- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] kernfs: RCU protect kernfs_nodes and avoid kernfs_idr_lock in kernfs_find_and_get_node_by_id()
by Li Lingfeng 09 May '24

09 May '24

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v6.6.27 commit 4b1f991bad566de14ae79bca952d201189cada52 bugzilla: https://gitee.com/openeuler/kernel/issues/I9MPZ8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4207b556e62f0a8915afc5da4c5d5ad915a253a5 ] The BPF helper bpf_cgroup_from_id() calls kernfs_find_and_get_node_by_id() which acquires kernfs_idr_lock, which is an non-raw non-IRQ-safe lock. This can lead to deadlocks as bpf_cgroup_from_id() can be called from any BPF programs including e.g. the ones that attach to functions which are holding the scheduler rq lock. Consider the following BPF program: SEC("fentry/__set_cpus_allowed_ptr_locked") int BPF_PROG(__set_cpus_allowed_ptr_locked, struct task_struct *p, struct affinity_context *affn_ctx, struct rq *rq, struct rq_flags *rf) { struct cgroup *cgrp = bpf_cgroup_from_id(p->cgroups->dfl_cgrp->kn->id); if (cgrp) { bpf_printk("%d[%s] in %s", p->pid, p->comm, cgrp->kn->name); bpf_cgroup_release(cgrp); } return 0; } __set_cpus_allowed_ptr_locked() is called with rq lock held and the above BPF program calls bpf_cgroup_from_id() within leading to the following lockdep warning: ===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.7.0-rc3-work-00053-g07124366a1d7-dirty #147 Not tainted ----------------------------------------------------- repro/1620 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffffffff833b3688 (kernfs_idr_lock){+.+.}-{2:2}, at: kernfs_find_and_get_node_by_id+0x1e/0x70 and this task is already holding: ffff888237ced698 (&rq->__lock){-.-.}-{2:2}, at: task_rq_lock+0x4e/0xf0 which would create a new lock dependency: (&rq->__lock){-.-.}-{2:2} -> (kernfs_idr_lock){+.+.}-{2:2} ... Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(kernfs_idr_lock); local_irq_disable(); lock(&rq->__lock); lock(kernfs_idr_lock); <Interrupt> lock(&rq->__lock); *** DEADLOCK *** ... Call Trace: dump_stack_lvl+0x55/0x70 dump_stack+0x10/0x20 __lock_acquire+0x781/0x2a40 lock_acquire+0xbf/0x1f0 _raw_spin_lock+0x2f/0x40 kernfs_find_and_get_node_by_id+0x1e/0x70 cgroup_get_from_id+0x21/0x240 bpf_cgroup_from_id+0xe/0x20 bpf_prog_98652316e9337a5a___set_cpus_allowed_ptr_locked+0x96/0x11a bpf_trampoline_6442545632+0x4f/0x1000 __set_cpus_allowed_ptr_locked+0x5/0x5a0 sched_setaffinity+0x1b3/0x290 __x64_sys_sched_setaffinity+0x4f/0x60 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e Let's fix it by protecting kernfs_node and kernfs_root with RCU and making kernfs_find_and_get_node_by_id() acquire rcu_read_lock() instead of kernfs_idr_lock. This adds an rcu_head to kernfs_node making it larger by 16 bytes on 64bit. Combined with the preceding rearrange patch, the net increase is 8 bytes. Signed-off-by: Tejun Heo <tj(a)kernel.org> Cc: Andrea Righi <andrea.righi(a)canonical.com> Cc: Geert Uytterhoeven <geert(a)linux-m68k.org> Link: https://lore.kernel.org/r/20240109214828.252092-4-tj@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/kernfs/kernfs-internal.h [Commit 50dfec9dae20("kernfs: kabi: Reserve KABI slots for kernfs_* struct") from OLK-6.6 add KABI_RESERVE in struct kernfs_root] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/kernfs/dir.c | 31 ++++++++++++++++++++----------- fs/kernfs/kernfs-internal.h | 2 ++ include/linux/kernfs.h | 2 ++ 3 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c index 62d39ecf0a46..2405aeb39b9a 100644 --- a/fs/kernfs/dir.c +++ b/fs/kernfs/dir.c @@ -529,6 +529,20 @@ void kernfs_get(struct kernfs_node *kn) } EXPORT_SYMBOL_GPL(kernfs_get); +static void kernfs_free_rcu(struct rcu_head *rcu) +{ + struct kernfs_node *kn = container_of(rcu, struct kernfs_node, rcu); + + kfree_const(kn->name); + + if (kn->iattr) { + simple_xattrs_free(&kn->iattr->xattrs, NULL); + kmem_cache_free(kernfs_iattrs_cache, kn->iattr); + } + + kmem_cache_free(kernfs_node_cache, kn); +} + /** * kernfs_put - put a reference count on a kernfs_node * @kn: the target kernfs_node @@ -557,16 +571,11 @@ void kernfs_put(struct kernfs_node *kn) if (kernfs_type(kn) == KERNFS_LINK) kernfs_put(kn->symlink.target_kn); - kfree_const(kn->name); - - if (kn->iattr) { - simple_xattrs_free(&kn->iattr->xattrs, NULL); - kmem_cache_free(kernfs_iattrs_cache, kn->iattr); - } spin_lock(&kernfs_idr_lock); idr_remove(&root->ino_idr, (u32)kernfs_ino(kn)); spin_unlock(&kernfs_idr_lock); - kmem_cache_free(kernfs_node_cache, kn); + + call_rcu(&kn->rcu, kernfs_free_rcu); kn = parent; if (kn) { @@ -575,7 +584,7 @@ void kernfs_put(struct kernfs_node *kn) } else { /* just released the root kn, free @root too */ idr_destroy(&root->ino_idr); - kfree(root); + kfree_rcu(root, rcu); } } EXPORT_SYMBOL_GPL(kernfs_put); @@ -715,7 +724,7 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, ino_t ino = kernfs_id_ino(id); u32 gen = kernfs_id_gen(id); - spin_lock(&kernfs_idr_lock); + rcu_read_lock(); kn = idr_find(&root->ino_idr, (u32)ino); if (!kn) @@ -739,10 +748,10 @@ struct kernfs_node *kernfs_find_and_get_node_by_id(struct kernfs_root *root, if (unlikely(!__kernfs_active(kn) || !atomic_inc_not_zero(&kn->count))) goto err_unlock; - spin_unlock(&kernfs_idr_lock); + rcu_read_unlock(); return kn; err_unlock: - spin_unlock(&kernfs_idr_lock); + rcu_read_unlock(); return NULL; } diff --git a/fs/kernfs/kernfs-internal.h b/fs/kernfs/kernfs-internal.h index ade12719da29..ad89bd8f1039 100644 --- a/fs/kernfs/kernfs-internal.h +++ b/fs/kernfs/kernfs-internal.h @@ -50,6 +50,8 @@ struct kernfs_root { struct rw_semaphore kernfs_iattr_rwsem; struct rw_semaphore kernfs_supers_rwsem; + struct rcu_head rcu; + KABI_RESERVE(1) KABI_RESERVE(2) KABI_RESERVE(3) diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h index bd3fbcb3c3f6..8c1766b47cfd 100644 --- a/include/linux/kernfs.h +++ b/include/linux/kernfs.h @@ -224,6 +224,8 @@ struct kernfs_node { unsigned short flags; umode_t mode; struct kernfs_iattrs *iattr; + + struct rcu_head rcu; }; /* -- 2.31.1

2 1

[PATCH 1/4] RDMA/hns: Fix a missing check of atomic wr length
by Chengchang Tang 09 May '24

09 May '24

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9MANQ --------------------------------------------------------------- The only supported length of atomic wr in kernel space is 8. The driver needs to check the length before post send. Fixes: 00a59d30f3f9 ("RDMA/hns: Optimize wqe buffer filling process for post send") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> --- drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 18 ++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 80870c278..d778fefbe 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -94,6 +94,8 @@ /* Configure to HW for PAGE_SIZE larger than 4KB */ #define PG_SHIFT_OFFSET (PAGE_SHIFT - 12) +#define ATOMIC_WR_LEN 8 + #define HNS_ROCE_IDX_QUE_ENTRY_SZ 4 #define SRQ_DB_REG 0x230 diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index b44bd4c3c..bc8818dc0 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -166,15 +166,22 @@ static void set_frmr_seg(struct hns_roce_v2_rc_send_wqe *rc_sq_wqe, hr_reg_clear(fseg, FRMR_BLK_MODE); } -static void set_atomic_seg(const struct ib_send_wr *wr, - struct hns_roce_v2_rc_send_wqe *rc_sq_wqe, - unsigned int valid_num_sge) +static int set_atomic_seg(struct hns_roce_dev *hr_dev, + const struct ib_send_wr *wr, + struct hns_roce_v2_rc_send_wqe *rc_sq_wqe, + unsigned int valid_num_sge, u32 msg_len) { struct hns_roce_v2_wqe_data_seg *dseg = (void *)rc_sq_wqe + sizeof(struct hns_roce_v2_rc_send_wqe); struct hns_roce_wqe_atomic_seg *aseg = (void *)dseg + sizeof(struct hns_roce_v2_wqe_data_seg); + if (msg_len != ATOMIC_WR_LEN) { + ibdev_err(&hr_dev->ib_dev, "invalid atomic wr len, len = %u.\n", + msg_len); + return -EINVAL; + } + set_data_seg_v2(dseg, wr->sg_list); if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP) { @@ -187,6 +194,8 @@ static void set_atomic_seg(const struct ib_send_wr *wr, } hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SGE_NUM, valid_num_sge); + + return 0; } static int fill_ext_sge_inl_data(struct hns_roce_qp *qp, @@ -681,7 +690,8 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP || wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) - set_atomic_seg(wr, rc_sq_wqe, valid_num_sge); + ret = set_atomic_seg(hr_dev, wr, rc_sq_wqe, valid_num_sge, + msg_len); else if (wr->opcode != IB_WR_REG_MR) ret = set_rwqe_data_seg(&qp->ibqp, wr, rc_sq_wqe, &curr_idx, valid_num_sge); -- 2.33.0

1 3

[PATCH OLK-5.10 0/3] arm64: Allow the boot CPU to be nohz_full
by Xiongfeng Wang 09 May '24

09 May '24

Xiongfeng Wang (3): Revert "sched/isolation: Require a present CPU in housekeeping mask" isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arch/arm64/Kconfig | 3 +++ include/linux/sched/isolation.h | 2 ++ kernel/sched/isolation.c | 32 ++++++++++++++++++++------------ kernel/smp.c | 4 ++++ 4 files changed, 29 insertions(+), 12 deletions(-) -- 2.30.0

2 4

[PATCH OLK-6.6 0/3] crypto: hisilicon fix some issues
by Wenkai Lin 09 May '24

09 May '24

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Chenghai Huang (2): crypto: hisilicon/zip - optimize the address offset of the reg query function crypto: hisilicon/qm - adjust the internal processing sequence of the vf enable and disable Wenkai Lin (1): uacce - fix for cdev memory leak drivers/crypto/hisilicon/qm.c | 7 +--- drivers/crypto/hisilicon/zip/zip_main.c | 48 +++++++++++-------------- drivers/misc/uacce/uacce.c | 11 +++++- 3 files changed, 31 insertions(+), 35 deletions(-) -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS] nilfs2: prevent kernel bug at submit_bh_wbc()
by Zheng Yejian 09 May '24

09 May '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v4.19.312 commit 91e4c4595fae5e87069e44687ae879091783c183 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5DI CVE: CVE-2024-26955 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 269cdf353b5bdd15f1a079671b0f889113865f20 ] Fix a bug where nilfs_get_block() returns a successful status when searching and inserting the specified block both fail inconsistently. If this inconsistent behavior is not due to a previously fixed bug, then an unexpected race is occurring, so return a temporary error -EAGAIN instead. This prevents callers such as __block_write_begin_int() from requesting a read into a buffer that is not mapped, which would cause the BUG_ON check for the BH_Mapped flag in submit_bh_wbc() to fail. Link: https://lkml.kernel.org/r/20240313105827.5296-3-konishi.ryusuke@gmail.com Fixes: 1f5abe7e7dbc ("nilfs2: replace BUG_ON and BUG calls triggerable from ioctl") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nilfs2/inode.c [In upstream branch linux-4.19.y, a dependent commit 5c8f85e9ff21 ("nilfs2: use a more common logging style"), but since bacporting it will introduce more dependent commits and this fix is simple, we can directly adapt this patch.] Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- fs/nilfs2/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index bfe3c7ccdf50..cbfe6ed764d3 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -107,7 +107,7 @@ int nilfs_get_block(struct inode *inode, sector_t blkoff, "%s (ino=%lu): a race condition while inserting a data block at offset=%llu", __func__, inode->i_ino, (unsigned long long)blkoff); - err = 0; + err = -EAGAIN; } nilfs_transaction_abort(inode->i_sb); goto out; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] scsi: qla2xxx: Fix command flush on cable pull
by Li Nan 09 May '24

09 May '24

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v4.19.312 commit b73377124f56d2fec154737c2f8d2e839c237d5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4QT CVE: CVE-2024-26931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a27d4d0e7de305def8a5098a614053be208d1aa1 upstream. System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL. Add a check to make sure commands are flush back on session tear down to prevent the null pointer access. Cc: stable(a)vger.kernel.org Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240227164127.36465-7-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/qla2xxx/qla_target.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c index e9545411ec5a..5236912603f0 100644 --- a/drivers/scsi/qla2xxx/qla_target.c +++ b/drivers/scsi/qla2xxx/qla_target.c @@ -1042,6 +1042,16 @@ void qlt_free_session_done(struct work_struct *work) "%s: sess %p logout completed\n", __func__, sess); } + /* check for any straggling io left behind */ + if (!(sess->flags & FCF_FCP2_DEVICE) && + qla2x00_eh_wait_for_pending_commands(sess->vha, sess->d_id.b24, 0, WAIT_TARGET)) { + ql_log(ql_log_warn, vha, 0x3027, + "IO not return. Resetting.\n"); + set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); + qla2xxx_wake_dpc(vha); + qla2x00_wait_for_chip_reset(vha); + } + if (sess->logo_ack_needed) { sess->logo_ack_needed = 0; qla24xx_async_notify_ack(vha, sess, -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] CVE-2024-27024
by Liu Jian 09 May '24

09 May '24

CVE-2024-27024 Edward Adam Davis (1): net/rds: fix WARNING in rds_conn_connect_if_down Mahmoud Adam (1): net/rds: fix possible cp null dereference net/rds/rdma.c | 3 +++ net/rds/send.c | 6 +----- 2 files changed, 4 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-27024
by Liu Jian 09 May '24

09 May '24

CVE-2024-27024 Edward Adam Davis (1): net/rds: fix WARNING in rds_conn_connect_if_down Mahmoud Adam (1): net/rds: fix possible cp null dereference net/rds/rdma.c | 3 +++ net/rds/send.c | 6 +----- 2 files changed, 4 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/3] backport patch for thp deferred list for 4.19
by Wupeng Ma 09 May '24

09 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport patch for thp deferred list Jianxing Wang (1): mm/mmu_gather: limit free batch count and add schedule point in tlb_batch_pages_flush Kirill A. Shutemov (1): mm, thp: do not queue fully unmapped pages for deferred split Yin Fengwei (1): THP: avoid lock when check whether THP is in deferred list mm/huge_memory.c | 17 ++++++++++++----- mm/mmu_gather.c | 16 ++++++++++++++-- mm/rmap.c | 14 ++++++++++---- 3 files changed, 36 insertions(+), 11 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] scsi: qla2xxx: Fix command flush on cable pull
by Li Nan 09 May '24

09 May '24

From: Quinn Tran <qutran(a)marvell.com> stable inclusion from stable-v5.10.215 commit 67b2d35853c2da25a8ca1c4190a5e96d3083c2ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4QT CVE: CVE-2024-26931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL. Add a check to make sure commands are flush back on session tear down to prevent the null pointer access. Cc: stable(a)vger.kernel.org Signed-off-by: Quinn Tran <qutran(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://lore.kernel.org/r/20240227164127.36465-7-njavali@marvell.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/scsi/qla2xxx/qla_target.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c index fdb424501da5..d2433f162815 100644 --- a/drivers/scsi/qla2xxx/qla_target.c +++ b/drivers/scsi/qla2xxx/qla_target.c @@ -1038,6 +1038,16 @@ void qlt_free_session_done(struct work_struct *work) "%s: sess %p logout completed\n", __func__, sess); } + /* check for any straggling io left behind */ + if (!(sess->flags & FCF_FCP2_DEVICE) && + qla2x00_eh_wait_for_pending_commands(sess->vha, sess->d_id.b24, 0, WAIT_TARGET)) { + ql_log(ql_log_warn, vha, 0x3027, + "IO not return. Resetting.\n"); + set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); + qla2xxx_wake_dpc(vha); + qla2x00_wait_for_chip_reset(vha); + } + if (sess->logo_ack_needed) { sess->logo_ack_needed = 0; qla24xx_async_notify_ack(vha, sess, -- 2.39.2

1 0

[PATCH OLK-5.10] nilfs2: prevent kernel bug at submit_bh_wbc()
by Zheng Yejian 09 May '24

09 May '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.215 commit f0fe7ad5aff4f0fcf988913313c497de85f1e186 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5DI CVE: CVE-2024-26955 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Fix a bug where nilfs_get_block() returns a successful status when searching and inserting the specified block both fail inconsistently. If this inconsistent behavior is not due to a previously fixed bug, then an unexpected race is occurring, so return a temporary error -EAGAIN instead. This prevents callers such as __block_write_begin_int() from requesting a read into a buffer that is not mapped, which would cause the BUG_ON check for the BH_Mapped flag in submit_bh_wbc() to fail. Link: https://lkml.kernel.org/r/20240313105827.5296-3-konishi.ryusuke@gmail.com Fixes: 1f5abe7e7dbc ("nilfs2: replace BUG_ON and BUG calls triggerable from ioctl") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- fs/nilfs2/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index d144e08a9003..06f4deb550c9 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -112,7 +112,7 @@ int nilfs_get_block(struct inode *inode, sector_t blkoff, "%s (ino=%lu): a race condition while inserting a data block at offset=%llu", __func__, inode->i_ino, (unsigned long long)blkoff); - err = 0; + err = -EAGAIN; } nilfs_transaction_abort(inode->i_sb); goto out; -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] backport patch for thp deferred list
by Wupeng Ma 09 May '24

09 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> backport patch for thp deferred list. Jianxing Wang (1): mm/mmu_gather: limit free batch count and add schedule point in tlb_batch_pages_flush Yin Fengwei (1): THP: avoid lock when check whether THP is in deferred list mm/huge_memory.c | 17 ++++++++++++----- mm/mmu_gather.c | 16 ++++++++++++++-- 2 files changed, 26 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
by Jialin Zhang 09 May '24

