- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] mlxsw: spectrum_acl_tcam: Fix stack corruption
by Liu Jian 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit 483ae90d8f976f8339cf81066312e1329f2d3706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932WD CVE: CVE-2024-26586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash when this condition is hit. [1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") Reported-by: Orel Hagag <orelh(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/2d91c89afba59c22587b444994ae419dbea8d876.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh --- .../mellanox/mlxsw/spectrum_acl_tcam.c | 2 + .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 56 ++++++++++++++++++- 2 files changed, 57 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..d4ddea426939 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -57,6 +57,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, tcam->max_groups = max_groups; tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUP_SIZE); + tcam->max_group_size = min_t(unsigned int, tcam->max_group_size, + MLXSW_REG_PAGT_ACL_MAX_NUM); err = ops->init(mlxsw_sp, tcam->priv, tcam); if (err) diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh index 3b75180f455d..61f0ce8454e0 100755 --- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh @@ -8,7 +8,7 @@ lib_dir=$(dirname $0)/../../../../net/forwarding ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ - multiple_masks_test ctcam_edge_cases_test" + multiple_masks_test ctcam_edge_cases_test max_group_size_test" NUM_NETIFS=2 source $lib_dir/tc_common.sh source $lib_dir/lib.sh @@ -324,6 +324,60 @@ ctcam_edge_cases_test() ctcam_no_atcam_masks_test } +max_group_size_test() +{ + # The number of ACLs in an ACL group is limited. Once the maximum + # number of ACLs has been reached, filters cannot be added. This test + # verifies that when this limit is reached, insertion fails without + # crashing. + + RET=0 + + local num_acls=32 + local max_size + local ret + + if [[ "$tcflags" != "skip_sw" ]]; then + return 0; + fi + + for ((i=1; i < $num_acls; i++)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter add dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter add dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + + ret=$? + [[ $ret -ne 0 ]] && max_size=$((i - 1)) && break + done + + # We expect to exceed the maximum number of ACLs in a group, so that + # insertion eventually fails. Otherwise, the test should be adjusted to + # add more filters. + check_fail $ret "expected to exceed number of ACLs in a group" + + for ((; i >= 1; i--)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter del dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter del dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + done + + log_test "max ACL group size test ($tcflags). max size $max_size" +} + setup_prepare() { h1=${NETIFS[p1]} -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/1] backport patch to fix CVE vulnerabilities from olk-6.6
by Yuntao Liu 26 Feb '24

26 Feb '24

patch to fix CVE-2024-23196. Tuo Li (1): ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2023-52435
by Ziyang Xuan 26 Feb '24

26 Feb '24

v3: - Add fixes tag for patch 2. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] kvm: kabi: KABI reservation for RME
by Guangwei Zhou 26 Feb '24

26 Feb '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I92TT5 CVE: NA ---------------------------------------------------------------------- Reserve KABI for struct kvm_arch and struct kvm_vcpu_arch for ARMv9 RME feature. Signed-off-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index 993b60d7219d..7c34e0b0b875 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -27,6 +27,7 @@ #include <asm/fpsimd.h> #include <asm/kvm.h> #include <asm/kvm_asm.h> +#include <linux/kabi.h> #define __KVM_HAVE_ARCH_INTC_INITIALIZED @@ -286,6 +287,15 @@ struct kvm_arch { cpumask_var_t sched_cpus; /* Union of all vcpu's cpus_ptr */ u64 tlbi_dvmbm; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct kvm_vcpu_fault_info { @@ -604,6 +614,26 @@ struct kvm_vcpu_arch { cpumask_var_t sched_cpus; cpumask_var_t pre_sched_cpus; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) }; /* -- 2.33.0

2 1

[PATCH OLK-6.6] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.14 commit d3c0b49aaa12a61d560528f5d605029ab57f0728 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 193b22a2d6bf..02d9c47797be 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1106,7 +1106,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v5.10.209 commit 6f866885e147d33efc497f1095f35b2ee5ec7310 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 72b109685db4..99e4ec48d2a4 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1066,7 +1066,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

