr after unlock. Beside the map pointer in the old element, should do the same thing for the special fields in the old element as well. (2) free_htab_elem() (through htab_put_fd_value()) Its caller includes __htab_map_lookup_and_delete_elem(), htab_map_delete_elem() and __htab_map_lookup_and_delete_batch(). For htab_map_delete_elem(), simply invoke free_htab_elem() after htab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just like lru map, linking the to-be-freed element into node_to_free list and invoking free_htab_elem() for these element after unlock. It is safe to reuse batch_flink as the link for node_to_free, because these elements have been removed from the hash llist. Because htab of maps doesn't support lookup_and_delete operation, __htab_map_lookup_and_delete_elem() doesn't have the problem, so kept it as is. (3) fd_htab_map_free() It invokes ->map_fd_put_ptr without raw_spinlock_t. (4) bpf_fd_htab_map_update_elem() It invokes ->map_fd_put_ptr without raw_spinlock_t. After moving free_htab_elem() outside htab bucket lock scope, using pcpu_freelist_push() instead of __pcpu_freelist_push() to disable the irq before freeing elements, and protecting the invocations of bpf_mem_cache_free() with migrate_{disable|enable} pair. Signed-off-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/20241106063542.357743-2-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Conflicts: kernel/bpf/hashtab.c [The conflicts were due to not merge the commit 0f8e4bd8a1fc8, d7ba4cc900bf1] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/hashtab.c | 46 ++++++++++++++++++++++++++++++++------------ 1 file changed, 34 insertions(+), 12 deletions(-) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 72bc5f575254..3cf34daa5220 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -799,7 +799,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l) htab_put_fd_value(htab, l); if (htab_is_prealloc(htab)) { - __pcpu_freelist_push(&htab->freelist, &l->fnode); + pcpu_freelist_push(&htab->freelist, &l->fnode); } else { atomic_dec(&htab->count); l->htab = htab; @@ -874,7 +874,6 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, */ pl_new = this_cpu_ptr(htab->extra_elems); l_new = *pl_new; - htab_put_fd_value(htab, old_elem); *pl_new = old_elem; } else { struct pcpu_freelist_node *l; @@ -963,6 +962,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value, struct htab_elem *l_new = NULL, *l_old; struct hlist_nulls_head *head; unsigned long flags; + void *old_map_ptr; struct bucket *b; u32 key_size, hash; int ret; @@ -1038,10 +1038,26 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value, hlist_nulls_add_head_rcu(&l_new->hash_node, head); if (l_old) { hlist_nulls_del_rcu(&l_old->hash_node); + + /* l_old has already been stashed in htab->extra_elems, free + * its special fields before it is available for reuse. Also + * save the old map pointer in htab of maps before unlock + * and release it after unlock. + */ + old_map_ptr = NULL; + if (htab_is_prealloc(htab)) { + if (map->ops->map_fd_put_ptr) + old_map_ptr = fd_htab_map_get_ptr(map, l_old); + } + } + htab_unlock_bucket(htab, b, flags); + if (l_old) { + if (old_map_ptr) + map->ops->map_fd_put_ptr(map, old_map_ptr, true); if (!htab_is_prealloc(htab)) free_htab_elem(htab, l_old); } - ret = 0; + return 0; err: htab_unlock_bucket(htab, b, flags); return ret; @@ -1264,11 +1280,13 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key) if (l) { hlist_nulls_del_rcu(&l->hash_node); - free_htab_elem(htab, l); ret = 0; } - htab_unlock_bucket(htab, b, flags); + + if (l) + free_htab_elem(htab, l); + return ret; } @@ -1515,13 +1533,14 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map, * may cause deadlock. See comments in function * prealloc_lru_pop(). Let us do bpf_lru_push_free() * after releasing the bucket lock. + * + * For htab of maps, htab_put_fd_value() in + * free_htab_elem() may acquire a spinlock with bucket + * lock being held and it violates the lock rule, so + * invoke free_htab_elem() after unlock as well. */ - if (is_lru_map) { - l->batch_flink = node_to_free; - node_to_free = l; - } else { - free_htab_elem(htab, l); - } + l->batch_flink = node_to_free; + node_to_free = l; } dst_key += key_size; dst_val += value_size; @@ -1533,7 +1552,10 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map, while (node_to_free) { l = node_to_free; node_to_free = node_to_free->batch_flink; - bpf_lru_push_free(&htab->lru, &l->lru_node); + if (is_lru_map) + bpf_lru_push_free(&htab->lru, &l->lru_node); + else + free_htab_elem(htab, l); } next_batch: -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] merge mainline patch into OLK-5.10
by Kaixiong Yu 10 Jan '25

10 Jan '25

merge mainline patch into OLK-5.10 David Hildenbrand (2): fs/proc/task_mmu: properly detect PM_MMAP_EXCLUSIVE per page of PMD-mapped THPs fs/proc/task_mmu: indicate PM_FILE for PMD-mapped file THP Michal Koutný (1): x86/mm: Do not shuffle CPU entry areas without KASLR Muchun Song (1): mm: kfence: fix using kfence_metadata without initialization in show_object() arch/x86/mm/cpu_entry_area.c | 7 +++++++ fs/proc/task_mmu.c | 19 +++++++++++++------ mm/kfence/core.c | 10 ++++++++-- 3 files changed, 28 insertions(+), 8 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
by Ye Bin 10 Jan '25

10 Jan '25

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> mainline inclusion from mainline-v6.13-rc4 commit 2dd59fe0e19e1ab955259978082b62e5751924c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PJ CVE: CVE-2024-56769 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000_read_reg(). Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case that call fails, the buffer may end up with some undefined values. Since no elaborate error handling is expected in dib3000_write_reg(), simply zero out rb buffer to mitigate the problem. [1] Syzkaller report dvb-usb: bulk message failed: -22 (6/0) ===================================================== BUG: KMSAN: uninit-value in dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 dib3000mb_attach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 dibusb_dib3000mb_frontend_attach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31 dvb_usb_adapter_frontend_init+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290 dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline] dvb_usb_device_init+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310 dibusb_probe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110 ... Local variable rb created at: dib3000_read_reg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54 dib3000mb_attach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 ... Fixes: 74340b0a8bc6 ("V4L/DVB (4457): Remove dib3000-common-module") Reported-by: syzbot+c88fc0ebe0d5935c70da(a)syzkaller.appspotmail.com Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Link: https://lore.kernel.org/r/20240517155800.9881-1-n.zhandarovich@fintech.ru Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/media/dvb-frontends/dib3000mb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/dib3000mb.c b/drivers/media/dvb-frontends/dib3000mb.c index c598b2a63325..7c452ddd9e40 100644 --- a/drivers/media/dvb-frontends/dib3000mb.c +++ b/drivers/media/dvb-frontends/dib3000mb.c @@ -51,7 +51,7 @@ MODULE_PARM_DESC(debug, "set debugging level (1=info,2=xfer,4=setfe,8=getfe (|-a static int dib3000_read_reg(struct dib3000_state *state, u16 reg) { u8 wb[] = { ((reg >> 8) | 0x80) & 0xff, reg & 0xff }; - u8 rb[2]; + u8 rb[2] = {}; struct i2c_msg msg[] = { { .addr = state->config.demod_address, .flags = 0, .buf = wb, .len = 2 }, { .addr = state->config.demod_address, .flags = I2C_M_RD, .buf = rb, .len = 2 }, -- 2.34.1

2 1