09 May '24

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v4.19.312 commit 9968c701cba7eda42e5f0052b040349d6222ae34 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IM CVE: CVE-2024-27059 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 014bcf41d946b36a8f0b8e9b5d9529efbb822f49 upstream. The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error). Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-and-tested-by: syzbot+28748250ab47a8f04100(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-usb/0000000000003eb868061245ba7f@google.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reviewed-by: PrasannaKumar Muralidharan <prasannatsmkumar(a)gmail.com> Reviewed-by: Martin K. Petersen <martin.petersen(a)oracle.com> Link: https://lore.kernel.org/r/b1e605ea-333f-4ac0-9511-da04f411763e@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/usb/storage/isd200.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c index f5e4500d9970..b7255659229c 100644 --- a/drivers/usb/storage/isd200.c +++ b/drivers/usb/storage/isd200.c @@ -1104,7 +1104,7 @@ static void isd200_dump_driveid(struct us_data *us, u16 *id) static int isd200_get_inquiry_data( struct us_data *us ) { struct isd200_info *info = (struct isd200_info *)us->extra; - int retStatus = ISD200_GOOD; + int retStatus; u16 *id = info->id; usb_stor_dbg(us, "Entering isd200_get_inquiry_data\n"); @@ -1136,6 +1136,13 @@ static int isd200_get_inquiry_data( struct us_data *us ) isd200_fix_driveid(id); isd200_dump_driveid(us, id); + /* Prevent division by 0 in isd200_scsi_to_ata() */ + if (id[ATA_ID_HEADS] == 0 || id[ATA_ID_SECTORS] == 0) { + usb_stor_dbg(us, " Invalid ATA Identify data\n"); + retStatus = ISD200_ERROR; + goto Done; + } + memset(&info->InquiryData, 0, sizeof(info->InquiryData)); /* Standard IDE interface only supports disks */ @@ -1201,6 +1208,7 @@ static int isd200_get_inquiry_data( struct us_data *us ) } } + Done: usb_stor_dbg(us, "Leaving isd200_get_inquiry_data %08X\n", retStatus); return(retStatus); @@ -1480,22 +1488,27 @@ static int isd200_init_info(struct us_data *us) static int isd200_Initialization(struct us_data *us) { + int rc = 0; + usb_stor_dbg(us, "ISD200 Initialization...\n"); /* Initialize ISD200 info struct */ - if (isd200_init_info(us) == ISD200_ERROR) { + if (isd200_init_info(us) < 0) { usb_stor_dbg(us, "ERROR Initializing ISD200 Info struct\n"); + rc = -ENOMEM; } else { /* Get device specific data */ - if (isd200_get_inquiry_data(us) != ISD200_GOOD) + if (isd200_get_inquiry_data(us) != ISD200_GOOD) { usb_stor_dbg(us, "ISD200 Initialization Failure\n"); - else + rc = -EINVAL; + } else { usb_stor_dbg(us, "ISD200 Initialization complete\n"); + } } - return 0; + return rc; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2 0/2] b43: fix CVE-2023-52644
by Dong Chenchen 09 May '24

09 May '24

fix CVE-2023-52644 Rahul Rameshbabu (1): wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled Saurav Girepunje (1): b43: dma: Fix use true/false for bool type variable drivers/net/wireless/broadcom/b43/b43.h | 16 ++++++++++++++++ drivers/net/wireless/broadcom/b43/dma.c | 8 ++++---- 2 files changed, 20 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 v2] nfs: fix UAF in direct writes
by Long Li 09 May '24

09 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.215 commit 4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9L5GC CVE: CVE-2024-26958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ] In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nfs/direct.c | 11 +++++++++-- fs/nfs/write.c | 2 +- include/linux/nfs_fs.h | 1 + 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 5d86ffa72cea..499519f0f6ec 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -678,10 +678,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) LIST_HEAD(mds_list); nfs_init_cinfo_from_dreq(&cinfo, dreq); + nfs_commit_begin(cinfo.mds); nfs_scan_commit(dreq->inode, &mds_list, &cinfo); res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo); - if (res < 0) /* res == -ENOMEM */ - nfs_direct_write_reschedule(dreq); + if (res < 0) { /* res == -ENOMEM */ + spin_lock(&dreq->lock); + if (dreq->flags == 0) + dreq->flags = NFS_ODIRECT_RESCHED_WRITES; + spin_unlock(&dreq->lock); + } + if (nfs_commit_end(cinfo.mds)) + nfs_direct_write_complete(dreq); } static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 0bc5c5fd5e10..11a5e1ef9781 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1634,7 +1634,7 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) !atomic_read(&cinfo->rpcs_out)); } -static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) { atomic_inc(&cinfo->rpcs_out); } diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index e39342945a80..7488864589a7 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -553,6 +553,7 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); extern int nfs_commit_inode(struct inode *, int); extern struct nfs_commit_data *nfs_commitdata_alloc(void); extern void nfs_commit_free(struct nfs_commit_data *data); +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo); bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); static inline int -- 2.31.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-27034
by Yifan Qiao 09 May '24

09 May '24

Chao Yu (3): f2fs: fix to stop filesystem update once CP failed f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info f2fs: compress: fix to cover normal cluster write with cp_rwsem NeilBrown (1): f2fs: replace congestion_wait() calls with io_schedule_timeout() fs/f2fs/f2fs.h | 26 ++++++++++++++++---------- fs/f2fs/checkpoint.c | 18 ++++++++++++------ fs/f2fs/compress.c | 36 ++++++++++++++++++++++-------------- fs/f2fs/data.c | 16 ++++++++-------- fs/f2fs/gc.c | 8 ++++---- fs/f2fs/node.c | 2 +- fs/f2fs/segment.c | 25 +++++++++++++++++-------- fs/f2fs/super.c | 6 ++---- 8 files changed, 82 insertions(+), 55 deletions(-) -- 2.39.2

2 5

[PATCH OLK-5.10] netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
by Ziyang Xuan 09 May '24

09 May '24

mainline inclusion from mainline-v6.9-rc5 commit d78d867dcea69c328db30df665be5be7d0148484 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4T1 CVE: CVE-2024-27019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_tables_objects list in __nft_obj_type_get(). Therefore, there is potential data-race of nf_tables_objects list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_objects list in __nft_obj_type_get(), and use rcu_read_lock() in the caller nft_obj_type_get() to protect the entire type query process. Fixes: e50092404c1b ("netfilter: nf_tables: add stateful objects") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [The version does not include commit 776d45164844.] Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 7bab8f7c7017..ec81a214aa2d 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6207,7 +6207,7 @@ static const struct nft_object_type *__nft_obj_type_get(u32 objtype) { const struct nft_object_type *type; - list_for_each_entry(type, &nf_tables_objects, list) { + list_for_each_entry_rcu(type, &nf_tables_objects, list) { if (objtype == type->type) return type; } @@ -6219,9 +6219,13 @@ nft_obj_type_get(struct net *net, u32 objtype) { const struct nft_object_type *type; + rcu_read_lock(); type = __nft_obj_type_get(objtype); - if (type != NULL && try_module_get(type->owner)) + if (type != NULL && try_module_get(type->owner)) { + rcu_read_unlock(); return type; + } + rcu_read_unlock(); lockdep_nfnl_nft_mutex_not_held(); #ifdef CONFIG_MODULES -- 2.25.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-27034
by Yifan Qiao 09 May '24

09 May '24

Chao Yu (3): f2fs: fix to stop filesystem update once CP failed f2fs: reduce stack memory cost by using bitfield in struct f2fs_io_info f2fs: compress: fix to cover normal cluster write with cp_rwsem NeilBrown (1): f2fs: replace congestion_wait() calls with io_schedule_timeout() fs/f2fs/f2fs.h | 26 ++++++++++++++++---------- fs/f2fs/checkpoint.c | 18 ++++++++++++------ fs/f2fs/compress.c | 36 ++++++++++++++++++++++-------------- fs/f2fs/data.c | 16 ++++++++-------- fs/f2fs/gc.c | 8 ++++---- fs/f2fs/node.c | 2 +- fs/f2fs/segment.c | 25 +++++++++++++++++-------- fs/f2fs/super.c | 6 ++---- 8 files changed, 82 insertions(+), 55 deletions(-) -- 2.39.2

2 5

[PATCH OLK-5.10] USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
by Jialin Zhang 09 May '24

09 May '24

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v5.10.215 commit 284fb1003d5da111019b9e0bf99b084fd71ac133 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IM CVE: CVE-2024-27059 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 014bcf41d946b36a8f0b8e9b5d9529efbb822f49 upstream. The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and head values when creating a CDB for READ or WRITE commands. The calculation involves division and modulus operations, which will cause a crash if either of these values is 0. While this never happens with a genuine device, it could happen with a flawed or subversive emulation, as reported by the syzbot fuzzer. Protect against this possibility by refusing to bind to the device if either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID information is 0. This requires isd200_Initialization() to return a negative error code when initialization fails; currently it always returns 0 (even when there is an error). Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-and-tested-by: syzbot+28748250ab47a8f04100(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-usb/0000000000003eb868061245ba7f@google.com/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reviewed-by: PrasannaKumar Muralidharan <prasannatsmkumar(a)gmail.com> Reviewed-by: Martin K. Petersen <martin.petersen(a)oracle.com> Link: https://lore.kernel.org/r/b1e605ea-333f-4ac0-9511-da04f411763e@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/usb/storage/isd200.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c index 3c76336e43bb..1d22db59f7bd 100644 --- a/drivers/usb/storage/isd200.c +++ b/drivers/usb/storage/isd200.c @@ -1105,7 +1105,7 @@ static void isd200_dump_driveid(struct us_data *us, u16 *id) static int isd200_get_inquiry_data( struct us_data *us ) { struct isd200_info *info = (struct isd200_info *)us->extra; - int retStatus = ISD200_GOOD; + int retStatus; u16 *id = info->id; usb_stor_dbg(us, "Entering isd200_get_inquiry_data\n"); @@ -1137,6 +1137,13 @@ static int isd200_get_inquiry_data( struct us_data *us ) isd200_fix_driveid(id); isd200_dump_driveid(us, id); + /* Prevent division by 0 in isd200_scsi_to_ata() */ + if (id[ATA_ID_HEADS] == 0 || id[ATA_ID_SECTORS] == 0) { + usb_stor_dbg(us, " Invalid ATA Identify data\n"); + retStatus = ISD200_ERROR; + goto Done; + } + memset(&info->InquiryData, 0, sizeof(info->InquiryData)); /* Standard IDE interface only supports disks */ @@ -1202,6 +1209,7 @@ static int isd200_get_inquiry_data( struct us_data *us ) } } + Done: usb_stor_dbg(us, "Leaving isd200_get_inquiry_data %08X\n", retStatus); return(retStatus); @@ -1481,22 +1489,27 @@ static int isd200_init_info(struct us_data *us) static int isd200_Initialization(struct us_data *us) { + int rc = 0; + usb_stor_dbg(us, "ISD200 Initialization...\n"); /* Initialize ISD200 info struct */ - if (isd200_init_info(us) == ISD200_ERROR) { + if (isd200_init_info(us) < 0) { usb_stor_dbg(us, "ERROR Initializing ISD200 Info struct\n"); + rc = -ENOMEM; } else { /* Get device specific data */ - if (isd200_get_inquiry_data(us) != ISD200_GOOD) + if (isd200_get_inquiry_data(us) != ISD200_GOOD) { usb_stor_dbg(us, "ISD200 Initialization Failure\n"); - else + rc = -EINVAL; + } else { usb_stor_dbg(us, "ISD200 Initialization complete\n"); + } } - return 0; + return rc; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] i40e: Fix NULL ptr dereference on VSI filter sync
by Zhang Zekun 09 May '24

09 May '24

From: Michal Maloszewski <michal.maloszewski(a)intel.com> stable inclusion from stable-v4.19.218 commit 87c421ab4a43433cb009fea44bbbc77f46913e1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFW CVE: CVE-2021-47184 --------------------------------------------- [ Upstream commit 37d9e304acd903a445df8208b8a13d707902dea6 ] Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Grzegorz Szczurek <grzegorzx.szczurek(a)intel.com> Signed-off-by: Michal Maloszewski <michal.maloszewski(a)intel.com> Reviewed-by: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> Reviewed-by: Witold Fijalkowski <witoldx.fijalkowski(a)intel.com> Reviewed-by: Jaroslaw Gawin <jaroslawx.gawin(a)intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Tony Brelinski <tony.brelinski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h index 6fcf51baca13..3bccf23135da 100644 --- a/drivers/net/ethernet/intel/i40e/i40e.h +++ b/drivers/net/ethernet/intel/i40e/i40e.h @@ -166,6 +166,7 @@ enum i40e_vsi_state_t { __I40E_VSI_OVERFLOW_PROMISC, __I40E_VSI_REINIT_REQUESTED, __I40E_VSI_DOWN_REQUESTED, + __I40E_VSI_RELEASING, /* This must be last as it determines the size of the BITMAP */ __I40E_VSI_STATE_SIZE__, }; diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index a728b6a7872c..fc6550979118 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -2584,7 +2584,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) for (v = 0; v < pf->num_alloc_vsi; v++) { if (pf->vsi[v] && - (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { + (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && + !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { int ret = i40e_sync_vsi_filters(pf->vsi[v]); if (ret) { @@ -12425,7 +12426,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); return -ENODEV; } - + set_bit(__I40E_VSI_RELEASING, vsi->state); uplink_seid = vsi->uplink_seid; if (vsi->type != I40E_VSI_SRIOV) { if (vsi->netdev_registered) { -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] media: v4l2-tpg: fix some memleaks in tpg_alloc
by Zhang Zekun 09 May '24

09 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v4.19.311 commit 0de691ff547d86dd54c24b40a81f9c925df8dd77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9JG CVE: CVE-2024-27078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8cf9c5051076e0eb958f4361d50d8b0c3ee6691c ] In tpg_alloc, resources should be deallocated in each and every error-handling paths, since they are allocated in for statements. Otherwise there would be memleaks because tpg_free is called only when tpg_alloc return 0. Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 52 +++++++++++++++---- 1 file changed, 42 insertions(+), 10 deletions(-) diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c index 2036b94269af..182a300e2d44 100644 --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c @@ -113,6 +113,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w) { unsigned pat; unsigned plane; + int ret = 0; tpg->max_line_width = max_w; for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++) { @@ -121,14 +122,18 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w) tpg->lines[pat][plane] = vzalloc(array3_size(max_w, 2, pixelsz)); - if (!tpg->lines[pat][plane]) - return -ENOMEM; + if (!tpg->lines[pat][plane]) { + ret = -ENOMEM; + goto free_lines; + } if (plane == 0) continue; tpg->downsampled_lines[pat][plane] = vzalloc(array3_size(max_w, 2, pixelsz)); - if (!tpg->downsampled_lines[pat][plane]) - return -ENOMEM; + if (!tpg->downsampled_lines[pat][plane]) { + ret = -ENOMEM; + goto free_lines; + } } } for (plane = 0; plane < TPG_MAX_PLANES; plane++) { @@ -136,18 +141,45 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w) tpg->contrast_line[plane] = vzalloc(array_size(pixelsz, max_w)); - if (!tpg->contrast_line[plane]) - return -ENOMEM; + if (!tpg->contrast_line[plane]) { + ret = -ENOMEM; + goto free_contrast_line; + } tpg->black_line[plane] = vzalloc(array_size(pixelsz, max_w)); - if (!tpg->black_line[plane]) - return -ENOMEM; + if (!tpg->black_line[plane]) { + ret = -ENOMEM; + goto free_contrast_line; + } tpg->random_line[plane] = vzalloc(array3_size(max_w, 2, pixelsz)); - if (!tpg->random_line[plane]) - return -ENOMEM; + if (!tpg->random_line[plane]) { + ret = -ENOMEM; + goto free_contrast_line; + } } return 0; + +free_contrast_line: + for (plane = 0; plane < TPG_MAX_PLANES; plane++) { + vfree(tpg->contrast_line[plane]); + vfree(tpg->black_line[plane]); + vfree(tpg->random_line[plane]); + tpg->contrast_line[plane] = NULL; + tpg->black_line[plane] = NULL; + tpg->random_line[plane] = NULL; + } +free_lines: + for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++) + for (plane = 0; plane < TPG_MAX_PLANES; plane++) { + vfree(tpg->lines[pat][plane]); + tpg->lines[pat][plane] = NULL; + if (plane == 0) + continue; + vfree(tpg->downsampled_lines[pat][plane]); + tpg->downsampled_lines[pat][plane] = NULL; + } + return ret; } EXPORT_SYMBOL_GPL(tpg_alloc); -- 2.17.1

2 1

[PATCH OLK-6.6] sched: programmable: Allow set tag for pid 1.
by Hui Tang 09 May '24

09 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NQM5 CVE: NA -------------------------------- Fixes: 34239429b125 ("sched: programmable: Add user interface of task tag") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 78f41a207767..d6d3b9f55f46 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3773,11 +3773,6 @@ static ssize_t pid_tag_write(struct file *file, const char __user *buf, if (!tsk) return -ESRCH; - if (unlikely(tsk->pid == 1)) { - err = -EPERM; - goto out; - } - err = kstrtol_from_user(buf, count, 0, &tag); if (err) goto out; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-27001 for 4.19
by Wupeng Ma 09 May '24

09 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-27001 for 4.19. Nikita Zhandarovich (1): comedi: vmk80xx: fix incomplete endpoint checking drivers/staging/comedi/drivers/vmk80xx.c | 35 ++++++++---------------- 1 file changed, 12 insertions(+), 23 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
by Zheng Yejian 09 May '24

09 May '24

From: Siddh Raman Pant <siddh.raman.pant(a)oracle.com> stable inclusion from stable-v4.19.313 commit 34925d01baf3ee62ab21c21efd9e2c44c24c004a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HL6U CVE: CVE-2024-26920 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- This reverts commit bcf4a115a5068f3331fafb8c176c1af0da3d8b19 which is commit 0958b33ef5a04ed91f61cef4760ac412080c4e08 upstream. The change has an incorrect assumption about the return value because in the current stable trees for versions 5.15 and before, the following commit responsible for making 0 a success value is not present: b8cc44a4d3c1 ("tracing: Remove logic for registering multiple event triggers at a time") The return value should be 0 on failure in the current tree, because in the functions event_trigger_callback() and event_enable_trigger_func(), we have: ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file); /* * The above returns on success the # of functions enabled, * but if it didn't find any functions it returns zero. * Consider no functions a failure too. */ if (!ret) { ret = -ENOENT; Cc: stable(a)kernel.org # 5.15, 5.10, 5.4, 4.19 Signed-off-by: Siddh Raman Pant <siddh.raman.pant(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Fixes: fe7309013a81 ("tracing/trigger: Fix to return error if failed to alloc snapshot") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_events_trigger.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c index 697cc52cc37e..4288f4240fee 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -1074,10 +1074,8 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops, struct event_trigger_data *data, struct trace_event_file *file) { - int ret = tracing_alloc_snapshot_instance(file->tr); - - if (ret < 0) - return ret; + if (tracing_alloc_snapshot_instance(file->tr) != 0) + return 0; return register_trigger(glob, ops, data, file); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
by Li Zetao 09 May '24

