November 2024 - Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2415/2415] kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static?
by kernel test robot 26 Nov '24

26 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5d73ae1b79c0e467e87e2f0494211ff38732900d commit: 364de98eacea8dbfe4f926f62085aebf8534f403 [2415/2415] watchdog: Fix sleeping function called from atomic context config: x86_64-randconfig-121-20241111 (https://download.01.org/0day-ci/archive/20241126/202411260320.yKIJ0n9e-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241126/202411260320.yKIJ0n9e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411260320.yKIJ0n9e-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/watchdog_hld.c:502:12: sparse: sparse: symbol '__hardlockup_detector_perf_init' was not declared. Should it be static? vim +/__hardlockup_detector_perf_init +502 kernel/watchdog_hld.c 501 > 502 int __init __hardlockup_detector_perf_init(void *not_used) 503 { 504 int ret = hardlockup_detector_event_create(); 505 506 if (ret) { 507 pr_info("Perf NMI watchdog permanently disabled\n"); 508 } else { 509 perf_event_release_kernel(this_cpu_read(watchdog_ev)); 510 this_cpu_write(watchdog_ev, NULL); 511 } 512 return ret; 513 } 514 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 48fd60600c1344806a27e3bb33ab33ec5a9fea7c
by kernel test robot 26 Nov '24

26 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 48fd60600c1344806a27e3bb33ab33ec5a9fea7c !13424 btrfs: reinitialize delayed ref list after deleting it from the list Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411251710.OUFik4Mp-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411260043.JceIGmYJ-lkp@intel.com drivers/iommu/arm-smmu-v3.c:2896:41: error: 'pci_bus_type' undeclared (first use in this function); did you mean 'pci_pcie_type'? drivers/mailbox/phytium_mailbox.c:116:36: warning: 'phytium_mbox_acpi_match' defined but not used [-Wunused-const-variable=] kernel/sched/grid/qos.c:84:31: error: 'struct mempolicy' has no member named 'v' kernel/sched/grid/qos.c:95:31: error: 'struct task_struct' has no member named 'il_prev' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-001-20241112 | |-- drivers-iommu-arm-smmu-v3.c:error:pci_bus_type-undeclared-(first-use-in-this-function) | |-- kernel-sched-grid-qos.c:error:struct-mempolicy-has-no-member-named-v | `-- kernel-sched-grid-qos.c:error:struct-task_struct-has-no-member-named-il_prev |-- arm64-randconfig-004-20241113 | `-- drivers-mailbox-phytium_mailbox.c:warning:phytium_mbox_acpi_match-defined-but-not-used |-- x86_64-buildonly-randconfig-002-20241117 | `-- block-.tmp_blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-004-20241125 | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-mailbox-qcom-apcs-ipc-mailbox.c:warning:apcs_clk_match_table-defined-but-not-used | |-- drivers-mtd-nand-bbt.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | `-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20241125 | |-- block-.tmp_blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- crypto-.tmp_aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- crypto-.tmp_zstd.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-char-tpm-eventlog-.tmp_of.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-fpga-.tmp_machxo2-spi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-.tmp_cdns-dsi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-.tmp_thc63lvd1024.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-i2c-.tmp_tda9950.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-vkms-.tmp_vkms_drv.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-chemical-.tmp_bme680_i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-chemical-.tmp_bme680_spi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_si1133.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-cirrus-.tmp_pinctrl-madera-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-regulator-.tmp_sy8106a-regulator.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- lib-zstd-.tmp_decompress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_fse_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_compress.o:warning:objtool:missing-symbol-for-section-.text | `-- lib-zstd-.tmp_huf_decompress.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-002-20241125 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-004-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-005-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-006-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-011-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-012-20241125 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-013-20241125 | |-- drivers-usb-host-ehci-hcd.o:warning:objtool:ehci_endpoint_disable:unreachable-instruction | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-015-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-016-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-072-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-073-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-074-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-076-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-101-20241125 | `-- drivers-usb-host-ehci-hcd.o:warning:objtool:ehci_endpoint_disable:unreachable-instruction |-- x86_64-randconfig-102-20241125 | |-- drivers-md-md.o:warning:objtool:md_seq_show:unreachable-instruction | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-103-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-104-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-161-20241125 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4 | |-- drivers-net-can-usb-kvaser_usb-kvaser_usb_hydra.c:warning:new_state-may-be-used-uninitialized | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-9.4-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 723m configs tested: 32 configs skipped: 137 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241125 gcc-14.2.0 arm64 randconfig-002-20241125 gcc-14.2.0 arm64 randconfig-003-20241125 gcc-14.2.0 arm64 randconfig-004-20241125 gcc-14.2.0 x86_64 buildonly-randconfig-001-20241125 clang-19 x86_64 buildonly-randconfig-002-20241125 gcc-12 x86_64 buildonly-randconfig-003-20241125 clang-19 x86_64 buildonly-randconfig-004-20241125 gcc-12 x86_64 buildonly-randconfig-005-20241125 clang-19 x86_64 buildonly-randconfig-006-20241125 clang-19 x86_64 kexec clang-19 x86_64 randconfig-001-20241125 clang-19 x86_64 randconfig-002-20241125 clang-19 x86_64 randconfig-003-20241125 gcc-12 x86_64 randconfig-004-20241125 clang-19 x86_64 randconfig-005-20241125 gcc-12 x86_64 randconfig-006-20241125 clang-19 x86_64 randconfig-011-20241125 gcc-12 x86_64 randconfig-012-20241125 clang-19 x86_64 randconfig-013-20241125 clang-19 x86_64 randconfig-014-20241125 gcc-12 x86_64 randconfig-015-20241125 clang-19 x86_64 randconfig-016-20241125 clang-19 x86_64 randconfig-071-20241125 clang-19 x86_64 randconfig-072-20241125 gcc-12 x86_64 randconfig-073-20241125 clang-19 x86_64 randconfig-074-20241125 clang-19 x86_64 randconfig-075-20241125 clang-19 x86_64 randconfig-076-20241125 gcc-12 x86_64 rhel-9.4 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1291/1291] drivers/mailbox/phytium_mailbox.c:116:36: warning: 'phytium_mbox_acpi_match' defined but not used
by kernel test robot 26 Nov '24