1 0

[openeuler:openEuler-1.0-LTS 13425/21632] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 90f09a01314abe26de1a722d1b51c351d84e1f5b [13425/21632] net/hinic: Add support for X86 Arch config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402252031.ls64imy6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: expected unsigned int val drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:970:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:979:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'intr_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base_phy' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'dwqe_mapping' not described in 'hinic_init_hwif' vim +649 drivers/net/ethernet/huawei/hinic/hinic_hwif.c 746ea35981b1f7 Xue 2019-01-30 640 746ea35981b1f7 Xue 2019-01-30 641 int hinic_dma_zalloc_coherent_align(void *dev_hdl, u64 size, u64 align, 746ea35981b1f7 Xue 2019-01-30 642 unsigned int flag, 746ea35981b1f7 Xue 2019-01-30 643 struct hinic_dma_addr_align *mem_align) 746ea35981b1f7 Xue 2019-01-30 644 { 746ea35981b1f7 Xue 2019-01-30 645 void *vaddr, *align_vaddr; 746ea35981b1f7 Xue 2019-01-30 646 dma_addr_t paddr, align_paddr; 746ea35981b1f7 Xue 2019-01-30 647 u64 real_size = size; 746ea35981b1f7 Xue 2019-01-30 648 746ea35981b1f7 Xue 2019-01-30 @649 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 650 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 651 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 652 746ea35981b1f7 Xue 2019-01-30 653 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 654 /* align */ 746ea35981b1f7 Xue 2019-01-30 655 if (align_paddr == paddr) { 746ea35981b1f7 Xue 2019-01-30 656 align_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 657 goto out; 746ea35981b1f7 Xue 2019-01-30 658 } 746ea35981b1f7 Xue 2019-01-30 659 746ea35981b1f7 Xue 2019-01-30 660 dma_free_coherent(dev_hdl, real_size, vaddr, paddr); 746ea35981b1f7 Xue 2019-01-30 661 746ea35981b1f7 Xue 2019-01-30 662 /* realloc memory for align */ 746ea35981b1f7 Xue 2019-01-30 663 real_size = size + align; 746ea35981b1f7 Xue 2019-01-30 664 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 665 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 666 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 667 746ea35981b1f7 Xue 2019-01-30 668 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 669 align_vaddr = (void *)((u64)vaddr + (align_paddr - paddr)); 746ea35981b1f7 Xue 2019-01-30 670 746ea35981b1f7 Xue 2019-01-30 671 out: 746ea35981b1f7 Xue 2019-01-30 672 mem_align->real_size = (u32)real_size; 746ea35981b1f7 Xue 2019-01-30 673 mem_align->ori_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 674 mem_align->ori_paddr = paddr; 746ea35981b1f7 Xue 2019-01-30 675 mem_align->align_vaddr = align_vaddr; 746ea35981b1f7 Xue 2019-01-30 676 mem_align->align_paddr = align_paddr; 746ea35981b1f7 Xue 2019-01-30 677 746ea35981b1f7 Xue 2019-01-30 678 return 0; 746ea35981b1f7 Xue 2019-01-30 679 } 746ea35981b1f7 Xue 2019-01-30 680 :::::: The code at line 649 was first introduced by commit :::::: 746ea35981b1f77e988d48642409d73f0470b3eb net: hinic: Add Hardware Abstract Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 10454/21632] sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: c6a3607c78f8035db0efc67cb41374fe49e4709d [10454/21632] ALSA: usb-audio: More validations of descriptor units config: x86_64-randconfig-121-20240224 (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402250716.ZS5etOKl-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer vim +113 sound/usb/validate.c 67 68 /* both for processing and extension units; covering all UACs */ 69 static bool validate_processing_unit(const void *p, 70 const struct usb_desc_validator *v) 71 { 72 const struct uac_processing_unit_descriptor *d = p; 73 const unsigned char *hdr = p; 74 size_t len, m; 75 76 if (d->bLength < sizeof(*d)) 77 return false; 78 len = d->bLength < sizeof(*d) + d->bNrInPins; 79 if (d->bLength < len) 80 return false; 81 switch (v->protocol) { 82 case UAC_VERSION_1: 83 default: 84 /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */ 85 len += 1 + 2 + 1 + 1; 86 if (d->bLength < len) /* bControlSize */ 87 return false; 88 m = hdr[len]; 89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ 90 break; 91 case UAC_VERSION_2: 92 /* bNrChannels, bmChannelConfig, iChannelNames */ 93 len += 1 + 4 + 1; 94 if (v->type == UAC2_PROCESSING_UNIT_V2) 95 len += 2; /* bmControls -- 2 bytes for PU */ 96 else 97 len += 1; /* bmControls -- 1 byte for EU */ 98 len += 1; /* iProcessing */ 99 break; 100 case UAC_VERSION_3: 101 /* wProcessingDescrStr, bmControls */ 102 len += 2 + 4; 103 break; 104 } 105 if (d->bLength < len) 106 return false; 107 108 switch (v->protocol) { 109 case UAC_VERSION_1: 110 default: 111 if (v->type == UAC1_EXTENSION_UNIT) 112 return true; /* OK */ > 113 switch (d->wProcessType) { 114 case UAC_PROCESS_UP_DOWNMIX: 115 case UAC_PROCESS_DOLBY_PROLOGIC: 116 if (d->bLength < len + 1) /* bNrModes */ 117 return false; 118 m = hdr[len]; 119 len += 1 + m * 2; /* bNrModes, waModes(n) */ 120 break; 121 default: 122 break; 123 } 124 break; 125 case UAC_VERSION_2: 126 if (v->type == UAC2_EXTENSION_UNIT_V2) 127 return true; /* OK */ 128 switch (d->wProcessType) { 129 case UAC2_PROCESS_UP_DOWNMIX: 130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ 131 if (d->bLength < len + 1) /* bNrModes */ 132 return false; 133 m = hdr[len]; 134 len += 1 + m * 4; /* bNrModes, daModes(n) */ 135 break; 136 default: 137 break; 138 } 139 break; 140 case UAC_VERSION_3: 141 if (v->type == UAC3_EXTENSION_UNIT) { 142 len += 2; /* wClusterDescrID */ 143 break; 144 } 145 switch (d->wProcessType) { 146 case UAC3_PROCESS_UP_DOWNMIX: 147 if (d->bLength < len + 1) /* bNrModes */ 148 return false; 149 m = hdr[len]; 150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */ 151 break; 152 case UAC3_PROCESS_MULTI_FUNCTION: 153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */ 154 break; 155 default: 156 break; 157 } 158 break; 159 } 160 if (d->bLength < len) 161 return false; 162 163 return true; 164 } 165 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0