09 May '24

From: Gabor Juhos <j4g8y7(a)gmail.com> stable inclusion from stable-v4.19.312 commit 5533686e99b04994d7c4877dc0e4282adc9444a2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5G5 CVE: CVE-2024-26966 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a903cfd38d8dee7e754fb89fd1bebed99e28003d ] The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested. Fixes: 2b46cd23a5a2 ("clk: qcom: Add APQ8084 Multimedia Clock Controller (MMCC) support") Signed-off-by: Gabor Juhos <j4g8y7(a)gmail.com> Reviewed-by: Stephen Boyd <sboyd(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-6-074334f0905c@… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- drivers/clk/qcom/mmcc-apq8084.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/qcom/mmcc-apq8084.c b/drivers/clk/qcom/mmcc-apq8084.c index 4ce1d7c88377f..36a40b0ddfa1f 100644 --- a/drivers/clk/qcom/mmcc-apq8084.c +++ b/drivers/clk/qcom/mmcc-apq8084.c @@ -341,6 +341,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = { F(333430000, P_MMPLL1, 3.5, 0, 0), F(400000000, P_MMPLL0, 2, 0, 0), F(466800000, P_MMPLL1, 2.5, 0, 0), + { } }; static struct clk_rcg2 mmss_axi_clk_src = { @@ -365,6 +366,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = { F(150000000, P_GPLL0, 4, 0, 0), F(228570000, P_MMPLL0, 3.5, 0, 0), F(320000000, P_MMPLL0, 2.5, 0, 0), + { } }; static struct clk_rcg2 ocmemnoc_clk_src = { -- 2.34.1

2 1

[PATCH OLK-5.10] Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
by Zheng Yejian 09 May '24

09 May '24

From: Siddh Raman Pant <siddh.raman.pant(a)oracle.com> stable inclusion from stable-v5.10.216 commit 26ebeffff238488466fa578be3b35b8a46e69906 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HL6U CVE: CVE-2024-26920 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- This reverts commit 56cfbe60710772916a5ba092c99542332b48e870 which is commit 0958b33ef5a04ed91f61cef4760ac412080c4e08 upstream. The change has an incorrect assumption about the return value because in the current stable trees for versions 5.15 and before, the following commit responsible for making 0 a success value is not present: b8cc44a4d3c1 ("tracing: Remove logic for registering multiple event triggers at a time") The return value should be 0 on failure in the current tree, because in the functions event_trigger_callback() and event_enable_trigger_func(), we have: ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file); /* * The above returns on success the # of functions enabled, * but if it didn't find any functions it returns zero. * Consider no functions a failure too. */ if (!ret) { ret = -ENOENT; Cc: stable(a)kernel.org # 5.15, 5.10, 5.4, 4.19 Signed-off-by: Siddh Raman Pant <siddh.raman.pant(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Fixes: 4b28b68db9d9 ("tracing/trigger: Fix to return error if failed to alloc snapshot") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_events_trigger.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c index 64abc66b82e5..3c6229f16e81 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -1140,10 +1140,8 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops, struct event_trigger_data *data, struct trace_event_file *file) { - int ret = tracing_alloc_snapshot_instance(file->tr); - - if (ret < 0) - return ret; + if (tracing_alloc_snapshot_instance(file->tr) != 0) + return 0; return register_trigger(glob, ops, data, file); } -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] fix CVE-2024-27001 for 5.10
by Wupeng Ma 09 May '24

09 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-27001 for 5.10. Nikita Zhandarovich (1): comedi: vmk80xx: fix incomplete endpoint checking drivers/staging/comedi/drivers/vmk80xx.c | 35 ++++++++---------------- 1 file changed, 12 insertions(+), 23 deletions(-) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS 21328/22325] drivers/scsi/sssraid/sssraid_os.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 09 May '24

09 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c95e10512c79660564907e3ba0c6403dcbd99d18 commit: 2e2a4edd9d4a725c5474dc278b090913d9b5bfd5 [21328/22325] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers config: x86_64-buildonly-randconfig-005-20240509 (https://download.01.org/0day-ci/archive/20240509/202405091039.NCGh5Ism-lkp@…) compiler: gcc-11 (Ubuntu 11.4.0-4ubuntu1) 11.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240509/202405091039.NCGh5Ism-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405091039.NCGh5Ism-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/scsi/sssraid/sssraid_os.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] sched: programmable: Allow set tag for pid 1.
by Hui Tang 09 May '24

09 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NQM5 CVE: NA -------------------------------- Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 78f41a207767..d6d3b9f55f46 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3773,11 +3773,6 @@ static ssize_t pid_tag_write(struct file *file, const char __user *buf, if (!tsk) return -ESRCH; - if (unlikely(tsk->pid == 1)) { - err = -EPERM; - goto out; - } - err = kstrtol_from_user(buf, count, 0, &tag); if (err) goto out; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2024-26865
by Zhengchao Shao 09 May '24

09 May '24

Fix CVE-2024-26865. Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): tcp: Clean up kernel listener's reqsk in inet_twsk_purge() net/ipv4/inet_timewait_sock.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] net: ath9k: fix CVE-2024-26897
by Dong Chenchen 09 May '24

09 May '24

fix CVE-2024-26897 Tetsuo Handa (1): ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() Toke Høiland-Jørgensen (1): wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete drivers/net/wireless/ath/ath9k/htc.h | 1 + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 4 ++++ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 1 + drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++++ 4 files changed, 12 insertions(+) -- 2.25.1

2 3

[PATCH v3 openEuler-1.0-LTS 0/2] Fix CVE-2022-48693
by Li Huafei 09 May '24

09 May '24

v2->v3: - Modify patch format: add 'category' and 'Reference' Liang He (1): soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs Miaoqian Lin (1): soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe drivers/soc/bcm/brcmstb/pm/pm-arm.c | 51 ++++++++++++++++++++++------- 1 file changed, 40 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/6] Fixes and cleanups to fs-writeback
by Zhihao Cheng 09 May '24

09 May '24

From: Zhihao Cheng <chengzhihao(a)huaweicloud.com> Kemeng Shi (6): fs/writeback: avoid to writeback non-expired inode in kupdate writeback fs/writeback: bail out if there is no more inodes for IO and queued once fs/writeback: remove unused parameter wb of finish_writeback_work fs/writeback: only calculate dirtied_before when b_io is empty fs/writeback: correct comment of __wakeup_flusher_threads_bdi fs/writeback: remove unnecessary return in writeback_inodes_sb fs/fs-writeback.c | 57 +++++++++++++++++++++++++++-------------------- 1 file changed, 33 insertions(+), 24 deletions(-) -- 2.31.1

2 7

[PATCH openEuler-1.0-LTS V1] nilfs2: fix OOB in nilfs_set_de_type
by Cheng Yu 09 May '24

09 May '24

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.9-rc5 commit c4a7dc9523b59b3e73fd522c73e95e072f876b16 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5GD CVE: CVE-2024-26981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT". static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode *inode) { umode_t mode = inode->i_mode; de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob } However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors. Link: https://lkml.kernel.org/r/20240415182048.7144-1-konishi.ryusuke@gmail.com Reported-by: syzbot+2e22057de05b9f3b30d8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2e22057de05b9f3b30d8 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 81394e22d0a0..eb7de9e2a384 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -243,7 +243,7 @@ nilfs_filetype_table[NILFS_FT_MAX] = { #define S_SHIFT 12 static unsigned char -nilfs_type_by_mode[S_IFMT >> S_SHIFT] = { +nilfs_type_by_mode[(S_IFMT >> S_SHIFT) + 1] = { [S_IFREG >> S_SHIFT] = NILFS_FT_REG_FILE, [S_IFDIR >> S_SHIFT] = NILFS_FT_DIR, [S_IFCHR >> S_SHIFT] = NILFS_FT_CHRDEV, -- 2.25.1

2 1

[PATCH OLK-5.10] media: edia: dvbdev: fix a use-after-free
by liwei 09 May '24

09 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9MA CVE: CVE-2024-27043 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain: budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in dvb_register_device) could point to memory that had been freed in dvb_register_device. Thereafter, this pointer is transferred to kref_put and triggering a use-after-free. Link: https://lore.kernel.org/linux-media/20240203134046.3120099-1-alexious@zju.e… Fixes: b61901024776 ("V4L/DVB (5244): Dvbdev: fix illegal re-usage of fileoperations struct") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/media/dvb-core/dvbdev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index 2ff8a1b776fb..467be48b9004 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -502,6 +502,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL); if (!dvbdevfops) { kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } @@ -510,6 +511,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, if (!new_node) { kfree(dvbdevfops); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } @@ -543,6 +545,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, } list_del (&dvbdev->list_head); kfree(dvbdev); + *pdvbdev = NULL; up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); return -EINVAL; @@ -565,6 +568,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvb_media_device_free(dvbdev); list_del (&dvbdev->list_head); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return ret; } @@ -583,6 +587,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvb_media_device_free(dvbdev); list_del (&dvbdev->list_head); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return PTR_ERR(clsdev); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
by Liu Chuang 09 May '24

09 May '24

From: Gabor Juhos <j4g8y7(a)gmail.com> stable inclusion from stable-v4.19.312 commit e117c6e2d1617520f5f7d7f6f6b395f01d8b5a27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NOH8 CVE: CVE-2024-26969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1040ef5ed95d6fd2628bad387d78a61633e09429 ] The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested. Fixes: 9607f6224b39 ("clk: qcom: ipq8074: add PCIE, USB and SDCC clocks") Signed-off-by: Gabor Juhos <j4g8y7(a)gmail.com> Reviewed-by: Stephen Boyd <sboyd(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-3-074334f0905c@… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/clk/qcom/gcc-ipq8074.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c index 505c6263141d..9a6f0c1159aa 100644 --- a/drivers/clk/qcom/gcc-ipq8074.c +++ b/drivers/clk/qcom/gcc-ipq8074.c @@ -985,6 +985,7 @@ static struct clk_rcg2 pcie0_axi_clk_src = { static const struct freq_tbl ftbl_pcie_aux_clk_src[] = { F(19200000, P_XO, 1, 0, 0), + { } }; static struct clk_rcg2 pcie0_aux_clk_src = { @@ -1090,6 +1091,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = { F(19200000, P_XO, 1, 0, 0), F(160000000, P_GPLL0, 5, 0, 0), F(308570000, P_GPLL6, 3.5, 0, 0), + { } }; static struct clk_rcg2 sdcc1_ice_core_clk_src = { -- 2.34.1

2 1

[PATCH OLK-6.6 v3 0/2] bugfix patches from OLK-5.10
by Xiongfeng Wang 09 May '24

09 May '24

Guilherme G. Piccoli (2): x86/PCI: Export find_cap() to be used in early PCI code x86/quirks: Add parameter to clear MSIs early on boot .../admin-guide/kernel-parameters.txt | 6 ++++ arch/x86/include/asm/pci-direct.h | 2 ++ arch/x86/kernel/aperture_64.c | 30 ++--------------- arch/x86/kernel/early-quirks.c | 32 +++++++++++++++++++ arch/x86/pci/common.c | 4 +++ arch/x86/pci/early.c | 25 +++++++++++++++ 6 files changed, 71 insertions(+), 28 deletions(-) -- 2.20.1

2 3

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 9ff44822aad3feccdf9b76d1b04aa62e958c05e0
by kernel test robot 09 May '24

09 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 9ff44822aad3feccdf9b76d1b04aa62e958c05e0 !6944 USB: core: Fix deadlock in usb_deauthorize_interface() Unverified Error/Warning (likely false positive, please contact us if interested): drivers/pinctrl/.tmp_pinctrl-ingenic.o: warning: objtool: ingenic_pinconf_set()+0x9c: sibling call from callable instruction with modified stack frame Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-004-20240509 | `-- include-linux-uaccess.h:warning:iocommand-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20240508 | `-- drivers-pinctrl-.tmp_pinctrl-ingenic.o:warning:objtool:ingenic_pinconf_set:sibling-call-from-callable-instruction-with-modified-stack-frame |-- x86_64-defconfig | |-- include-linux-list.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node | `-- mm-swapfile.c:warning:array-subscript-pfo_ret__-is-outside-array-bounds-of-struct-plist_node |-- x86_64-randconfig-001-20240509 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | `-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int |-- x86_64-randconfig-013-20240509 | |-- include-linux-compiler.h:warning:array-subscript-index-is-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-compiler.h:warning:array-subscript-unknown-is-outside-array-bounds-of-const-u32-aka-const-unsigned-int | `-- kernel-sched-sparsemask.h:warning:array-subscript-is-outside-array-bounds-of-const-struct-sparsemask_chunk `-- x86_64-randconfig-076-20240509 |-- include-linux-spinlock.h:warning:array-subscript-is-outside-array-bounds-of-struct-small_page_pool |-- mm-hugetlb.c:warning:array-subscript-is-outside-array-bounds-of-struct-small_page_pool `-- mm-memcontrol.c:warning:array-subscript-is-outside-array-bounds-of-struct-small_page_pool clang_recent_errors |-- x86_64-allyesconfig | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-002-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-005-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-006-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-011-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-012-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-014-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-015-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-071-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-072-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-073-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-074-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-075-20240509 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) `-- x86_64-rhel-8.3-rust `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) elapsed time: 745m configs tested: 36 configs skipped: 146 tested configs: arm64 alldefconfig gcc arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240509 gcc arm64 randconfig-002-20240509 gcc arm64 randconfig-003-20240509 gcc arm64 randconfig-004-20240509 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240509 clang x86_64 buildonly-randconfig-002-20240509 clang x86_64 buildonly-randconfig-003-20240509 gcc x86_64 buildonly-randconfig-004-20240509 gcc x86_64 buildonly-randconfig-005-20240509 gcc x86_64 buildonly-randconfig-006-20240509 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240509 gcc x86_64 randconfig-002-20240509 clang x86_64 randconfig-003-20240509 gcc x86_64 randconfig-004-20240509 gcc x86_64 randconfig-005-20240509 clang x86_64 randconfig-006-20240509 clang x86_64 randconfig-011-20240509 clang x86_64 randconfig-012-20240509 clang x86_64 randconfig-013-20240509 gcc x86_64 randconfig-014-20240509 clang x86_64 randconfig-015-20240509 clang x86_64 randconfig-016-20240509 gcc x86_64 randconfig-071-20240509 clang x86_64 randconfig-072-20240509 clang x86_64 randconfig-073-20240509 clang x86_64 randconfig-074-20240509 clang x86_64 randconfig-075-20240509 clang x86_64 randconfig-076-20240509 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 8c0dfc8b996502f065bb072eb44f2ef912277805
by kernel test robot 09 May '24

09 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 8c0dfc8b996502f065bb072eb44f2ef912277805 !6844 block: fix deadlock between bd_link_disk_holder and partition scan Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405090620.ipiUsJT5-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/yunsilicon/xsc/net/main.c:2628:28: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'? Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | `-- arch-arm64-kernel-cpufeature.c:error:enable_pseudo_nmi-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-076-20240509 `-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:error:struct-pci_dev-has-no-member-named-physfn clang_recent_errors |-- arm64-allmodconfig | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_before_active_check | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_destroy | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_init_slave | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_netdev_event | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_service_proc | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_tracker_get | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_deatch_bond | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_detach_nic_bond_work | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev_by_name | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_queue_bond_work | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq_destroy.c:warning:no-previous-prototype-for-function-roce3_cq_hw2sw | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_cleanup_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_init_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_alloc | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_disable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_enable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_res.c:warning:no-previous-prototype-for-function-hmm_rdma_mpt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_alloc_mr | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_free_tpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_umem_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_context_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_ext_ctx_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_dif_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_verbs_cmd.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-mr-roce_mr.c:warning:no-previous-prototype-for-function-roce3_check_mr_status | |-- drivers-infiniband-hw-hiroce3-rdma-rdma_comp.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_bond_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_link_event | |-- drivers-infiniband-hw-hiroce3-roce_sysfs.c:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-bat_table-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_fill_cla | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_numb-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_type-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_fill_cla()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_lock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_unlock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_xyz()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-free_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-malloc_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-bloomfilter_init_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-k_flag-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-op-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-bloomfilter_init_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_dec()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_inc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd_buf-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box_async()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_imm()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_record-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-direct_wqe-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-object-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-pagenum-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_get_db_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_direct_wqe_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_fc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_update_pri()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_software_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_get_hardware_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-data-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-event-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_capability_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_template-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_aeq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_capability_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ecq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nocq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_scq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_register()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_unregister()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-bh-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-common-not-described-in-cqm_object_share_recv_queue_add_container | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_number-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_gid_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_timer_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-function_id-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-global_funcid-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_base-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_number-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-init_rq_num-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_funcid | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_old | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-room_header_alloc-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-xid-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_hash_buf_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_timer_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_gid_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_fc_srq_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_funcid()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_alloc_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_old()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_add_container()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_timer_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_free_srq_bitmap_index | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-common-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-container_addr-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link_mode-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_container_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_used_rq_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_head_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_tail_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-tail-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_per_buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_linkwqe_fill()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_bitmap_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_container_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_used_rq_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_cfg.c:warning:expecting-prototype-for-hinic_set_vf_dev_cap().-Prototype-was-for-hinic3_init_vf_dev_cap()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_get | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__mbox_to_host | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-comm_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-get_slave_func_netdev_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hilink_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_get_master_host_mbox_enable | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_nic_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_register_slave_ppf | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-set_slave_func_nic_state | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-sw_func_ppf_mbox_handler |-- x86_64-allnoconfig | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:linux-version.h-not-needed. | |-- drivers-infiniband-hw-hiroce3-roce.h:linux-version.h-not-needed. | |-- drivers-net-ethernet-huawei-hinic3-bond-hinic3_bond.c:linux-version.h-not-needed. | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:hinic3_hwif.h-is-included-more-than-once. |-- x86_64-randconfig-011-20240509 | |-- kernel-sched-fair.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ctl_table | `-- kernel-sched-fair.c:error:use-of-undeclared-identifier-hundred_thousand |-- x86_64-randconfig-012-20240509 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | `-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats |-- x86_64-randconfig-014-20240509 | `-- kernel-sched-psi.c:error:function-definition-is-not-allowed-here `-- x86_64-randconfig-074-20240509 |-- kernel-sched-fair.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ctl_table `-- kernel-sched-fair.c:error:use-of-undeclared-identifier-hundred_thousand elapsed time: 723m configs tested: 40 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240509 clang arm64 randconfig-002-20240509 clang arm64 randconfig-003-20240509 gcc arm64 randconfig-004-20240509 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240509 gcc loongarch randconfig-002-20240509 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240509 clang x86_64 buildonly-randconfig-002-20240509 clang x86_64 buildonly-randconfig-003-20240509 gcc x86_64 buildonly-randconfig-004-20240509 gcc x86_64 buildonly-randconfig-005-20240509 gcc x86_64 buildonly-randconfig-006-20240509 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240509 gcc x86_64 randconfig-002-20240509 clang x86_64 randconfig-003-20240509 gcc x86_64 randconfig-004-20240509 gcc x86_64 randconfig-005-20240509 clang x86_64 randconfig-006-20240509 clang x86_64 randconfig-011-20240509 clang x86_64 randconfig-012-20240509 clang x86_64 randconfig-013-20240509 gcc x86_64 randconfig-014-20240509 clang x86_64 randconfig-015-20240509 clang x86_64 randconfig-016-20240509 gcc x86_64 randconfig-071-20240509 clang x86_64 randconfig-072-20240509 clang x86_64 randconfig-073-20240509 clang x86_64 randconfig-074-20240509 clang x86_64 randconfig-075-20240509 clang x86_64 randconfig-076-20240509 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS e706c6b612a11ab8048819097bcfa5f465488cb2
by kernel test robot 09 May '24