26 Nov '24

Hi Chen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 48fd60600c1344806a27e3bb33ab33ec5a9fea7c commit: 1ae9436b02e93f1f2b9cfc10226812197fbfcd04 [1291/1291] mailbox: add phytium mailbox driver config: arm64-randconfig-004-20241113 (https://download.01.org/0day-ci/archive/20241126/202411260043.JceIGmYJ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241126/202411260043.JceIGmYJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411260043.JceIGmYJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/mailbox/phytium_mailbox.c:116:36: warning: 'phytium_mbox_acpi_match' defined but not used [-Wunused-const-variable=] 116 | static const struct acpi_device_id phytium_mbox_acpi_match[] = { | ^~~~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HARDLOCKUP_DETECTOR Depends on [n]: DEBUG_KERNEL [=n] && !S390 && (HAVE_HARDLOCKUP_DETECTOR_PERF [=n] || HAVE_HARDLOCKUP_DETECTOR_ARCH [=y]) Selected by [y]: - SDEI_WATCHDOG [=y] && <choice> && ARM_SDE_INTERFACE [=y] && !HARDLOCKUP_CHECK_TIMESTAMP [=n] vim +/phytium_mbox_acpi_match +116 drivers/mailbox/phytium_mailbox.c 115 > 116 static const struct acpi_device_id phytium_mbox_acpi_match[] = { 117 { "PHYT0009", 0 }, 118 { }, 119 }; 120 MODULE_DEVICE_TABLE(acpi, phytium_mbox_acpi_match); 121 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1466/1466] arch/loongarch/kvm/exit.c:768:2-3: Unneeded semicolon
by kernel test robot 25 Nov '24

25 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e5f9cb08ccf02777d4bcc83a9bcdbba6434a7ab2 commit: 60f12ac296b9c755ff6f94fed1590a9ae2e6dfa7 [1466/1466] LoongArch: KVM: Add pv ipi support on kvm side config: loongarch-randconfig-r051-20241114 (https://download.01.org/0day-ci/archive/20241125/202411252036.xy4CfSQv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411252036.xy4CfSQv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/loongarch/kvm/exit.c:768:2-3: Unneeded semicolon vim +768 arch/loongarch/kvm/exit.c 751 752 /* 753 * hypercall emulation always return to guest, Caller should check retval. 754 */ 755 static void kvm_handle_pv_service(struct kvm_vcpu *vcpu) 756 { 757 unsigned long func = vcpu->arch.gprs[LOONGARCH_GPR_A0]; 758 long ret; 759 760 switch (func) { 761 case KVM_HCALL_FUNC_PV_IPI: 762 kvm_pv_send_ipi(vcpu); 763 ret = KVM_HCALL_STATUS_SUCCESS; 764 break; 765 default: 766 ret = KVM_HCALL_INVALID_CODE; 767 break; > 768 }; 769 770 vcpu->arch.gprs[LOONGARCH_GPR_A0] = ret; 771 } 772 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v4 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v4: - Fix the missing Comma about check_xint_pre_kernel_entry. - When CONFIG_SECURITY_FEATURE_BYPASS not set, ret_to_user/kernel instead of "kernel_exit \el" for xcall/xint. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 168 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 834 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 v4 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v4: - Fix the missing Comma about check_xint_pre_kernel_entry. - When CONFIG_SECURITY_FEATURE_BYPASS not set, ret_to_user/kernel instead of "kernel_exit \el" for xcall/xint. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 168 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 834 insertions(+), 5 deletions(-) -- 2.34.1

1 4

[PATCH OLK-6.6 v3 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v3: - Fix few typos in entry.S. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S. - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare(). Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 164 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 +++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 830 insertions(+), 5 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS] tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
by Liu Jian 25 Nov '24

