Hi Dong,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: e4fe1cc5cc1a347dec844c60d34f6141780f05af
commit: bf177ad1d8f72824180b44563c09f37562f645de [7044/14254] drivers: initial support for rnpgbevf drivers from Mucse Technology
config: loongarch-randconfig-001-20240930 (https://download.01.org/0day-ci/archive/20240930/202409301357.XJDOWyKd-lkp@…)
compiler: loongarch64-linux-gcc (GCC) 14.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409301357.XJDOWyKd-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202409301357.XJDOWyKd-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from drivers/net/ethernet/mucse/rnpgbevf/vf.h:13,
from drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf.h:14,
from drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:27:
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h: In function '_rnp_skb_dump':
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:265:23: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable]
265 | int headroom, tailroom;
| ^~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:265:13: warning: variable 'headroom' set but not used [-Wunused-but-set-variable]
265 | int headroom, tailroom;
| ^~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:264:23: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable]
264 | bool has_mac, has_trans;
| ^~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_defines.h:264:14: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable]
264 | bool has_mac, has_trans;
| ^~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: At top level:
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:119:6: warning: no previous prototype for 'rnpgbevf_unmap_and_free_tx_resource' [-Wmissing-prototypes]
119 | void rnpgbevf_unmap_and_free_tx_resource(struct rnpgbevf_ring *ring,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1236:6: warning: no previous prototype for 'rnpgbevf_alloc_rx_buffers' [-Wmissing-prototypes]
1236 | void rnpgbevf_alloc_rx_buffers(struct rnpgbevf_ring *rx_ring, u16 cleaned_count)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_clean_rx_irq':
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1530:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable]
1530 | bool xdp_xmit = false;
| ^~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: At top level:
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2263:6: warning: no previous prototype for 'rnpgbevf_write_eitr_rx' [-Wmissing-prototypes]
2263 | void rnpgbevf_write_eitr_rx(struct rnpgbevf_q_vector *q_vector)
| ^~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2361:6: warning: no previous prototype for 'rnpgbevf_configure_tx_ring' [-Wmissing-prototypes]
2361 | void rnpgbevf_configure_tx_ring(struct rnpgbevf_adapter *adapter,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2426:6: warning: no previous prototype for 'rnpgbevf_disable_rx_queue' [-Wmissing-prototypes]
2426 | void rnpgbevf_disable_rx_queue(struct rnpgbevf_adapter *adapter,
| ^~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2432:6: warning: no previous prototype for 'rnpgbevf_enable_rx_queue' [-Wmissing-prototypes]
2432 | void rnpgbevf_enable_rx_queue(struct rnpgbevf_adapter *adapter,
| ^~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2438:6: warning: no previous prototype for 'rnpgbevf_configure_rx_ring' [-Wmissing-prototypes]
2438 | void rnpgbevf_configure_rx_ring(struct rnpgbevf_adapter *adapter,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_vlan_rx_kill_vid':
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:2561:13: warning: variable 'err' set but not used [-Wunused-but-set-variable]
2561 | int err = -EOPNOTSUPP;
| ^~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_acquire_msix_vectors':
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:3187:13: warning: variable 'vector_threshold' set but not used [-Wunused-but-set-variable]
3187 | int vector_threshold;
| ^~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: At top level:
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:4378:6: warning: no previous prototype for 'rnpgbevf_tx_ctxtdesc' [-Wmissing-prototypes]
4378 | void rnpgbevf_tx_ctxtdesc(struct rnpgbevf_ring *tx_ring, u16 mss_seg_len,
| ^~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:4820:6: warning: no previous prototype for 'rnpgbevf_maybe_tx_ctxtdesc' [-Wmissing-prototypes]
4820 | void rnpgbevf_maybe_tx_ctxtdesc(struct rnpgbevf_ring *tx_ring,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:4838:13: warning: no previous prototype for 'rnpgbevf_xmit_frame_ring' [-Wmissing-prototypes]
4838 | netdev_tx_t rnpgbevf_xmit_frame_ring(struct sk_buff *skb,
| ^~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:5311:6: warning: no previous prototype for 'rnpgbevf_assign_netdev_ops' [-Wmissing-prototypes]
5311 | void rnpgbevf_assign_netdev_ops(struct net_device *dev)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c: In function 'rnpgbevf_request_msix_irqs':
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1978:44: warning: '%d' directive output may be truncated writing between 1 and 5 bytes into a region of size between 1 and 16 [-Wformat-truncation=]
1978 | "%s-%s-%d-%d", netdev->name, "TxRx", i,
| ^~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1978:34: note: directive argument in the range [0, 65535]
1978 | "%s-%s-%d-%d", netdev->name, "TxRx", i,
| ^~~~~~~~~~~~~
drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c:1977:25: note: 'snprintf' output between 10 and 29 bytes into a destination of size 24
1977 | snprintf(q_vector->name, sizeof(q_vector->name) - 1,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1978 | "%s-%s-%d-%d", netdev->name, "TxRx", i,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1979 | q_vector->v_idx);
| ~~~~~~~~~~~~~~~~
vim +/rnpgbevf_alloc_rx_buffers +1236 drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.c
1229
1230 #else
1231 /**
1232 * rnpgbevf_alloc_rx_buffers - Replace used receive buffers
1233 * @rx_ring: ring to place buffers on
1234 * @cleaned_count: number of buffers to replace
1235 **/
> 1236 void rnpgbevf_alloc_rx_buffers(struct rnpgbevf_ring *rx_ring, u16 cleaned_count)
1237 {
1238 union rnp_rx_desc *rx_desc;
1239 struct rnpgbevf_rx_buffer *bi;
1240 u16 i = rx_ring->next_to_use;
1241 u64 fun_id = ((u64)(rx_ring->vfnum) << (32 + 24));
1242 u16 bufsz;
1243 /* nothing to do */
1244 if (!cleaned_count)
1245 return;
1246
1247 rx_desc = RNPVF_RX_DESC(rx_ring, i);
1248
1249 BUG_ON(!rx_desc);
1250
1251 bi = &rx_ring->rx_buffer_info[i];
1252
1253 BUG_ON(!bi);
1254
1255 i -= rx_ring->count;
1256 bufsz = rnpgbevf_rx_bufsz(rx_ring);
1257
1258 do {
1259 if (!rnpgbevf_alloc_mapped_page(rx_ring, bi))
1260 break;
1261
1262 dma_sync_single_range_for_device(rx_ring->dev, bi->dma,
1263 bi->page_offset, bufsz,
1264 DMA_FROM_DEVICE);
1265
1266 /* Refresh the desc even if buffer_addrs didn't change
1267 * because each write-back erases this info.