09 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: e706c6b612a11ab8048819097bcfa5f465488cb2 !6943 speakup: Avoid crash on very long word Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | `-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed. elapsed time: 773m configs tested: 36 configs skipped: 149 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 alldefconfig gcc arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240509 clang arm64 randconfig-002-20240509 clang arm64 randconfig-003-20240509 gcc arm64 randconfig-004-20240509 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240509 clang x86_64 buildonly-randconfig-002-20240509 clang x86_64 buildonly-randconfig-003-20240509 gcc x86_64 buildonly-randconfig-004-20240509 gcc x86_64 buildonly-randconfig-005-20240509 gcc x86_64 buildonly-randconfig-006-20240509 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240509 gcc x86_64 randconfig-002-20240509 clang x86_64 randconfig-003-20240509 gcc x86_64 randconfig-004-20240509 gcc x86_64 randconfig-005-20240509 clang x86_64 randconfig-006-20240509 clang x86_64 randconfig-011-20240509 clang x86_64 randconfig-012-20240509 clang x86_64 randconfig-013-20240509 gcc x86_64 randconfig-014-20240509 clang x86_64 randconfig-015-20240509 clang x86_64 randconfig-016-20240509 gcc x86_64 randconfig-071-20240509 clang x86_64 randconfig-072-20240509 clang x86_64 randconfig-073-20240509 clang x86_64 randconfig-074-20240509 clang x86_64 randconfig-075-20240509 clang x86_64 randconfig-076-20240509 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7634/9457] drivers/net/ethernet/yunsilicon/xsc/net/main.c:2628:28: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'?
by kernel test robot 09 May '24

09 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8c0dfc8b996502f065bb072eb44f2ef912277805 commit: 601fb01dc16f747534b866610743d95830b6655e [7634/9457] drivers: support for xsc drivers from Yunsilicon Technology config: x86_64-randconfig-076-20240509 (https://download.01.org/0day-ci/archive/20240509/202405090620.ipiUsJT5-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240509/202405090620.ipiUsJT5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405090620.ipiUsJT5-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/yunsilicon/xsc/net/main.c:295:5: warning: no previous prototype for 'xsc_eth_destroy_cq' [-Wmissing-prototypes] 295 | int xsc_eth_destroy_cq(struct xsc_core_device *xdev, struct xsc_cq *cq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:333:6: warning: no previous prototype for 'xsc_eth_free_cq' [-Wmissing-prototypes] 333 | void xsc_eth_free_cq(struct xsc_cq *cq) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:338:5: warning: no previous prototype for 'xsc_eth_create_rss_qp_rqs' [-Wmissing-prototypes] 338 | int xsc_eth_create_rss_qp_rqs(struct xsc_core_device *xdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:359:6: warning: no previous prototype for 'xsc_eth_qp_event' [-Wmissing-prototypes] 359 | void xsc_eth_qp_event(struct xsc_core_qp *qp, int type) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:389:5: warning: no previous prototype for 'xsc_eth_create_qp_rq' [-Wmissing-prototypes] 389 | int xsc_eth_create_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:416:5: warning: no previous prototype for 'xsc_eth_destroy_qp_rq' [-Wmissing-prototypes] 416 | int xsc_eth_destroy_qp_rq(struct xsc_core_device *xdev, struct xsc_rq *prq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:469:5: warning: no previous prototype for 'xsc_eth_create_qp_sq' [-Wmissing-prototypes] 469 | int xsc_eth_create_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:488:5: warning: no previous prototype for 'xsc_eth_modify_qp_sq' [-Wmissing-prototypes] 488 | int xsc_eth_modify_qp_sq(struct xsc_core_device *xdev, struct xsc_modify_raw_qp_mbox_in *in) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:506:5: warning: no previous prototype for 'xsc_eth_destroy_qp_sq' [-Wmissing-prototypes] 506 | int xsc_eth_destroy_qp_sq(struct xsc_core_device *xdev, struct xsc_sq *psq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:750:5: warning: no previous prototype for 'xsc_eth_set_hw_mtu' [-Wmissing-prototypes] 750 | int xsc_eth_set_hw_mtu(struct xsc_core_device *dev, u16 mtu, u16 rx_buf_sz) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:775:5: warning: no previous prototype for 'xsc_eth_get_mac' [-Wmissing-prototypes] 775 | int xsc_eth_get_mac(struct xsc_core_device *dev, char *mac) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:806:5: warning: no previous prototype for 'xsc_eth_modify_qps_channel' [-Wmissing-prototypes] 806 | int xsc_eth_modify_qps_channel(struct xsc_adapter *adapter, struct xsc_channel *c) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:828:5: warning: no previous prototype for 'xsc_eth_modify_qps' [-Wmissing-prototypes] 828 | int xsc_eth_modify_qps(struct xsc_adapter *adapter, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:845:5: warning: no previous prototype for 'xsc_rx_get_linear_frag_sz' [-Wmissing-prototypes] 845 | u32 xsc_rx_get_linear_frag_sz(u32 mtu) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:852:6: warning: no previous prototype for 'xsc_rx_is_linear_skb' [-Wmissing-prototypes] 852 | bool xsc_rx_is_linear_skb(u32 mtu) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1316:5: warning: no previous prototype for 'xsc_eth_open_channel' [-Wmissing-prototypes] 1316 | int xsc_eth_open_channel(struct xsc_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1528:5: warning: no previous prototype for 'xsc_eth_open_channels' [-Wmissing-prototypes] 1528 | int xsc_eth_open_channels(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1640:6: warning: no previous prototype for 'xsc_eth_activate_channel' [-Wmissing-prototypes] 1640 | void xsc_eth_activate_channel(struct xsc_channel *c) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1646:6: warning: no previous prototype for 'xsc_eth_deactivate_channel' [-Wmissing-prototypes] 1646 | void xsc_eth_deactivate_channel(struct xsc_channel *c) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1692:6: warning: no previous prototype for 'xsc_eth_activate_priv_channels' [-Wmissing-prototypes] 1692 | void xsc_eth_activate_priv_channels(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1707:6: warning: no previous prototype for 'xsc_eth_deactivate_priv_channels' [-Wmissing-prototypes] 1707 | void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1850:5: warning: no previous prototype for 'xsc_eth_change_link_status' [-Wmissing-prototypes] 1850 | int xsc_eth_change_link_status(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1907:6: warning: no previous prototype for 'xsc_eth_event_handler' [-Wmissing-prototypes] 1907 | void xsc_eth_event_handler(void *arg) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1915:5: warning: no previous prototype for 'xsc_eth_enable_nic_hca' [-Wmissing-prototypes] 1915 | int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1977:5: warning: no previous prototype for 'xsc_eth_disable_nic_hca' [-Wmissing-prototypes] 1977 | int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2010:6: warning: no previous prototype for 'xsc_eth_rss_params_change' [-Wmissing-prototypes] 2010 | void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2318:6: warning: no previous prototype for 'xsc_build_default_indir_rqt' [-Wmissing-prototypes] 2318 | void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2416:5: warning: no previous prototype for 'xsc_eth_nic_mtu_changed' [-Wmissing-prototypes] 2416 | int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2479:5: warning: no previous prototype for 'xsc_set_vf_mac' [-Wmissing-prototypes] 2479 | int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) | ^~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2496:5: warning: no previous prototype for 'xsc_get_vf_config' [-Wmissing-prototypes] 2496 | int xsc_get_vf_config(struct net_device *dev, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2512:5: warning: no previous prototype for 'set_feature_rxcsum' [-Wmissing-prototypes] 2512 | int set_feature_rxcsum(struct net_device *netdev, bool enable) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2564:5: warning: no previous prototype for 'xsc_eth_set_features' [-Wmissing-prototypes] 2564 | int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2581:5: warning: no previous prototype for 'xsc_select_queue' [-Wmissing-prototypes] 2581 | u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c: In function 'xsc_get_phys_port_name': >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2628:28: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'? 2628 | if (!pdev->physfn) | ^~~~~~ | is_physfn drivers/net/ethernet/yunsilicon/xsc/net/main.c:2630:49: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'? 2630 | pf_xdev = pci_get_drvdata(pdev->physfn); | ^~~~~~ | is_physfn drivers/net/ethernet/yunsilicon/xsc/net/main.c: At top level: drivers/net/ethernet/yunsilicon/xsc/net/main.c:2769:24: warning: no previous prototype for 'xsc_tirc_get_default_config' [-Wmissing-prototypes] 2769 | struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2774:6: warning: no previous prototype for 'xsc_build_rss_params' [-Wmissing-prototypes] 2774 | void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2792:6: warning: no previous prototype for 'xsc_eth_build_nic_params' [-Wmissing-prototypes] 2792 | void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2814:6: warning: no previous prototype for 'xsc_eth_build_nic_netdev' [-Wmissing-prototypes] 2814 | void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2885:5: warning: no previous prototype for 'xsc_eth_create_xdev_resources' [-Wmissing-prototypes] 2885 | int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2906:5: warning: no previous prototype for 'xsc_eth_init_nic_rx' [-Wmissing-prototypes] 2906 | int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ vim +2628 drivers/net/ethernet/yunsilicon/xsc/net/main.c 2614 2615 static int xsc_get_phys_port_name(struct net_device *dev, 2616 char *buf, size_t len) 2617 { 2618 struct xsc_adapter *adapter = netdev_priv(dev); 2619 struct xsc_core_device *xdev = adapter->xdev; 2620 struct xsc_core_device *pf_xdev; 2621 struct net_device *pf_netdev; 2622 struct pci_dev *pdev = xdev->pdev; 2623 int ret = len; 2624 2625 if (!pdev) 2626 return -EOPNOTSUPP; 2627 if (!xsc_core_is_pf(xdev)) { > 2628 if (!pdev->physfn) 2629 return -EOPNOTSUPP; 2630 pf_xdev = pci_get_drvdata(pdev->physfn); 2631 if (!pf_xdev || !pf_xdev->netdev) 2632 return -EOPNOTSUPP; 2633 pf_netdev = (struct net_device *)pf_xdev->netdev; 2634 ret = snprintf(buf, len, "%s_%d", 2635 pf_netdev->name, xdev->vf_id); 2636 } else { 2637 return -EOPNOTSUPP; 2638 } 2639 if (ret >= len) 2640 return -EOPNOTSUPP; 2641 2642 return 0; 2643 } 2644 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] b43: fix CVE-2023-52644
by Dong Chenchen 08 May '24

08 May '24

fix CVE-2023-52644 Rahul Rameshbabu (1): wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled Saurav Girepunje (1): b43: dma: Fix use true/false for bool type variable drivers/net/wireless/broadcom/b43/b43.h | 16 ++++++++++++++++ drivers/net/wireless/broadcom/b43/dma.c | 8 ++++---- 2 files changed, 20 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
by Dong Chenchen 08 May '24

08 May '24

From: Rahul Rameshbabu <sergeantsagara(a)protonmail.com> mainline inclusion from mainline-v6.9-rc1 commit 9636951e4468f02c72cc75a82dc65d003077edbc category: bugfix bugzilla: 189835, https://gitee.com/src-openeuler/kernel/issues/I9HK94 CVE: CVE-2023-52644 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When QoS is disabled, the queue priority value will not map to the correct ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS is disabled to prevent trying to stop/wake a non-existent queue and failing to stop/wake the actual queue instantiated. Log of issue before change (with kernel parameter qos=0): [ +5.112651] ------------[ cut here ]------------ [ +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211] [ +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3 [ +0.000044] videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common [ +0.000055] usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)] [ +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G W O 6.6.7 #1-NixOS [ +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019 [ +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211] [ +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 <0f> 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00 [ +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097 [ +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000 [ +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900 [ +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0 [ +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000 [ +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40 [ +0.000001] FS: 0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000 [ +0.000001] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000001] CR2: 00007fafda7ae008 CR3: 000000046d220005 CR4: 00000000000606e0 [ +0.000002] Call Trace: [ +0.000003] <TASK> [ +0.000001] ? __ieee80211_wake_queue+0xd5/0x180 [mac80211] [ +0.000044] ? __warn+0x81/0x130 [ +0.000005] ? __ieee80211_wake_queue+0xd5/0x180 [mac80211] [ +0.000045] ? report_bug+0x171/0x1a0 [ +0.000004] ? handle_bug+0x41/0x70 [ +0.000004] ? exc_invalid_op+0x17/0x70 [ +0.000003] ? asm_exc_invalid_op+0x1a/0x20 [ +0.000005] ? __ieee80211_wake_queue+0xd5/0x180 [mac80211] [ +0.000043] ieee80211_wake_queue+0x4a/0x80 [mac80211] [ +0.000044] b43_dma_handle_txstatus+0x29c/0x3a0 [b43] [ +0.000016] ? __pfx_irq_thread_fn+0x10/0x10 [ +0.000002] b43_handle_txstatus+0x61/0x80 [b43] [ +0.000012] b43_interrupt_thread_handler+0x3f9/0x6b0 [b43] [ +0.000011] irq_thread_fn+0x23/0x60 [ +0.000002] irq_thread+0xfe/0x1c0 [ +0.000002] ? __pfx_irq_thread_dtor+0x10/0x10 [ +0.000001] ? __pfx_irq_thread+0x10/0x10 [ +0.000001] kthread+0xe8/0x120 [ +0.000003] ? __pfx_kthread+0x10/0x10 [ +0.000003] ret_from_fork+0x34/0x50 [ +0.000002] ? __pfx_kthread+0x10/0x10 [ +0.000002] ret_from_fork_asm+0x1b/0x30 [ +0.000004] </TASK> [ +0.000001] ---[ end trace 0000000000000000 ]--- [ +0.000065] ------------[ cut here ]------------ [ +0.000001] WARNING: CPU: 0 PID: 56077 at net/mac80211/util.c:514 __ieee80211_stop_queue+0xcc/0xe0 [mac80211] [ +0.000077] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3 [ +0.000073] videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common [ +0.000084] usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43] [ +0.000012] CPU: 0 PID: 56077 Comm: kworker/u16:17 Tainted: G W O 6.6.7 #1-NixOS [ +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019 [ +0.000001] Workqueue: phy7 b43_tx_work [b43] [ +0.000019] RIP: 0010:__ieee80211_stop_queue+0xcc/0xe0 [mac80211] [ +0.000076] Code: 74 11 48 8b 78 08 0f b7 d6 89 e9 4c 89 e6 e8 ab f4 00 00 65 ff 0d 9c b7 34 3f 0f 85 55 ff ff ff 0f 1f 44 00 00 e9 4b ff ff ff <0f> 0b 5b 5d 41 5c 41 5d c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 [ +0.000002] RSP: 0000:ffffc90004157d50 EFLAGS: 00010097 [ +0.000002] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000 [ +0.000002] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8882d65d0900 [ +0.000002] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ +0.000001] R10: 00000000000000ff R11: ffff88814d0155a0 R12: ffff8882d65d0900 [ +0.000002] R13: 0000000000000000 R14: ffff8881002d2800 R15: 00000000000000d0 [ +0.000002] FS: 0000000000000000(0000) GS:ffff88846f800000(0000) knlGS:0000000000000000 [ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000002] CR2: 00007f2e8c10c880 CR3: 0000000385b66005 CR4: 00000000000606f0 [ +0.000002] Call Trace: [ +0.000001] <TASK> [ +0.000001] ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211] [ +0.000075] ? __warn+0x81/0x130 [ +0.000004] ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211] [ +0.000075] ? report_bug+0x171/0x1a0 [ +0.000005] ? handle_bug+0x41/0x70 [ +0.000003] ? exc_invalid_op+0x17/0x70 [ +0.000004] ? asm_exc_invalid_op+0x1a/0x20 [ +0.000004] ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211] [ +0.000076] ieee80211_stop_queue+0x36/0x50 [mac80211] [ +0.000077] b43_dma_tx+0x550/0x780 [b43] [ +0.000023] b43_tx_work+0x90/0x130 [b43] [ +0.000018] process_one_work+0x174/0x340 [ +0.000003] worker_thread+0x27b/0x3a0 [ +0.000004] ? __pfx_worker_thread+0x10/0x10 [ +0.000002] kthread+0xe8/0x120 [ +0.000003] ? __pfx_kthread+0x10/0x10 [ +0.000004] ret_from_fork+0x34/0x50 [ +0.000002] ? __pfx_kthread+0x10/0x10 [ +0.000003] ret_from_fork_asm+0x1b/0x30 [ +0.000006] </TASK> [ +0.000001] ---[ end trace 0000000000000000 ]--- Fixes: e6f5b934fba8 ("b43: Add QOS support") Signed-off-by: Rahul Rameshbabu <sergeantsagara(a)protonmail.com> Reviewed-by: Julian Calaby <julian.calaby(a)gmail.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20231231050300.122806-2-sergeantsagara@protonmail.com Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/broadcom/b43/b43.h | 16 ++++++++++++++++ drivers/net/wireless/broadcom/b43/dma.c | 4 ++-- 2 files changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/broadcom/b43/b43.h b/drivers/net/wireless/broadcom/b43/b43.h index 67b4bac048e5..c0d8fc0b22fb 100644 --- a/drivers/net/wireless/broadcom/b43/b43.h +++ b/drivers/net/wireless/broadcom/b43/b43.h @@ -1082,6 +1082,22 @@ static inline bool b43_using_pio_transfers(struct b43_wldev *dev) return dev->__using_pio_transfers; } +static inline void b43_wake_queue(struct b43_wldev *dev, int queue_prio) +{ + if (dev->qos_enabled) + ieee80211_wake_queue(dev->wl->hw, queue_prio); + else + ieee80211_wake_queue(dev->wl->hw, 0); +} + +static inline void b43_stop_queue(struct b43_wldev *dev, int queue_prio) +{ + if (dev->qos_enabled) + ieee80211_stop_queue(dev->wl->hw, queue_prio); + else + ieee80211_stop_queue(dev->wl->hw, 0); +} + /* Message printing */ __printf(2, 3) void b43info(struct b43_wl *wl, const char *fmt, ...); __printf(2, 3) void b43err(struct b43_wl *wl, const char *fmt, ...); diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c index 9a7c62bd5e43..cfaf2f9d67b2 100644 --- a/drivers/net/wireless/broadcom/b43/dma.c +++ b/drivers/net/wireless/broadcom/b43/dma.c @@ -1399,7 +1399,7 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb) should_inject_overflow(ring)) { /* This TX ring is full. */ unsigned int skb_mapping = skb_get_queue_mapping(skb); - ieee80211_stop_queue(dev->wl->hw, skb_mapping); + b43_stop_queue(dev, skb_mapping); dev->wl->tx_queue_stopped[skb_mapping] = true; ring->stopped = true; if (b43_debug(dev, B43_DBG_DMAVERBOSE)) { @@ -1570,7 +1570,7 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev, } else { /* If the driver queue is running wake the corresponding * mac80211 queue. */ - ieee80211_wake_queue(dev->wl->hw, ring->queue_prio); + b43_wake_queue(dev, ring->queue_prio); if (b43_debug(dev, B43_DBG_DMAVERBOSE)) { b43dbg(dev->wl, "Woke up TX ring %d\n", ring->index); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: ttpci: fix two memleaks in budget_av_attach
by Zhang Changzhong 08 May '24