25 Nov '24

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.12-rc4 commit e8c526f2bdf1845bedaf6a478816a3d06fa78b8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2STS CVE: CVE-2024-50154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_timer_handler+0xda/0x3d0 run_timer_softirq+0x292/0x8a0 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 intel_idle_irq+0x5a/0xa0 cpuidle_enter_state+0x94/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6 allocated by task 0 on cpu 9 at 260507.901592s: sk_prot_alloc+0x35/0x140 sk_clone_lock+0x1f/0x3f0 inet_csk_clone_lock+0x15/0x160 tcp_create_openreq_child+0x1f/0x410 tcp_v6_syn_recv_sock+0x1da/0x700 tcp_check_req+0x1fb/0x510 tcp_v6_rcv+0x98b/0x1420 ipv6_list_rcv+0x2258/0x26e0 napi_complete_done+0x5b1/0x2990 mlx5e_napi_poll+0x2ae/0x8d0 net_rx_action+0x13e/0x590 irq_exit_rcu+0xf5/0x320 common_interrupt+0x80/0x90 asm_common_interrupt+0x22/0x40 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb freed by task 0 on cpu 9 at 260507.927527s: rcu_core_si+0x4ff/0xf10 irq_exit_rcu+0xf5/0x320 sysvec_apic_timer_interrupt+0x6d/0x80 asm_sysvec_apic_timer_interrupt+0x16/0x20 cpuidle_enter_state+0xfb/0x273 cpu_startup_entry+0x15e/0x260 start_secondary+0x8a/0x90 secondary_startup_64_no_verify+0xfa/0xfb Fixes: 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") Reported-by: Martin KaFai Lau <martin.lau(a)kernel.org> Closes: https://lore.kernel.org/netdev/eb6684d0-ffd9-4bdc-9196-33f690c25824@linux.d… Link: https://lore.kernel.org/netdev/b55e2ca0-42f2-4b7c-b445-6ffd87ca74a0@linux.d… [1] Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20241014223312.4254-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_connection_sock.c [Did not backport c905dee62232, 5903123f662e, 9b13df3fb64e.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/inet_connection_sock.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index c1f90e08761c..ffa0f8b3f21f 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -718,21 +718,31 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue, found = __sk_nulls_del_node_init_rcu(req_to_sk(req)); spin_unlock(lock); } - if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) - reqsk_put(req); + return found; } -bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) +static bool __inet_csk_reqsk_queue_drop(struct sock *sk, + struct request_sock *req, + bool from_timer) { bool unlinked = reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req); + if (!from_timer && del_timer_sync(&req->rsk_timer)) + reqsk_put(req); + if (unlinked) { reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req); reqsk_put(req); } + return unlinked; } + +bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req) +{ + return __inet_csk_reqsk_queue_drop(sk, req, false); +} EXPORT_SYMBOL(inet_csk_reqsk_queue_drop); void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req) @@ -805,7 +815,8 @@ static void reqsk_timer_handler(struct timer_list *t) return; } drop: - inet_csk_reqsk_queue_drop_and_put(sk_listener, req); + __inet_csk_reqsk_queue_drop(sk_listener, req, true); + reqsk_put(req); } static void reqsk_queue_hash_req(struct request_sock *req, -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/4] arm64: Add xcall/xint support
by Jinjie Ruan 25 Nov '24

25 Nov '24

Add xcall/xint support for arm64. Changes in v2: - Avoid enable xint without GICv3 enabled. - Fix cpucap KABI break. - Fix missing openeuler_defconfig update. - Correct the marco control for SECURITY_FEATURE_BYPASS in entry.S - exit_to_user_mode_prepare_xcall() -> xcall_exit_to_user_mode_prepare() Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 64 ++++++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++++ arch/arm64/kernel/entry-common.c | 162 ++++++++++++++++++++++++ arch/arm64/kernel/entry.S | 164 ++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 123 +++++++++++++++++++ fs/proc/base.c | 112 +++++++++++++++++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 4 + kernel/fork.c | 17 +++ kernel/irq/debugfs.c | 33 +++++ kernel/irq/internals.h | 18 +++ kernel/irq/proc.c | 6 + kernel/softirq.c | 47 +++++++ 18 files changed, 830 insertions(+), 5 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] net/hinic3: Support new NIC feature
by s00851154 25 Nov '24

25 Nov '24

From: zhuyikai <zhuyikai1(a)h-partners.com> Support new TX WQE offload format and new RX WQE type. zhuyikai (2): net/hinic3: Support new TX feature net/hinic3: Support new RX feature drivers/net/ethernet/huawei/hinic3/hinic3_main.c | 8 + drivers/net/ethernet/huawei/hinic3/hinic3_mgmt_interface.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_mt.h | 2 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_cfg.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 1 + drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.c | 23 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_io.h | 5 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_qp.h | 131 +++++++--- drivers/net/ethernet/huawei/hinic3/hinic3_rx.c | 162 ++++++++----- drivers/net/ethernet/huawei/hinic3/hinic3_rx.h | 10 +- drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 430 ++++++++++++++++++--------------- drivers/net/ethernet/huawei/hinic3/hinic3_tx.h | 10 +- 12 files changed, 498 insertions(+), 286 deletions(-) -- 2.45.1.windows.1

2 3

2024

2023

2022

2021

2020

2019

Kernel November 2024