1268 */
1269 rx_desc->pkt_addr =
1270 cpu_to_le64(bi->dma + bi->page_offset + fun_id);
1271
1272 /* clean dd */
1273 rx_desc->cmd = 0;
1274
1275 rx_desc++;
1276 bi++;
1277 i++;
1278 if (unlikely(!i)) {
1279 rx_desc = RNPVF_RX_DESC(rx_ring, 0);
1280 bi = rx_ring->rx_buffer_info;
1281 i -= rx_ring->count;
1282 }
1283
1284 /* clear the hdr_addr for the next_to_use descriptor */
1285 cleaned_count--;
1286 } while (cleaned_count);
1287
1288 i += rx_ring->count;
1289
1290 if (rx_ring->next_to_use != i)
1291 rnpgbevf_update_rx_tail(rx_ring, i);
1292 }
1293
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
From: Justin Tee <justin.tee(a)broadcom.com>
mainline inclusion
from mainline-v6.11-rc1
commit ede596b1434b57c0b3fd5c02b326efe5c54f6e48
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9N8
CVE: CVE-2024-46842
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?…
--------------------------------
The MBX_TIMEOUT return code is not handled in lpfc_get_sfp_info and the
routine unconditionally frees submitted mailbox commands regardless of
return status. The issue is that for MBX_TIMEOUT cases, when firmware
returns SFP information at a later time, that same mailbox memory region
references previously freed memory in its cmpl routine.
Fix by adding checks for the MBX_TIMEOUT return code. During mailbox
resource cleanup, check the mbox flag to make sure that the wait did not
timeout. If the MBOX_WAKE flag is not set, then do not free the resources
because it will be freed when firmware completes the mailbox at a later
time in its cmpl routine.
Also, increase the timeout from 30 to 60 seconds to accommodate boot
scripts requiring longer timeouts.
Signed-off-by: Justin Tee <justin.tee(a)broadcom.com>
Link: https://lore.kernel.org/r/20240628172011.25921-6-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
Conflicts:
drivers/scsi/lpfc/lpfc_els.c
[The conflict here is due to inconsistencies in the context caused by
18f7fe44bc79 ("scsi: lpfc: Define lpfc_nodelist type for ctx_ndlp ptr").]
Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com>
---
drivers/scsi/lpfc/lpfc_els.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 44d3ada9fbbc..76fc32284a80 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -7304,13 +7304,13 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba,
}
mbox->vport = phba->pport;
mbox->ctx_ndlp = (struct lpfc_rdp_context *)rdp_context;
-
- rc = lpfc_sli_issue_mbox_wait(phba, mbox, 30);
+ rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_SLI4_CONFIG_TMO);
if (rc == MBX_NOT_FINISHED) {
rc = 1;
goto error;
}
-
+ if (rc == MBX_TIMEOUT)
+ goto error;
if (phba->sli_rev == LPFC_SLI_REV4)
mp = (struct lpfc_dmabuf *)(mbox->ctx_buf);
else
@@ -7364,7 +7364,10 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba,
}
mbox->ctx_ndlp = (struct lpfc_rdp_context *)rdp_context;
- rc = lpfc_sli_issue_mbox_wait(phba, mbox, 30);
+ rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_SLI4_CONFIG_TMO);
+
+ if (rc == MBX_TIMEOUT)
+ goto error;
if (bf_get(lpfc_mqe_status, &mbox->u.mqe)) {
rc = 1;
goto error;
@@ -7375,8 +7378,10 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba,
DMP_SFF_PAGE_A2_SIZE);
error:
- mbox->ctx_buf = mpsave;
- lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
+ if (mbox->mbox_flag & LPFC_MBX_WAKE) {
+ mbox->ctx_buf = mpsave;
+ lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
+ }
return rc;
--
2.39.2