08 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit d0b07f712bf61e1a3cf23c87c663791c42e50837 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IH CVE: CVE-2024-27073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of ttpci_budget_init does. Besides, there are two fixme comment refers to such deallocations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Conflicts: drivers/media/pci/ttpci/budget-av.c [commit 3e30a927af3c ("media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO") was not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/media/pci/ttpci/budget-av.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/media/pci/ttpci/budget-av.c b/drivers/media/pci/ttpci/budget-av.c index abc98f1..fdb7045 100644 --- a/drivers/media/pci/ttpci/budget-av.c +++ b/drivers/media/pci/ttpci/budget-av.c @@ -1476,7 +1476,8 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio budget_av->has_saa7113 = 1; err = saa7146_vv_init(dev, &vv_data); if (err != 0) { - /* fixme: proper cleanup here */ + ttpci_budget_deinit(&budget_av->budget); + kfree(budget_av); ERR("cannot init vv subsystem\n"); return err; } @@ -1485,9 +1486,10 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio vv_data.vid_ops.vidioc_s_input = vidioc_s_input; if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_GRABBER))) { - /* fixme: proper cleanup here */ - ERR("cannot register capture v4l2 device\n"); saa7146_vv_release(dev); + ttpci_budget_deinit(&budget_av->budget); + kfree(budget_av); + ERR("cannot register capture v4l2 device\n"); return err; } -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] nfs: fix UAF in direct writes
by Long Li 08 May '24

08 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.167 commit 4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5GC CVE: CVE-2024-26958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ] In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/nfs/write.c include/linux/nfs_fs.h [make nfs_commit_end() have return value of bool and declared in header file] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nfs/direct.c | 11 +++++++++-- fs/nfs/write.c | 10 +++++++--- include/linux/nfs_fs.h | 2 ++ 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 6a4083d550c6..c0de56ed8364 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -760,10 +760,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) LIST_HEAD(mds_list); nfs_init_cinfo_from_dreq(&cinfo, dreq); + nfs_commit_begin(cinfo.mds); nfs_scan_commit(dreq->inode, &mds_list, &cinfo); res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo); - if (res < 0) /* res == -ENOMEM */ - nfs_direct_write_reschedule(dreq); + if (res < 0) { /* res == -ENOMEM */ + spin_lock(&dreq->lock); + if (dreq->flags == 0) + dreq->flags = NFS_ODIRECT_RESCHED_WRITES; + spin_unlock(&dreq->lock); + } + if (nfs_commit_end(cinfo.mds)) + nfs_direct_write_complete(dreq); } static void nfs_direct_write_schedule_work(struct work_struct *work) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index e383d265e65b..e4b1ce488637 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1643,15 +1643,19 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) !atomic_read(&cinfo->rpcs_out)); } -static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) { atomic_inc(&cinfo->rpcs_out); } -static void nfs_commit_end(struct nfs_mds_commit_info *cinfo) +bool nfs_commit_end(struct nfs_mds_commit_info *cinfo) { - if (atomic_dec_and_test(&cinfo->rpcs_out)) + + if (atomic_dec_and_test(&cinfo->rpcs_out)) { wake_up_var(&cinfo->rpcs_out); + return true; + } + return false; } void nfs_commitdata_release(struct nfs_commit_data *data) diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 22e4ce63917d..beb26241fe57 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -545,6 +545,8 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); extern int nfs_commit_inode(struct inode *, int); extern struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail); extern void nfs_commit_free(struct nfs_commit_data *data); +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo); +bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); static inline int nfs_have_writebacks(struct inode *inode) -- 2.31.1

2 1

[PATCH OLK-5.10] wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
by Dong Chenchen 08 May '24

08 May '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> mainline inclusion from mainline-v6.9-rc1 commit 24355fcb0d4cbcb6ddda262596558e8cfba70f11 category: bugfix bugzilla: 189830, https://gitee.com/src-openeuler/kernel/issues/I9HK6T CVE: CVE-2024-26897 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data structures have been fully initialised by the time it runs. However, because of the order in which things are initialised, this is not guaranteed to be the case, because the device is exposed to the USB subsystem before the ath9k driver initialisation is completed. We already committed a partial fix for this in commit: 8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()") However, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event tasklet, pairing it with an "initialisation complete" bit in the TX struct. It seems syzbot managed to trigger the race for one of the other commands as well, so let's just move the existing synchronisation bit to cover the whole tasklet (setting it at the end of ath9k_htc_probe_device() instead of inside ath9k_tx_init()). Link: https://lore.kernel.org/r/ed1d2c66-1193-4c81-9542-d514c29ba8b8.bugreport@ub… Fixes: 8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()") Reported-by: Ubisectech Sirius <bugreport(a)ubisectech.com> Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://msgid.link/20240126140218.1033443-1-toke@toke.dk Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc.h | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 4 ++++ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 4 ---- drivers/net/wireless/ath/ath9k/wmi.c | 10 ++++++---- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h index 237f4ec2cffd..6c33e898b300 100644 --- a/drivers/net/wireless/ath/ath9k/htc.h +++ b/drivers/net/wireless/ath/ath9k/htc.h @@ -306,7 +306,6 @@ struct ath9k_htc_tx { DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM); struct timer_list cleanup_timer; spinlock_t tx_lock; - bool initialized; }; struct ath9k_htc_tx_ctl { @@ -515,6 +514,7 @@ struct ath9k_htc_priv { unsigned long ps_usecount; bool ps_enabled; bool ps_idle; + bool initialized; #ifdef CONFIG_MAC80211_LEDS enum led_brightness brightness; diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c index 96a3185a96d7..b014185373f3 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -966,6 +966,10 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, htc_handle->drv_priv = priv; + /* Allow ath9k_wmi_event_tasklet() to operate. */ + smp_wmb(); + priv->initialized = true; + return 0; err_init: diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index 5037142c5a82..95146ec754d5 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -810,10 +810,6 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv) skb_queue_head_init(&priv->tx.data_vo_queue); skb_queue_head_init(&priv->tx.tx_failed); - /* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */ - smp_wmb(); - priv->tx.initialized = true; - return 0; } diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c index 1476b42b52a9..805ad31edba2 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.c +++ b/drivers/net/wireless/ath/ath9k/wmi.c @@ -155,6 +155,12 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t) } spin_unlock_irqrestore(&wmi->wmi_lock, flags); + /* Check if ath9k_htc_probe_device() completed. */ + if (!data_race(priv->initialized)) { + kfree_skb(skb); + continue; + } + hdr = (struct wmi_cmd_hdr *) skb->data; cmd_id = be16_to_cpu(hdr->command_id); wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr)); @@ -169,10 +175,6 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t) &wmi->drv_priv->fatal_work); break; case WMI_TXSTATUS_EVENTID: - /* Check if ath9k_tx_init() completed. */ - if (!data_race(priv->tx.initialized)) - break; - spin_lock_bh(&priv->tx.tx_lock); if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) { spin_unlock_bh(&priv->tx.tx_lock); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] wifi: ath9k: fix CVE-2024-26897
by Dong Chenchen 08 May '24

08 May '24

fix CVE-2024-26897 Tetsuo Handa (1): ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() Toke Høiland-Jørgensen (1): wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete drivers/net/wireless/ath/ath9k/htc.h | 1 + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 4 ++++ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 1 + drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++++ 4 files changed, 12 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-27010
by Zhengchao Shao 08 May '24

08 May '24

Fix CVE-2024-27010. Eric Dumazet (1): net/sched: Fix mirred deadlock on device recursion Zhengchao Shao (1): net/sched: fix kabi change in struct Qdisc include/net/sch_generic.h | 2 ++ net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 1 + 3 files changed, 9 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-27010
by Zhengchao Shao 08 May '24

08 May '24

Fix CVE-2024-27010. Eric Dumazet (1): net/sched: Fix mirred deadlock on device recursion Zhengchao Shao (1): net/sched: fix kabi change in struct Qdisc include/net/sch_generic.h | 2 +- net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 1 + 3 files changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-27010
by Zhengchao Shao 08 May '24

08 May '24

Fix CVE-2024-27010. Eric Dumazet (1): net/sched: Fix mirred deadlock on device recursion Zhengchao Shao (1): net/sched: fix kabi change in struct Qdisc include/net/sch_generic.h | 2 ++ net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 1 + 3 files changed, 9 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6 v2 0/2] bugfix patches from OLK-5.10
by Xiongfeng Wang 08 May '24

08 May '24

Guilherme G. Piccoli (2): x86/PCI: Export find_cap() to be used in early PCI code x86/quirks: Add parameter to clear MSIs early on boot .../admin-guide/kernel-parameters.txt | 6 ++++ arch/x86/include/asm/pci-direct.h | 2 ++ arch/x86/kernel/aperture_64.c | 30 ++--------------- arch/x86/kernel/early-quirks.c | 32 +++++++++++++++++++ arch/x86/pci/common.c | 4 +++ arch/x86/pci/early.c | 25 +++++++++++++++ 6 files changed, 71 insertions(+), 28 deletions(-) -- 2.20.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2024-27010
by Zhengchao Shao 08 May '24

08 May '24

Fix CVE-2024-27010. Eric Dumazet (1): net/sched: Fix mirred deadlock on device recursion Zhengchao Shao (1): net/sched: fix kabi change in struct Qdisc include/net/sch_generic.h | 2 +- net/core/dev.c | 6 ++++++ net/sched/sch_generic.c | 1 + 3 files changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] sched/fair: Optimize performance by inlining cpu_util_without() and cpu_util()
by Li Zetao 08 May '24

08 May '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9MSNE?from=project-issue CVE: NA -------------------------------- Consider optimizing performance by inlining high-frequency hotspot functions. The test results are as follows: base base+this patch fork_proc 438.5427333ms 420.5897667ms (4.27%) Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- kernel/sched/fair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..0a68bd3b9143 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8448,7 +8448,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target) * * Return: (Boosted) (estimated) utilization for the specified CPU. */ -static unsigned long +static __always_inline unsigned long cpu_util(int cpu, struct task_struct *p, int dst_cpu, int boost) { struct cfs_rq *cfs_rq = &cpu_rq(cpu)->cfs; @@ -8536,7 +8536,7 @@ unsigned long cpu_util_cfs_boost(int cpu) * utilization of the specified task, whenever the task is currently * contributing to the CPU utilization. */ -static unsigned long cpu_util_without(int cpu, struct task_struct *p) +static __always_inline unsigned long cpu_util_without(int cpu, struct task_struct *p) { /* Task has no contribution or is new */ if (cpu != task_cpu(p) || !READ_ONCE(p->se.avg.last_update_time)) -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 8557/22306] drivers/dma/qcom/.tmp_hidma_mgmt.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 08 May '24

08 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 76f29355ee875b8515aded65ea6001681d4afc0c commit: 775947c125d5bd6e00e0dcf9d12c57fd5d44d07f [8557/22306] asm-generic: fix -Wtype-limits compiler warnings config: x86_64-buildonly-randconfig-005-20240508 (https://download.01.org/0day-ci/archive/20240508/202405081832.WRSU6yPp-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405081832.WRSU6yPp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405081832.WRSU6yPp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dma/qcom/.tmp_hidma_mgmt.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v2] net/mlx5e: Prevent deadlock while disabling aRFS
by Liu Jian 08 May '24

08 May '24

From: Carolina Jubran <cjubran(a)nvidia.com> mainline inclusion from mainline-v6.9-rc5 commit fef965764cf562f28afb997b626fc7c3cec99693 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5LB CVE: CVE-2024-27014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When disabling aRFS under the `priv->state_lock`, any scheduled aRFS works are canceled using the `cancel_work_sync` function, which waits for the work to end if it has already started. However, while waiting for the work handler, the handler will try to acquire the `state_lock` which is already acquired. The worker acquires the lock to delete the rules if the state is down, which is not the worker's responsibility since disabling aRFS deletes the rules. Add an aRFS state variable, which indicates whether the aRFS is enabled and prevent adding rules when the aRFS is disabled. Kernel log: ====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Tainted: G I ------------------------------------------------------ ethtool/386089 is trying to acquire lock: ffff88810f21ce68 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}, at: __flush_work+0x74/0x4e0 but task is already holding lock: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&priv->state_lock){+.+.}-{3:3}: __mutex_lock+0x80/0xc90 arfs_handle_work+0x4b/0x3b0 [mlx5_core] process_one_work+0x1dc/0x4a0 worker_thread+0x1bf/0x3c0 kthread+0xd7/0x100 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x11/0x20 -> #0 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}: __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 __flush_work+0x7a/0x4e0 __cancel_work_timer+0x131/0x1c0 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); *** DEADLOCK *** 3 locks held by ethtool/386089: #0: ffffffff82ea7210 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 #1: ffffffff82e94c88 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_set_doit+0xd3/0x240 #2: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] stack backtrace: CPU: 15 PID: 386089 Comm: ethtool Tainted: G I 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x60/0xa0 check_noncircular+0x144/0x160 __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 ? __flush_work+0x74/0x4e0 ? save_trace+0x3e/0x360 ? __flush_work+0x74/0x4e0 __flush_work+0x7a/0x4e0 ? __flush_work+0x74/0x4e0 ? __lock_acquire+0xa78/0x2c80 ? lock_acquire+0xd0/0x2b0 ? mark_held_locks+0x49/0x70 __cancel_work_timer+0x131/0x1c0 ? mark_held_locks+0x49/0x70 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 ? ethnl_ops_begin+0xb0/0xb0 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 ? do_user_addr_fault+0x53f/0x8f0 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e </TASK> Fixes: 45bf454ae884 ("net/mlx5e: Enabling aRFS mechanism") Signed-off-by: Carolina Jubran <cjubran(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://lore.kernel.org/r/20240411115444.374475-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c drivers/net/ethernet/mellanox/mlx5/core/en/fs.h [Did not backport the commit f6755b80d693 ("net/mlx5e: Dynamic alloc arfs table for netdev when needed"), and commit f52f2faee581 ("net/mlx5e: Introduce flow steering API").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en/fs.h | 1 + .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h index 1431232c9a09..5fc903fa9573 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h @@ -149,6 +149,7 @@ struct mlx5e_arfs_tables { struct list_head rules; int last_filter_id; struct workqueue_struct *wq; + unsigned long state; }; int mlx5e_arfs_create_tables(struct mlx5e_priv *priv); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index a4be04debe67..37dbe2739169 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -36,6 +36,10 @@ #include <linux/ipv6.h> #include "en.h" +enum { + MLX5E_ARFS_STATE_ENABLED, +}; + struct arfs_tuple { __be16 etype; u8 ip_proto; @@ -144,6 +148,8 @@ int mlx5e_arfs_enable(struct mlx5e_priv *priv) return err; } } + set_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + return 0; } @@ -406,6 +412,8 @@ static void arfs_del_rules(struct mlx5e_priv *priv) int j; HLIST_HEAD(del_list); + clear_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + spin_lock_bh(&priv->fs.arfs.arfs_lock); mlx5e_for_each_arfs_rule(rule, htmp, priv->fs.arfs.arfs_tables, i, j) { hlist_del_init(&rule->hlist); @@ -568,17 +576,8 @@ static void arfs_handle_work(struct work_struct *work) struct mlx5e_priv *priv = arfs_rule->priv; struct mlx5_flow_handle *rule; - mutex_lock(&priv->state_lock); - if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { - spin_lock_bh(&priv->fs.arfs.arfs_lock); - hlist_del(&arfs_rule->hlist); - spin_unlock_bh(&priv->fs.arfs.arfs_lock); - - mutex_unlock(&priv->state_lock); - kfree(arfs_rule); - goto out; - } - mutex_unlock(&priv->state_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state)) + return; if (!arfs_rule->rule) { rule = arfs_add_rule(priv, arfs_rule); @@ -689,6 +688,11 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb, return -EPROTONOSUPPORT; spin_lock_bh(&arfs->arfs_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state)) { + spin_unlock_bh(&arfs->arfs_lock); + return -EPERM; + } + arfs_rule = arfs_find_rule(arfs_t, &fk); if (arfs_rule) { if (arfs_rule->rxq == rxq_index) { -- 2.34.1

2 1

[PATCH OLK-5.10 v2] net/mlx5e: Prevent deadlock while disabling aRFS
by Liu Jian 08 May '24

08 May '24

From: Carolina Jubran <cjubran(a)nvidia.com> mainline inclusion from mainline-v6.9-rc5 commit fef965764cf562f28afb997b626fc7c3cec99693 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5LB CVE: CVE-2024-27014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When disabling aRFS under the `priv->state_lock`, any scheduled aRFS works are canceled using the `cancel_work_sync` function, which waits for the work to end if it has already started. However, while waiting for the work handler, the handler will try to acquire the `state_lock` which is already acquired. The worker acquires the lock to delete the rules if the state is down, which is not the worker's responsibility since disabling aRFS deletes the rules. Add an aRFS state variable, which indicates whether the aRFS is enabled and prevent adding rules when the aRFS is disabled. Kernel log: ====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Tainted: G I ------------------------------------------------------ ethtool/386089 is trying to acquire lock: ffff88810f21ce68 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}, at: __flush_work+0x74/0x4e0 but task is already holding lock: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&priv->state_lock){+.+.}-{3:3}: __mutex_lock+0x80/0xc90 arfs_handle_work+0x4b/0x3b0 [mlx5_core] process_one_work+0x1dc/0x4a0 worker_thread+0x1bf/0x3c0 kthread+0xd7/0x100 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x11/0x20 -> #0 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}: __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 __flush_work+0x7a/0x4e0 __cancel_work_timer+0x131/0x1c0 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); *** DEADLOCK *** 3 locks held by ethtool/386089: #0: ffffffff82ea7210 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 #1: ffffffff82e94c88 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_set_doit+0xd3/0x240 #2: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] stack backtrace: CPU: 15 PID: 386089 Comm: ethtool Tainted: G I 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x60/0xa0 check_noncircular+0x144/0x160 __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 ? __flush_work+0x74/0x4e0 ? save_trace+0x3e/0x360 ? __flush_work+0x74/0x4e0 __flush_work+0x7a/0x4e0 ? __flush_work+0x74/0x4e0 ? __lock_acquire+0xa78/0x2c80 ? lock_acquire+0xd0/0x2b0 ? mark_held_locks+0x49/0x70 __cancel_work_timer+0x131/0x1c0 ? mark_held_locks+0x49/0x70 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 ? ethnl_ops_begin+0xb0/0xb0 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 ? do_user_addr_fault+0x53f/0x8f0 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e </TASK> Fixes: 45bf454ae884 ("net/mlx5e: Enabling aRFS mechanism") Signed-off-by: Carolina Jubran <cjubran(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://lore.kernel.org/r/20240411115444.374475-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c drivers/net/ethernet/mellanox/mlx5/core/en/fs.h [Did not backport the commit f6755b80d693 ("net/mlx5e: Dynamic alloc arfs table for netdev when needed"), and commit f52f2faee581 ("net/mlx5e: Introduce flow steering API").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en/fs.h | 1 + .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h index 000ca294b0a0..ce2c9daae2c7 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h @@ -215,6 +215,7 @@ struct mlx5e_arfs_tables { struct list_head rules; int last_filter_id; struct workqueue_struct *wq; + unsigned long state; }; int mlx5e_arfs_create_tables(struct mlx5e_priv *priv); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index 39475f6565c7..2e800d730231 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -36,6 +36,10 @@ #include <linux/ipv6.h> #include "en.h" +enum { + MLX5E_ARFS_STATE_ENABLED, +}; + struct arfs_tuple { __be16 etype; u8 ip_proto; @@ -132,6 +136,8 @@ int mlx5e_arfs_enable(struct mlx5e_priv *priv) return err; } } + set_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + return 0; } @@ -387,6 +393,8 @@ static void arfs_del_rules(struct mlx5e_priv *priv) int j; HLIST_HEAD(del_list); + clear_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + spin_lock_bh(&priv->fs.arfs.arfs_lock); mlx5e_for_each_arfs_rule(rule, htmp, priv->fs.arfs.arfs_tables, i, j) { hlist_del_init(&rule->hlist); @@ -552,17 +560,8 @@ static void arfs_handle_work(struct work_struct *work) struct mlx5e_priv *priv = arfs_rule->priv; struct mlx5_flow_handle *rule; - mutex_lock(&priv->state_lock); - if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { - spin_lock_bh(&priv->fs.arfs.arfs_lock); - hlist_del(&arfs_rule->hlist); - spin_unlock_bh(&priv->fs.arfs.arfs_lock); - - mutex_unlock(&priv->state_lock); - kfree(arfs_rule); - goto out; - } - mutex_unlock(&priv->state_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state)) + return; if (!arfs_rule->rule) { rule = arfs_add_rule(priv, arfs_rule); @@ -673,6 +672,11 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb, return -EPROTONOSUPPORT; spin_lock_bh(&arfs->arfs_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state)) { + spin_unlock_bh(&arfs->arfs_lock); + return -EPERM; + } + arfs_rule = arfs_find_rule(arfs_t, &fk); if (arfs_rule) { if (arfs_rule->rxq == rxq_index) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] bugfix patches from OLK-5.10
by Xiongfeng Wang 08 May '24

08 May '24

Guilherme G. Piccoli (2): x86/PCI: Export find_cap() to be used in early PCI code x86/quirks: Add parameter to clear MSIs early on boot .../admin-guide/kernel-parameters.txt | 6 ++++ arch/x86/include/asm/pci-direct.h | 2 ++ arch/x86/kernel/aperture_64.c | 30 ++--------------- arch/x86/kernel/early-quirks.c | 32 +++++++++++++++++++ arch/x86/pci/common.c | 4 +++ arch/x86/pci/early.c | 25 +++++++++++++++ 6 files changed, 71 insertions(+), 28 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS] media: edia: dvbdev: fix a use-after-free
by liwei 08 May '24

08 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9MA CVE: CVE-2024-27043 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain: budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in dvb_register_device) could point to memory that had been freed in dvb_register_device. Thereafter, this pointer is transferred to kref_put and triggering a use-after-free. Link: https://lore.kernel.org/linux-media/20240203134046.3120099-1-alexious@zju.e… Fixes: b61901024776 ("V4L/DVB (5244): Dvbdev: fix illegal re-usage of fileoperations struct") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Conflicts: drivers/media/dvb-core/dvbdev.c Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/media/dvb-core/dvbdev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index 4b562238749d..117fbdc0bc7c 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -498,6 +498,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL); if (!dvbdevfops) { kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } @@ -506,6 +507,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, if (!new_node) { kfree(dvbdevfops); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } @@ -537,6 +539,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, kfree(new_node); } kfree(dvbdev); + *pdvbdev = NULL; up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); return -EINVAL; @@ -558,6 +561,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, } dvb_media_device_free(dvbdev); kfree(dvbdev); + *pdvbdev = NULL; up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); return ret; @@ -576,6 +580,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, } dvb_media_device_free(dvbdev); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return PTR_ERR(clsdev); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mac802154: fix llsec key resources release in mac802154_llsec_key_del
by Cai Xinchen 08 May '24

08 May '24

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v5.10.215 commit 068ab2759bc0b4daf0b964de61b2731449c86531 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5OC CVE: CVE-2024-26961 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8a1e58345cf40b7b272e08ac7b32328b2543e40 ] mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0 [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0 [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0 [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80 [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0 [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0 [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0 [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440 [<ffffffff86ff1d88>] genl_rcv+0x28/0x40 [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820 [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60 [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0 [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0 [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0 [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0 [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org) Fixes: 5d637d5aabd8 ("mac802154: add llsec structures and mutators") Cc: stable(a)vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Acked-by: Alexander Aring <aahringo(a)redhat.com> Message-ID: <20240228163840.6667-1-pchelkin(a)ispras.ru> Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/mac802154/llsec.c [Use kzfree instead of kfree_sensitive because commit 453431a54934 ("mm, treewide: rename kzfree() to kfree_sensitive()") not merged] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- include/net/cfg802154.h | 1 + net/mac802154/llsec.c | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h index 795ca4008f72..ee8af7c74d18 100644 --- a/include/net/cfg802154.h +++ b/include/net/cfg802154.h @@ -265,6 +265,7 @@ struct ieee802154_llsec_key { struct ieee802154_llsec_key_entry { struct list_head list; + struct rcu_head rcu; struct ieee802154_llsec_key_id id; struct ieee802154_llsec_key *key; diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c index d742e635ad07..48e958dbe9a4 100644 --- a/net/mac802154/llsec.c +++ b/net/mac802154/llsec.c @@ -273,19 +273,27 @@ int mac802154_llsec_key_add(struct mac802154_llsec *sec, return -ENOMEM; } +static void mac802154_llsec_key_del_rcu(struct rcu_head *rcu) +{ + struct ieee802154_llsec_key_entry *pos; + struct mac802154_llsec_key *mkey; + + pos = container_of(rcu, struct ieee802154_llsec_key_entry, rcu); + mkey = container_of(pos->key, struct mac802154_llsec_key, key); + + llsec_key_put(mkey); + kzfree(pos); +} + int mac802154_llsec_key_del(struct mac802154_llsec *sec, const struct ieee802154_llsec_key_id *key) { struct ieee802154_llsec_key_entry *pos; list_for_each_entry(pos, &sec->table.keys, list) { - struct mac802154_llsec_key *mkey; - - mkey = container_of(pos->key, struct mac802154_llsec_key, key); - if (llsec_key_id_equal(&pos->id, key)) { list_del_rcu(&pos->list); - llsec_key_put(mkey); + call_rcu(&pos->rcu, mac802154_llsec_key_del_rcu); return 0; } } -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
by Ziyang Xuan 08 May '24

08 May '24

stable inclusion from stable-v5.10.216 commit 934e66e231cff2b18faa2c8aad0b8cec13957e05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5P0 CVE: CVE-2024-27020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f969eb84ce482331a991079ab7a5c4dc3b7f89bf ] nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process. Fixes: ef1f7df9170d ("netfilter: nf_tables: expression ops overloading") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 1cfd98d76060..095d9a527133 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2716,7 +2716,7 @@ static const struct nft_expr_type *__nft_expr_type_get(u8 family, { const struct nft_expr_type *type, *candidate = NULL; - list_for_each_entry(type, &nf_tables_expressions, list) { + list_for_each_entry_rcu(type, &nf_tables_expressions, list) { if (!nla_strcmp(nla, type->name)) { if (!type->family && !candidate) candidate = type; @@ -2748,9 +2748,13 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net, if (nla == NULL) return ERR_PTR(-EINVAL); + rcu_read_lock(); type = __nft_expr_type_get(family, nla); - if (type != NULL && try_module_get(type->owner)) + if (type != NULL && try_module_get(type->owner)) { + rcu_read_unlock(); return type; + } + rcu_read_unlock(); lockdep_nfnl_nft_mutex_not_held(); #ifdef CONFIG_MODULES -- 2.25.1

2 1

[PATCH OLK-6.6] sched/fair: Optimize performance by inlining cpu_util_without() and cpu_util()
by Li Zetao 08 May '24

08 May '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9MSNE?from=project-issue CVE: NA -------------------------------- Consider optimizing performance by inlining high-frequency hotspot functions. The test results are as follows: base base+this patch fork_proc 438.5427333ms 420.5897667ms (4.27%) Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- kernel/sched/fair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..cb56367203aa 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8448,7 +8448,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target) * * Return: (Boosted) (estimated) utilization for the specified CPU. */ -static unsigned long +static inline unsigned long cpu_util(int cpu, struct task_struct *p, int dst_cpu, int boost) { struct cfs_rq *cfs_rq = &cpu_rq(cpu)->cfs; @@ -8536,7 +8536,7 @@ unsigned long cpu_util_cfs_boost(int cpu) * utilization of the specified task, whenever the task is currently * contributing to the CPU utilization. */ -static unsigned long cpu_util_without(int cpu, struct task_struct *p) +static inline unsigned long cpu_util_without(int cpu, struct task_struct *p) { /* Task has no contribution or is new */ if (cpu != task_cpu(p) || !READ_ONCE(p->se.avg.last_update_time)) -- 2.34.1

2 1

[PATCH OLK-5.10] clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
by Jinjie Ruan 08 May '24

08 May '24

From: Gabor Juhos <j4g8y7(a)gmail.com> stable inclusion from stable-v5.10.215 commit 3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5N3 CVE: CVE-2024-26965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96 ] The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested. Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") Signed-off-by: Gabor Juhos <j4g8y7(a)gmail.com> Reviewed-by: Stephen Boyd <sboyd(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-7-074334f0905c@… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/clk/qcom/mmcc-msm8974.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c index 015426262d08..dfc377463a7a 100644 --- a/drivers/clk/qcom/mmcc-msm8974.c +++ b/drivers/clk/qcom/mmcc-msm8974.c @@ -283,6 +283,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = { F(291750000, P_MMPLL1, 4, 0, 0), F(400000000, P_MMPLL0, 2, 0, 0), F(466800000, P_MMPLL1, 2.5, 0, 0), + { } }; static struct clk_rcg2 mmss_axi_clk_src = { @@ -307,6 +308,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = { F(150000000, P_GPLL0, 4, 0, 0), F(291750000, P_MMPLL1, 4, 0, 0), F(400000000, P_MMPLL0, 2, 0, 0), + { } }; static struct clk_rcg2 ocmemnoc_clk_src = { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
by Jinjie Ruan 08 May '24

08 May '24

From: Gabor Juhos <j4g8y7(a)gmail.com> stable inclusion from stable-v5.10.215 commit 3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5N3 CVE: CVE-2024-26965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96 ] The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested. Fixes: d8b212014e69 ("clk: qcom: Add support for MSM8974's multimedia clock controller (MMCC)") Signed-off-by: Gabor Juhos <j4g8y7(a)gmail.com> Reviewed-by: Stephen Boyd <sboyd(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-7-074334f0905c@… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/clk/qcom/mmcc-msm8974.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/qcom/mmcc-msm8974.c b/drivers/clk/qcom/mmcc-msm8974.c index 91818516c3e0..124d21f19e2c 100644 --- a/drivers/clk/qcom/mmcc-msm8974.c +++ b/drivers/clk/qcom/mmcc-msm8974.c @@ -291,6 +291,7 @@ static struct freq_tbl ftbl_mmss_axi_clk[] = { F(291750000, P_MMPLL1, 4, 0, 0), F(400000000, P_MMPLL0, 2, 0, 0), F(466800000, P_MMPLL1, 2.5, 0, 0), + { } }; static struct clk_rcg2 mmss_axi_clk_src = { @@ -315,6 +316,7 @@ static struct freq_tbl ftbl_ocmemnoc_clk[] = { F(150000000, P_GPLL0, 4, 0, 0), F(291750000, P_MMPLL1, 4, 0, 0), F(400000000, P_MMPLL0, 2, 0, 0), + { } }; static struct clk_rcg2 ocmemnoc_clk_src = { -- 2.34.1

2 1

[PATCH OLK-5.10] nfs: fix UAF in direct writes
by Long Li 08 May '24

08 May '24

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v5.10.167 commit 4595d90b5d2ea5fa4d318d13f59055aa4bf3e7f5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9L5GC CVE: CVE-2024-26958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 17f46b803d4f23c66cacce81db35fef3adb8f2af ] In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/nfs/direct.c | 11 +++++++++-- fs/nfs/write.c | 2 +- include/linux/nfs_fs.h | 1 + 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 5d86ffa72cea..499519f0f6ec 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -678,10 +678,17 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq) LIST_HEAD(mds_list); nfs_init_cinfo_from_dreq(&cinfo, dreq); + nfs_commit_begin(cinfo.mds); nfs_scan_commit(dreq->inode, &mds_list, &cinfo); res = nfs_generic_commit_list(dreq->inode, &mds_list, 0, &cinfo); - if (res < 0) /* res == -ENOMEM */ - nfs_direct_write_reschedule(dreq); + if (res < 0) { /* res == -ENOMEM */ + spin_lock(&dreq->lock); + if (dreq->flags == 0) + dreq->flags = NFS_ODIRECT_RESCHED_WRITES; + spin_unlock(&dreq->lock); + } + if (nfs_commit_end(cinfo.mds)) + nfs_direct_write_complete(dreq); } static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq) diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 0bc5c5fd5e10..11a5e1ef9781 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1634,7 +1634,7 @@ static int wait_on_commit(struct nfs_mds_commit_info *cinfo) !atomic_read(&cinfo->rpcs_out)); } -static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo) { atomic_inc(&cinfo->rpcs_out); } diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index e39342945a80..7488864589a7 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -553,6 +553,7 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); extern int nfs_commit_inode(struct inode *, int); extern struct nfs_commit_data *nfs_commitdata_alloc(void); extern void nfs_commit_free(struct nfs_commit_data *data); +void nfs_commit_begin(struct nfs_mds_commit_info *cinfo); bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); static inline int -- 2.31.1

2 1

[PATCH OLK-5.10] net/mlx5e: Prevent deadlock while disabling aRFS
by Liu Jian 08 May '24

08 May '24

From: Carolina Jubran <cjubran(a)nvidia.com> mainline inclusion from mainline-v6.9-rc5 commit fef965764cf562f28afb997b626fc7c3cec99693 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5LB CVE: CVE-2024-27014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… When disabling aRFS under the `priv->state_lock`, any scheduled aRFS works are canceled using the `cancel_work_sync` function, which waits for the work to end if it has already started. However, while waiting for the work handler, the handler will try to acquire the `state_lock` which is already acquired. The worker acquires the lock to delete the rules if the state is down, which is not the worker's responsibility since disabling aRFS deletes the rules. Add an aRFS state variable, which indicates whether the aRFS is enabled and prevent adding rules when the aRFS is disabled. Kernel log: ====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Tainted: G I ------------------------------------------------------ ethtool/386089 is trying to acquire lock: ffff88810f21ce68 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}, at: __flush_work+0x74/0x4e0 but task is already holding lock: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&priv->state_lock){+.+.}-{3:3}: __mutex_lock+0x80/0xc90 arfs_handle_work+0x4b/0x3b0 [mlx5_core] process_one_work+0x1dc/0x4a0 worker_thread+0x1bf/0x3c0 kthread+0xd7/0x100 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x11/0x20 -> #0 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}: __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 __flush_work+0x7a/0x4e0 __cancel_work_timer+0x131/0x1c0 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); *** DEADLOCK *** 3 locks held by ethtool/386089: #0: ffffffff82ea7210 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 #1: ffffffff82e94c88 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_set_doit+0xd3/0x240 #2: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] stack backtrace: CPU: 15 PID: 386089 Comm: ethtool Tainted: G I 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x60/0xa0 check_noncircular+0x144/0x160 __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 ? __flush_work+0x74/0x4e0 ? save_trace+0x3e/0x360 ? __flush_work+0x74/0x4e0 __flush_work+0x7a/0x4e0 ? __flush_work+0x74/0x4e0 ? __lock_acquire+0xa78/0x2c80 ? lock_acquire+0xd0/0x2b0 ? mark_held_locks+0x49/0x70 __cancel_work_timer+0x131/0x1c0 ? mark_held_locks+0x49/0x70 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 ? ethnl_ops_begin+0xb0/0xb0 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 ? do_user_addr_fault+0x53f/0x8f0 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e </TASK> Fixes: 45bf454ae884 ("net/mlx5e: Enabling aRFS mechanism") Signed-off-by: Carolina Jubran <cjubran(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://lore.kernel.org/r/20240411115444.374475-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c drivers/net/ethernet/mellanox/mlx5/core/en/fs.h [Did not backport the commit f6755b80d693 ("net/mlx5e: Dynamic alloc arfs table for netdev when needed"), and commit f52f2faee581 ("net/mlx5e: Introduce flow steering API").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en/fs.h | 1 + .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h index 000ca294b0a0..ce2c9daae2c7 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h @@ -215,6 +215,7 @@ struct mlx5e_arfs_tables { struct list_head rules; int last_filter_id; struct workqueue_struct *wq; + unsigned long state; }; int mlx5e_arfs_create_tables(struct mlx5e_priv *priv); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index 39475f6565c7..2e800d730231 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -36,6 +36,10 @@ #include <linux/ipv6.h> #include "en.h" +enum { + MLX5E_ARFS_STATE_ENABLED, +}; + struct arfs_tuple { __be16 etype; u8 ip_proto; @@ -132,6 +136,8 @@ int mlx5e_arfs_enable(struct mlx5e_priv *priv) return err; } } + set_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + return 0; } @@ -387,6 +393,8 @@ static void arfs_del_rules(struct mlx5e_priv *priv) int j; HLIST_HEAD(del_list); + clear_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + spin_lock_bh(&priv->fs.arfs.arfs_lock); mlx5e_for_each_arfs_rule(rule, htmp, priv->fs.arfs.arfs_tables, i, j) { hlist_del_init(&rule->hlist); @@ -552,17 +560,8 @@ static void arfs_handle_work(struct work_struct *work) struct mlx5e_priv *priv = arfs_rule->priv; struct mlx5_flow_handle *rule; - mutex_lock(&priv->state_lock); - if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { - spin_lock_bh(&priv->fs.arfs.arfs_lock); - hlist_del(&arfs_rule->hlist); - spin_unlock_bh(&priv->fs.arfs.arfs_lock); - - mutex_unlock(&priv->state_lock); - kfree(arfs_rule); - goto out; - } - mutex_unlock(&priv->state_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state)) + return; if (!arfs_rule->rule) { rule = arfs_add_rule(priv, arfs_rule); @@ -673,6 +672,11 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb, return -EPROTONOSUPPORT; spin_lock_bh(&arfs->arfs_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state)) { + spin_unlock_bh(&arfs->arfs_lock); + return -EPERM; + } + arfs_rule = arfs_find_rule(arfs_t, &fk); if (arfs_rule) { if (arfs_rule->rxq == rxq_index) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net/mlx5e: Prevent deadlock while disabling aRFS
by Liu Jian 08 May '24

08 May '24

From: Carolina Jubran <cjubran(a)nvidia.com> mainline inclusion from mainline-v6.9-rc5 commit fef965764cf562f28afb997b626fc7c3cec99693 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5LB CVE: CVE-2024-27014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… When disabling aRFS under the `priv->state_lock`, any scheduled aRFS works are canceled using the `cancel_work_sync` function, which waits for the work to end if it has already started. However, while waiting for the work handler, the handler will try to acquire the `state_lock` which is already acquired. The worker acquires the lock to delete the rules if the state is down, which is not the worker's responsibility since disabling aRFS deletes the rules. Add an aRFS state variable, which indicates whether the aRFS is enabled and prevent adding rules when the aRFS is disabled. Kernel log: ====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Tainted: G I ------------------------------------------------------ ethtool/386089 is trying to acquire lock: ffff88810f21ce68 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}, at: __flush_work+0x74/0x4e0 but task is already holding lock: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&priv->state_lock){+.+.}-{3:3}: __mutex_lock+0x80/0xc90 arfs_handle_work+0x4b/0x3b0 [mlx5_core] process_one_work+0x1dc/0x4a0 worker_thread+0x1bf/0x3c0 kthread+0xd7/0x100 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x11/0x20 -> #0 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}: __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 __flush_work+0x7a/0x4e0 __cancel_work_timer+0x131/0x1c0 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); *** DEADLOCK *** 3 locks held by ethtool/386089: #0: ffffffff82ea7210 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 #1: ffffffff82e94c88 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_set_doit+0xd3/0x240 #2: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] stack backtrace: CPU: 15 PID: 386089 Comm: ethtool Tainted: G I 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x60/0xa0 check_noncircular+0x144/0x160 __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 ? __flush_work+0x74/0x4e0 ? save_trace+0x3e/0x360 ? __flush_work+0x74/0x4e0 __flush_work+0x7a/0x4e0 ? __flush_work+0x74/0x4e0 ? __lock_acquire+0xa78/0x2c80 ? lock_acquire+0xd0/0x2b0 ? mark_held_locks+0x49/0x70 __cancel_work_timer+0x131/0x1c0 ? mark_held_locks+0x49/0x70 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 ? ethnl_ops_begin+0xb0/0xb0 ? genl_family_rcv_msg_dumpit+0xf0/0xf0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 ? do_user_addr_fault+0x53f/0x8f0 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e </TASK> Fixes: 45bf454ae884 ("net/mlx5e: Enabling aRFS mechanism") Signed-off-by: Carolina Jubran <cjubran(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://lore.kernel.org/r/20240411115444.374475-7-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c drivers/net/ethernet/mellanox/mlx5/core/en/fs.h [Did not backport the commit f6755b80d693 ("net/mlx5e: Dynamic alloc arfs table for netdev when needed"), and commit f52f2faee581 ("net/mlx5e: Introduce flow steering API").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en/fs.h | 1 + .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h index 1431232c9a09..5fc903fa9573 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h @@ -149,6 +149,7 @@ struct mlx5e_arfs_tables { struct list_head rules; int last_filter_id; struct workqueue_struct *wq; + unsigned long state; }; int mlx5e_arfs_create_tables(struct mlx5e_priv *priv); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index a4be04debe67..37dbe2739169 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -36,6 +36,10 @@ #include <linux/ipv6.h> #include "en.h" +enum { + MLX5E_ARFS_STATE_ENABLED, +}; + struct arfs_tuple { __be16 etype; u8 ip_proto; @@ -144,6 +148,8 @@ int mlx5e_arfs_enable(struct mlx5e_priv *priv) return err; } } + set_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + return 0; } @@ -406,6 +412,8 @@ static void arfs_del_rules(struct mlx5e_priv *priv) int j; HLIST_HEAD(del_list); + clear_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state); + spin_lock_bh(&priv->fs.arfs.arfs_lock); mlx5e_for_each_arfs_rule(rule, htmp, priv->fs.arfs.arfs_tables, i, j) { hlist_del_init(&rule->hlist); @@ -568,17 +576,8 @@ static void arfs_handle_work(struct work_struct *work) struct mlx5e_priv *priv = arfs_rule->priv; struct mlx5_flow_handle *rule; - mutex_lock(&priv->state_lock); - if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { - spin_lock_bh(&priv->fs.arfs.arfs_lock); - hlist_del(&arfs_rule->hlist); - spin_unlock_bh(&priv->fs.arfs.arfs_lock); - - mutex_unlock(&priv->state_lock); - kfree(arfs_rule); - goto out; - } - mutex_unlock(&priv->state_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &priv->fs.arfs.state)) + return; if (!arfs_rule->rule) { rule = arfs_add_rule(priv, arfs_rule); @@ -689,6 +688,11 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb, return -EPROTONOSUPPORT; spin_lock_bh(&arfs->arfs_lock); + if (!test_bit(MLX5E_ARFS_STATE_ENABLED, &arfs->state)) { + spin_unlock_bh(&arfs->arfs_lock); + return -EPERM; + } + arfs_rule = arfs_find_rule(arfs_t, &fk); if (arfs_rule) { if (arfs_rule->rxq == rxq_index) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] ksmbd: validate payload size in ipc response
by ZhaoLong Wang 08 May '24

08 May '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.157 commit 88b7f1143b15b29cccb8392b4f38e75b7bb3e300 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9EYBG CVE: CVE-2024-26811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a677ebd8ca2f2632ccdecbad7b87641274e15aac ] If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ipc response from ksmbd.mountd to avoid memory overrun or slab-out-of-bounds. This patch validate 3 ipc response that has payload. Cc: stable(a)vger.kernel.org Reported-by: Chao Ma <machao2019(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ksmbd/ksmbd_netlink.h Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ksmbd/ksmbd_netlink.h | 3 ++- fs/ksmbd/mgmt/share_config.c | 7 ++++++- fs/ksmbd/transport_ipc.c | 37 ++++++++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/ksmbd_netlink.h b/fs/ksmbd/ksmbd_netlink.h index 71bfb7de4472..33b909b419f7 100644 --- a/fs/ksmbd/ksmbd_netlink.h +++ b/fs/ksmbd/ksmbd_netlink.h @@ -162,7 +162,8 @@ struct ksmbd_share_config_response { __u16 force_directory_mode; __u16 force_uid; __u16 force_gid; - __u32 reserved[128]; /* Reserved room */ + __u32 reserved[127]; /* Reserved room */ + __u32 payload_sz; __u32 veto_list_sz; __s8 ____payload[]; }; diff --git a/fs/ksmbd/mgmt/share_config.c b/fs/ksmbd/mgmt/share_config.c index 70655af93b44..8550fc5a3a78 100644 --- a/fs/ksmbd/mgmt/share_config.c +++ b/fs/ksmbd/mgmt/share_config.c @@ -139,7 +139,12 @@ static struct ksmbd_share_config *share_config_request(char *name) share->name = kstrdup(name, GFP_KERNEL); if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { - share->path = kstrdup(ksmbd_share_config_path(resp), + int path_len = PATH_MAX; + + if (resp->payload_sz) + path_len = resp->payload_sz - resp->veto_list_sz; + + share->path = kstrndup(ksmbd_share_config_path(resp), path_len, GFP_KERNEL); if (share->path) share->path_sz = strlen(share->path); diff --git a/fs/ksmbd/transport_ipc.c b/fs/ksmbd/transport_ipc.c index 3ad6881e0f7e..589f3bb2e83c 100644 --- a/fs/ksmbd/transport_ipc.c +++ b/fs/ksmbd/transport_ipc.c @@ -64,6 +64,7 @@ struct ipc_msg_table_entry { struct hlist_node ipc_table_hlist; void *response; + unsigned int msg_sz; }; static struct delayed_work ipc_timer_work; @@ -273,6 +274,7 @@ static int handle_response(int type, void *payload, size_t sz) } memcpy(entry->response, payload, sz); + entry->msg_sz = sz; wake_up_interruptible(&entry->wait); ret = 0; break; @@ -446,6 +448,34 @@ static int ipc_msg_send(struct ksmbd_ipc_msg *msg) return ret; } +static int ipc_validate_msg(struct ipc_msg_table_entry *entry) +{ + unsigned int msg_sz = entry->msg_sz; + + if (entry->type == KSMBD_EVENT_RPC_REQUEST) { + struct ksmbd_rpc_command *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; + } else if (entry->type == KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST) { + struct ksmbd_spnego_authen_response *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_spnego_authen_response) + + resp->session_key_len + resp->spnego_blob_len; + } else if (entry->type == KSMBD_EVENT_SHARE_CONFIG_REQUEST) { + struct ksmbd_share_config_response *resp = entry->response; + + if (resp->payload_sz) { + if (resp->payload_sz < resp->veto_list_sz) + return -EINVAL; + + msg_sz = sizeof(struct ksmbd_share_config_response) + + resp->payload_sz; + } + } + + return entry->msg_sz != msg_sz ? -EINVAL : 0; +} + static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle) { struct ipc_msg_table_entry entry; @@ -470,6 +500,13 @@ static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle ret = wait_event_interruptible_timeout(entry.wait, entry.response != NULL, IPC_WAIT_TIMEOUT); + if (entry.response) { + ret = ipc_validate_msg(&entry); + if (ret) { + kvfree(entry.response); + entry.response = NULL; + } + } out: down_write(&ipc_msg_table_lock); hash_del(&entry.ipc_table_hlist); -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP2] ksmbd: validate payload size in ipc response
by ZhaoLong Wang 08 May '24

08 May '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.157 commit 88b7f1143b15b29cccb8392b4f38e75b7bb3e300 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9EYBG CVE: CVE-2024-26811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a677ebd8ca2f2632ccdecbad7b87641274e15aac ] If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ipc response from ksmbd.mountd to avoid memory overrun or slab-out-of-bounds. This patch validate 3 ipc response that has payload. Cc: stable(a)vger.kernel.org Reported-by: Chao Ma <machao2019(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ksmbd/ksmbd_netlink.h Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ksmbd/ksmbd_netlink.h | 3 ++- fs/ksmbd/mgmt/share_config.c | 7 ++++++- fs/ksmbd/transport_ipc.c | 37 ++++++++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/ksmbd_netlink.h b/fs/ksmbd/ksmbd_netlink.h index 71bfb7de4472..33b909b419f7 100644 --- a/fs/ksmbd/ksmbd_netlink.h +++ b/fs/ksmbd/ksmbd_netlink.h @@ -162,7 +162,8 @@ struct ksmbd_share_config_response { __u16 force_directory_mode; __u16 force_uid; __u16 force_gid; - __u32 reserved[128]; /* Reserved room */ + __u32 reserved[127]; /* Reserved room */ + __u32 payload_sz; __u32 veto_list_sz; __s8 ____payload[]; }; diff --git a/fs/ksmbd/mgmt/share_config.c b/fs/ksmbd/mgmt/share_config.c index 70655af93b44..8550fc5a3a78 100644 --- a/fs/ksmbd/mgmt/share_config.c +++ b/fs/ksmbd/mgmt/share_config.c @@ -139,7 +139,12 @@ static struct ksmbd_share_config *share_config_request(char *name) share->name = kstrdup(name, GFP_KERNEL); if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { - share->path = kstrdup(ksmbd_share_config_path(resp), + int path_len = PATH_MAX; + + if (resp->payload_sz) + path_len = resp->payload_sz - resp->veto_list_sz; + + share->path = kstrndup(ksmbd_share_config_path(resp), path_len, GFP_KERNEL); if (share->path) share->path_sz = strlen(share->path); diff --git a/fs/ksmbd/transport_ipc.c b/fs/ksmbd/transport_ipc.c index 3ad6881e0f7e..589f3bb2e83c 100644 --- a/fs/ksmbd/transport_ipc.c +++ b/fs/ksmbd/transport_ipc.c @@ -64,6 +64,7 @@ struct ipc_msg_table_entry { struct hlist_node ipc_table_hlist; void *response; + unsigned int msg_sz; }; static struct delayed_work ipc_timer_work; @@ -273,6 +274,7 @@ static int handle_response(int type, void *payload, size_t sz) } memcpy(entry->response, payload, sz); + entry->msg_sz = sz; wake_up_interruptible(&entry->wait); ret = 0; break; @@ -446,6 +448,34 @@ static int ipc_msg_send(struct ksmbd_ipc_msg *msg) return ret; } +static int ipc_validate_msg(struct ipc_msg_table_entry *entry) +{ + unsigned int msg_sz = entry->msg_sz; + + if (entry->type == KSMBD_EVENT_RPC_REQUEST) { + struct ksmbd_rpc_command *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; + } else if (entry->type == KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST) { + struct ksmbd_spnego_authen_response *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_spnego_authen_response) + + resp->session_key_len + resp->spnego_blob_len; + } else if (entry->type == KSMBD_EVENT_SHARE_CONFIG_REQUEST) { + struct ksmbd_share_config_response *resp = entry->response; + + if (resp->payload_sz) { + if (resp->payload_sz < resp->veto_list_sz) + return -EINVAL; + + msg_sz = sizeof(struct ksmbd_share_config_response) + + resp->payload_sz; + } + } + + return entry->msg_sz != msg_sz ? -EINVAL : 0; +} + static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle) { struct ipc_msg_table_entry entry; @@ -470,6 +500,13 @@ static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle ret = wait_event_interruptible_timeout(entry.wait, entry.response != NULL, IPC_WAIT_TIMEOUT); + if (entry.response) { + ret = ipc_validate_msg(&entry); + if (ret) { + kvfree(entry.response); + entry.response = NULL; + } + } out: down_write(&ipc_msg_table_lock); hash_del(&entry.ipc_table_hlist); -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: validate payload size in ipc response
by ZhaoLong Wang 08 May '24

08 May '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.157 commit 88b7f1143b15b29cccb8392b4f38e75b7bb3e300 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9EYBG CVE: CVE-2024-26811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a677ebd8ca2f2632ccdecbad7b87641274e15aac ] If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ipc response from ksmbd.mountd to avoid memory overrun or slab-out-of-bounds. This patch validate 3 ipc response that has payload. Cc: stable(a)vger.kernel.org Reported-by: Chao Ma <machao2019(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ksmbd/ksmbd_netlink.h Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ksmbd/ksmbd_netlink.h | 3 ++- fs/ksmbd/mgmt/share_config.c | 7 ++++++- fs/ksmbd/transport_ipc.c | 37 ++++++++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/ksmbd_netlink.h b/fs/ksmbd/ksmbd_netlink.h index 71bfb7de4472..33b909b419f7 100644 --- a/fs/ksmbd/ksmbd_netlink.h +++ b/fs/ksmbd/ksmbd_netlink.h @@ -162,7 +162,8 @@ struct ksmbd_share_config_response { __u16 force_directory_mode; __u16 force_uid; __u16 force_gid; - __u32 reserved[128]; /* Reserved room */ + __u32 reserved[127]; /* Reserved room */ + __u32 payload_sz; __u32 veto_list_sz; __s8 ____payload[]; }; diff --git a/fs/ksmbd/mgmt/share_config.c b/fs/ksmbd/mgmt/share_config.c index 70655af93b44..8550fc5a3a78 100644 --- a/fs/ksmbd/mgmt/share_config.c +++ b/fs/ksmbd/mgmt/share_config.c @@ -139,7 +139,12 @@ static struct ksmbd_share_config *share_config_request(char *name) share->name = kstrdup(name, GFP_KERNEL); if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { - share->path = kstrdup(ksmbd_share_config_path(resp), + int path_len = PATH_MAX; + + if (resp->payload_sz) + path_len = resp->payload_sz - resp->veto_list_sz; + + share->path = kstrndup(ksmbd_share_config_path(resp), path_len, GFP_KERNEL); if (share->path) share->path_sz = strlen(share->path); diff --git a/fs/ksmbd/transport_ipc.c b/fs/ksmbd/transport_ipc.c index 3ad6881e0f7e..589f3bb2e83c 100644 --- a/fs/ksmbd/transport_ipc.c +++ b/fs/ksmbd/transport_ipc.c @@ -64,6 +64,7 @@ struct ipc_msg_table_entry { struct hlist_node ipc_table_hlist; void *response; + unsigned int msg_sz; }; static struct delayed_work ipc_timer_work; @@ -273,6 +274,7 @@ static int handle_response(int type, void *payload, size_t sz) } memcpy(entry->response, payload, sz); + entry->msg_sz = sz; wake_up_interruptible(&entry->wait); ret = 0; break; @@ -446,6 +448,34 @@ static int ipc_msg_send(struct ksmbd_ipc_msg *msg) return ret; } +static int ipc_validate_msg(struct ipc_msg_table_entry *entry) +{ + unsigned int msg_sz = entry->msg_sz; + + if (entry->type == KSMBD_EVENT_RPC_REQUEST) { + struct ksmbd_rpc_command *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; + } else if (entry->type == KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST) { + struct ksmbd_spnego_authen_response *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_spnego_authen_response) + + resp->session_key_len + resp->spnego_blob_len; + } else if (entry->type == KSMBD_EVENT_SHARE_CONFIG_REQUEST) { + struct ksmbd_share_config_response *resp = entry->response; + + if (resp->payload_sz) { + if (resp->payload_sz < resp->veto_list_sz) + return -EINVAL; + + msg_sz = sizeof(struct ksmbd_share_config_response) + + resp->payload_sz; + } + } + + return entry->msg_sz != msg_sz ? -EINVAL : 0; +} + static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle) { struct ipc_msg_table_entry entry; @@ -470,6 +500,13 @@ static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle ret = wait_event_interruptible_timeout(entry.wait, entry.response != NULL, IPC_WAIT_TIMEOUT); + if (entry.response) { + ret = ipc_validate_msg(&entry); + if (ret) { + kvfree(entry.response); + entry.response = NULL; + } + } out: down_write(&ipc_msg_table_lock); hash_del(&entry.ipc_table_hlist); -- 2.34.3

2 1

[PATCH OLK-5.10] wireguard: netlink: access device through ctx instead of peer
by Yang Yingliang 08 May '24

08 May '24

From: "Jason A. Donenfeld" <Jason(a)zx2c4.com> stable inclusion from stable-v5.10.215 commit 493aa6bdcffd90a4f82aa614fe4f4db0641b4068 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5JW CVE: CVE-2024-26950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f ] The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peer_allowedips.seq is compared with ctx->allowedips_seq, basing them both in ctx. This also acts as a defence in depth provision against freed peers. Cc: stable(a)vger.kernel.org Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld <Jason(a)zx2c4.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/wireguard/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c index f5bc279c9a8c..83837496a412 100644 --- a/drivers/net/wireguard/netlink.c +++ b/drivers/net/wireguard/netlink.c @@ -164,8 +164,8 @@ get_peer(struct wg_peer *peer, struct sk_buff *skb, struct dump_ctx *ctx) if (!allowedips_node) goto no_allowedips; if (!ctx->allowedips_seq) - ctx->allowedips_seq = peer->device->peer_allowedips.seq; - else if (ctx->allowedips_seq != peer->device->peer_allowedips.seq) + ctx->allowedips_seq = ctx->wg->peer_allowedips.seq; + else if (ctx->allowedips_seq != ctx->wg->peer_allowedips.seq) goto no_allowedips; allowedips_nest = nla_nest_start(skb, WGPEER_A_ALLOWEDIPS); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] nfp: flower: handle acti_netdevs allocation failure
by Liu Chuang 08 May '24

08 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v4.19.311 commit d746889db75a76aeee95fb705b8e1ac28c684a2e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NDFD CVE: CVE-2024-27046 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 84e95149bd341705f0eca6a7fcb955c548805002 ] The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_netdevs, the null pointer dereference bugs will happen. This patch adds a check to judge whether allocation failure occurs. If it happens, the delayed work will be rescheduled and try again. Fixes: bb9a8d031140 ("nfp: flower: monitor and offload LAG groups") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Louis Peens <louis.peens(a)corigine.com> Link: https://lore.kernel.org/r/20240308142540.9674-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/net/ethernet/netronome/nfp/flower/lag_conf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c index bf10598f66ae..1b5e0cef9771 100644 --- a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c +++ b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c @@ -336,6 +336,11 @@ static void nfp_fl_lag_do_work(struct work_struct *work) acti_netdevs = kmalloc_array(entry->slave_cnt, sizeof(*acti_netdevs), GFP_KERNEL); + if (!acti_netdevs) { + schedule_delayed_work(&lag->work, + NFP_FL_LAG_DELAY); + continue; + } /* Include sanity check in the loop. It may be that a bond has * changed between processing the last notification and the -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: validate payload size in ipc response
by ZhaoLong Wang 08 May '24

08 May '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.157 commit 88b7f1143b15b29cccb8392b4f38e75b7bb3e300 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9EYBG CVE: CVE-2024-26811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a677ebd8ca2f2632ccdecbad7b87641274e15aac ] If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ipc response from ksmbd.mountd to avoid memory overrun or slab-out-of-bounds. This patch validate 3 ipc response that has payload. Cc: stable(a)vger.kernel.org Reported-by: Chao Ma <machao2019(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ksmbd/ksmbd_netlink.h Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/ksmbd/ksmbd_netlink.h | 3 ++- fs/ksmbd/mgmt/share_config.c | 7 ++++++- fs/ksmbd/transport_ipc.c | 37 ++++++++++++++++++++++++++++++++++++ 3 files changed, 45 insertions(+), 2 deletions(-) diff --git a/fs/ksmbd/ksmbd_netlink.h b/fs/ksmbd/ksmbd_netlink.h index 583f95be5284..2fcee69a4e1e 100644 --- a/fs/ksmbd/ksmbd_netlink.h +++ b/fs/ksmbd/ksmbd_netlink.h @@ -162,7 +162,8 @@ struct ksmbd_share_config_response { __u16 force_directory_mode; __u16 force_uid; __u16 force_gid; - __u32 reserved[128]; /* Reserved room */ + __u32 reserved[127]; /* Reserved room */ + __u32 payload_sz; __u32 veto_list_sz; __s8 ____payload[]; }; diff --git a/fs/ksmbd/mgmt/share_config.c b/fs/ksmbd/mgmt/share_config.c index 70655af93b44..8550fc5a3a78 100644 --- a/fs/ksmbd/mgmt/share_config.c +++ b/fs/ksmbd/mgmt/share_config.c @@ -139,7 +139,12 @@ static struct ksmbd_share_config *share_config_request(char *name) share->name = kstrdup(name, GFP_KERNEL); if (!test_share_config_flag(share, KSMBD_SHARE_FLAG_PIPE)) { - share->path = kstrdup(ksmbd_share_config_path(resp), + int path_len = PATH_MAX; + + if (resp->payload_sz) + path_len = resp->payload_sz - resp->veto_list_sz; + + share->path = kstrndup(ksmbd_share_config_path(resp), path_len, GFP_KERNEL); if (share->path) share->path_sz = strlen(share->path); diff --git a/fs/ksmbd/transport_ipc.c b/fs/ksmbd/transport_ipc.c index cf88f0aa48e0..e42e785d253c 100644 --- a/fs/ksmbd/transport_ipc.c +++ b/fs/ksmbd/transport_ipc.c @@ -64,6 +64,7 @@ struct ipc_msg_table_entry { struct hlist_node ipc_table_hlist; void *response; + unsigned int msg_sz; }; static struct delayed_work ipc_timer_work; @@ -273,6 +274,7 @@ static int handle_response(int type, void *payload, size_t sz) } memcpy(entry->response, payload, sz); + entry->msg_sz = sz; wake_up_interruptible(&entry->wait); ret = 0; break; @@ -446,6 +448,34 @@ static int ipc_msg_send(struct ksmbd_ipc_msg *msg) return ret; } +static int ipc_validate_msg(struct ipc_msg_table_entry *entry) +{ + unsigned int msg_sz = entry->msg_sz; + + if (entry->type == KSMBD_EVENT_RPC_REQUEST) { + struct ksmbd_rpc_command *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_rpc_command) + resp->payload_sz; + } else if (entry->type == KSMBD_EVENT_SPNEGO_AUTHEN_REQUEST) { + struct ksmbd_spnego_authen_response *resp = entry->response; + + msg_sz = sizeof(struct ksmbd_spnego_authen_response) + + resp->session_key_len + resp->spnego_blob_len; + } else if (entry->type == KSMBD_EVENT_SHARE_CONFIG_REQUEST) { + struct ksmbd_share_config_response *resp = entry->response; + + if (resp->payload_sz) { + if (resp->payload_sz < resp->veto_list_sz) + return -EINVAL; + + msg_sz = sizeof(struct ksmbd_share_config_response) + + resp->payload_sz; + } + } + + return entry->msg_sz != msg_sz ? -EINVAL : 0; +} + static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle) { struct ipc_msg_table_entry entry; @@ -470,6 +500,13 @@ static void *ipc_msg_send_request(struct ksmbd_ipc_msg *msg, unsigned int handle ret = wait_event_interruptible_timeout(entry.wait, entry.response != NULL, IPC_WAIT_TIMEOUT); + if (entry.response) { + ret = ipc_validate_msg(&entry); + if (ret) { + kvfree(entry.response); + entry.response = NULL; + } + } out: down_write(&ipc_msg_table_lock); hash_del(&entry.ipc_table_hlist); -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
by Lin Yujun 08 May '24

08 May '24

From: Dongxiang Ke <kdx.glider(a)gmail.com> stable inclusion from stable-v4.19.258 commit 2a308e415d247a23d4d64c964c02e782eede2936 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9LKC3 CVE: CVE-2022-48701 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf upstream. There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Signed-off-by: Dongxiang Ke <kdx.glider(a)gmail.com> Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> --- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/stream.c b/sound/usb/stream.c index 9d020bd0de17..971d39403b43 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -1110,7 +1110,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no) * Dallas DS4201 workaround: It presents 5 altsettings, but the last * one misses syncpipe, and does not produce any sound. */ - if (chip->usb_id == USB_ID(0x04fa, 0x4201)) + if (chip->usb_id == USB_ID(0x04fa, 0x4201) && num >= 4) num = 4; for (i = 0; i < num; i++) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mac802154: fix llsec key resources release in mac802154_llsec_key_del
by Cai Xinchen 08 May '24

08 May '24

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v5.10.215 commit 068ab2759bc0b4daf0b964de61b2731449c86531 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5OC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8a1e58345cf40b7b272e08ac7b32328b2543e40 ] mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0 [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0 [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0 [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80 [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0 [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0 [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0 [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440 [<ffffffff86ff1d88>] genl_rcv+0x28/0x40 [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820 [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60 [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0 [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0 [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0 [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0 [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org) Fixes: 5d637d5aabd8 ("mac802154: add llsec structures and mutators") Cc: stable(a)vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Acked-by: Alexander Aring <aahringo(a)redhat.com> Message-ID: <20240228163840.6667-1-pchelkin(a)ispras.ru> Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/mac802154/llsec.c [Use kzfree instead of kfree_sensitive because commit 453431a54934 ("mm, treewide: rename kzfree() to kfree_sensitive()") not merged] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- include/net/cfg802154.h | 1 + net/mac802154/llsec.c | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h index 795ca4008f72..ee8af7c74d18 100644 --- a/include/net/cfg802154.h +++ b/include/net/cfg802154.h @@ -265,6 +265,7 @@ struct ieee802154_llsec_key { struct ieee802154_llsec_key_entry { struct list_head list; + struct rcu_head rcu; struct ieee802154_llsec_key_id id; struct ieee802154_llsec_key *key; diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c index d742e635ad07..48e958dbe9a4 100644 --- a/net/mac802154/llsec.c +++ b/net/mac802154/llsec.c @@ -273,19 +273,27 @@ int mac802154_llsec_key_add(struct mac802154_llsec *sec, return -ENOMEM; } +static void mac802154_llsec_key_del_rcu(struct rcu_head *rcu) +{ + struct ieee802154_llsec_key_entry *pos; + struct mac802154_llsec_key *mkey; + + pos = container_of(rcu, struct ieee802154_llsec_key_entry, rcu); + mkey = container_of(pos->key, struct mac802154_llsec_key, key); + + llsec_key_put(mkey); + kzfree(pos); +} + int mac802154_llsec_key_del(struct mac802154_llsec *sec, const struct ieee802154_llsec_key_id *key) { struct ieee802154_llsec_key_entry *pos; list_for_each_entry(pos, &sec->table.keys, list) { - struct mac802154_llsec_key *mkey; - - mkey = container_of(pos->key, struct mac802154_llsec_key, key); - if (llsec_key_id_equal(&pos->id, key)) { list_del_rcu(&pos->list); - llsec_key_put(mkey); + call_rcu(&pos->rcu, mac802154_llsec_key_del_rcu); return 0; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-26974
by Xia Fukun 08 May '24

08 May '24

CVE-2024-26974 patch: Damian Muszynski (1): crypto: qat - resolve race condition during AER recovery Svyatoslav Pankratov (1): crypto: qat - fix double free during reset drivers/crypto/qat/qat_common/adf_aer.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-6.6 1625/9446] ld: drivers/video/fbdev/ls2k500sfb.c:247:undefined reference to `fg_console'
by kernel test robot 08 May '24

08 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0993c620607a484e46e5954e6d6b012184a40803 commit: 8248d42b7c5f4338a54f26d8efebec8614b43466 [1625/9446] fbdev: add ls2k500sfb driver for ls2k500 bmc. config: x86_64-randconfig-016-20240508 (https://download.01.org/0day-ci/archive/20240508/202405081542.RUf3xcAg-lkp@…) compiler: gcc-10 (Ubuntu 10.5.0-1ubuntu1) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405081542.RUf3xcAg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405081542.RUf3xcAg-lkp@intel.com/ All errors (new ones prefixed by >>): ld: vmlinux.o: in function `ls2k500sfb_events_fn': drivers/video/fbdev/ls2k500sfb.c:247:(.text+0x1225f33): undefined reference to `fg_console' >> ld: drivers/video/fbdev/ls2k500sfb.c:247:(.text+0x1225f60): undefined reference to `fg_console' ld: drivers/video/fbdev/ls2k500sfb.c:247:(.text+0x12261e2): undefined reference to `fg_console' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nfp: flower: handle acti_netdevs allocation failure
by Liu Chuang 08 May '24

08 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v4.19.311 commit d746889db75a76aeee95fb705b8e1ac28c684a2e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NDFD Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 84e95149bd341705f0eca6a7fcb955c548805002 ] The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_netdevs, the null pointer dereference bugs will happen. This patch adds a check to judge whether allocation failure occurs. If it happens, the delayed work will be rescheduled and try again. Fixes: bb9a8d031140 ("nfp: flower: monitor and offload LAG groups") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Louis Peens <louis.peens(a)corigine.com> Link: https://lore.kernel.org/r/20240308142540.9674-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/net/ethernet/netronome/nfp/flower/lag_conf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c index bf10598f66ae..1b5e0cef9771 100644 --- a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c +++ b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c @@ -336,6 +336,11 @@ static void nfp_fl_lag_do_work(struct work_struct *work) acti_netdevs = kmalloc_array(entry->slave_cnt, sizeof(*acti_netdevs), GFP_KERNEL); + if (!acti_netdevs) { + schedule_delayed_work(&lag->work, + NFP_FL_LAG_DELAY); + continue; + } /* Include sanity check in the loop. It may be that a bond has * changed between processing the last notification and the -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] speakup: Avoid crash on very long word
by Zhang Xiaoxu 08 May '24

08 May '24

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v6.9-rc5 commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5L5 CVE: CVE-2024-26994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer. Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Fixes: c6e3fd22cd538 ("Staging: add speakup to the staging directory") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240323164843.1426997-1-samuel.thibault@ens-lyon… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/staging/speakup/main.c [file was copy from drivers/staging/speakup/main.c to drivers/accessibility/speakup/main.c] Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/staging/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c index 869f40ebf1a7..8dd47a995fd9 100644 --- a/drivers/staging/speakup/main.c +++ b/drivers/staging/speakup/main.c @@ -577,7 +577,7 @@ static u_long get_word(struct vc_data *vc) } attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; - while (tmpx < vc->vc_cols - 1) { + while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) { tmp_pos += 2; tmpx++; ch = get_char(vc, (u_short *)tmp_pos, &temp); -- 2.34.1

2 1

[PATCH OLK-5.10 v2] memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
by Liu Shixin 08 May '24

08 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NC0J CVE: NA -------------------------------- The function sysctl_memcg_swap_qos_handler() doesn't handle error case correctly and care nothing about concurrency. To fix it, we should do two thing: 1. reset sysctl_memcg_swap_qos_stat to old value for error case. 2. add a mutex_lock to protect the process. Fixes: 8202acc60f97 ("memcg/swap: add ability to disable memcg swap") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/memcontrol.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index f5add1247f43..9f8646bf51e2 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4095,22 +4095,21 @@ static int sysctl_memcg_swap_qos_handler(struct ctl_table *table, int write, void __user *buffer, size_t *length, loff_t *ppos) { int ret; - int qos_stat_old = sysctl_memcg_swap_qos_stat; + int qos_stat_old; int swap_type; + static DEFINE_MUTEX(sysctl_mutex); + mutex_lock(&sysctl_mutex); + qos_stat_old = sysctl_memcg_swap_qos_stat; ret = proc_dointvec_minmax(table, write, buffer, length, ppos); - if (ret) - return ret; - - if (qos_stat_old == sysctl_memcg_swap_qos_stat) - return 0; - - if (write) { + if (write && !ret) { + if (qos_stat_old == sysctl_memcg_swap_qos_stat) + goto unlock; switch (sysctl_memcg_swap_qos_stat) { case MEMCG_SWAP_STAT_DISABLE: static_branch_disable(&memcg_swap_qos_key); - return 0; + goto unlock; case MEMCG_SWAP_STAT_ALL: swap_type = SWAP_TYPE_ALL; break; @@ -4119,16 +4118,26 @@ static int sysctl_memcg_swap_qos_handler(struct ctl_table *table, int write, break; } + /* + * Enable the feature when it is in disabled state. + * If it is already in enabled state, don't allowed + * to switch it to other state directly since it is + * dangerous that will impact all memory cgroups. + */ if (!qos_stat_old) { memcg_swap_qos_reset(swap_type); static_branch_enable(&memcg_swap_qos_key); enable_swap_slots_cache_max(); } else { - return -EINVAL; + sysctl_memcg_swap_qos_stat = qos_stat_old; + ret = -EINVAL; } } - return 0; +unlock: + mutex_unlock(&sysctl_mutex); + + return ret; } static struct ctl_table memcg_swap_qos_sysctls[] = { -- 2.25.1

2 1

[openeuler:OLK-6.6 7227/7652] ERROR: modpost: "msi_domain_first_desc" [drivers/scsi/sssraid/sssraid.ko] undefined!
by kernel test robot 08 May '24

08 May '24

Hi chriszhou, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: afd82dd979acad2f99b9d30f8ce8463ca4153a05 commit: 165b3cc224374728856b5584455d7ae7f054fbe5 [7227/7652] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers config: x86_64-randconfig-003-20240508 (https://download.01.org/0day-ci/archive/20240508/202405081432.FGceylSZ-lkp@…) compiler: clang version 18.1.4 (https://github.com/llvm/llvm-project e6c3289804a67ea0bb6a86fadbe454dd93b8d855) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405081432.FGceylSZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405081432.FGceylSZ-lkp@intel.com/ All errors (new ones prefixed by >>, old ones prefixed by <<): WARNING: modpost: missing MODULE_DESCRIPTION() in fs/efs/efs.o WARNING: modpost: missing MODULE_DESCRIPTION() in fs/adfs/adfs.o WARNING: modpost: missing MODULE_DESCRIPTION() in security/keys/encrypted-keys/encrypted-keys.o WARNING: modpost: missing MODULE_DESCRIPTION() in lib/kunit/kunit.o WARNING: modpost: missing MODULE_DESCRIPTION() in lib/kunit/kunit-example-test.o WARNING: modpost: missing MODULE_DESCRIPTION() in lib/math/prime_numbers.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pinctrl/pinctrl-mcp23s08_i2c.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pinctrl/pinctrl-mcp23s08.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pci/pci-pf-stub.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/video/backlight/platform_lcd.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/acpi/nfit/nfit.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/clk/clk_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/clk/clk-gate_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/dma/qcom/hdma_mgmt.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/dma/ioat/ioatdma.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/virtio/virtio_dma_buf.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/char/ppdev.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_kunit_helpers.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_buddy_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_cmdline_parser_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_connector_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_damage_helper_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_dp_mst_helper_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_format_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_framebuffer_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_managed_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_mm_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_modes_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_plane_helper_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_probe_helper_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_rect_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpu/drm/tests/drm_exec_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/base/regmap/regmap-kunit.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/base/regmap/regmap-ram.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/base/regmap/regmap-raw-ram.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/base/regmap/regmap-slimbus.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/base/regmap/regmap-sccb.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/block/floppy.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mfd/intel_soc_pmic_bxtwc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvdimm/nd_pmem.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvdimm/nd_btt.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/scsi/isci/isci.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/scsi/imm.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme-core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme-fabrics.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme-fc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/target/nvmet.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/target/nvmet-fc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/spmi/hisi-spmi-controller.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firewire/firewire-uapi-test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/cdrom/cdrom.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/auxdisplay/charlcd.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/auxdisplay/hd44780_common.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/pcmcia/i82092.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/input/tests/input_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/rtc/lib_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/rtc/rtc-rc5t583.o WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/tuners/tda9887.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/v4l2-core/v4l2-async.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/v4l2-core/v4l2-fwnode.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/thermal/intel/int340x_thermal/processor_thermal_rapl.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/thermal/intel/int340x_thermal/processor_thermal_rfim.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/thermal/intel/int340x_thermal/processor_thermal_mbox.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firmware/google/gsmi.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-apple.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-cypress.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-emsff.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-ite.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-kensington.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-keytouch.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-maltron.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-microsoft.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-pl.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-tivo.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-xinmo.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/hid-zpff.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hid/intel-ish-hid/intel-ishtp.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/greybus/gb-bootrom.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/greybus/gb-hid.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/greybus/gb-log.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/greybus/gb-vibrator.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/greybus/gb-gbphy.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/greybus/gb-gpio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/greybus/gb-i2c.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/platform/x86/intel/pmc/intel_pmc_core_pltdrv.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/platform/x86/intel/intel-rst.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hwtracing/intel_th/intel_th_msu_sink.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/parport/parport.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/dca/dca.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/greybus/greybus.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/configfs/configfs_sample.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/kfifo/bytestream-example.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/kfifo/dma-example.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/kfifo/inttype-example.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/kfifo/record-example.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/kobject/kobject-example.o WARNING: modpost: missing MODULE_DESCRIPTION() in samples/kobject/kset-example.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/core/dev_addr_lists_test.o >> ERROR: modpost: "msi_domain_first_desc" [drivers/scsi/sssraid/sssraid.ko] undefined! >> ERROR: modpost: "msi_next_desc" [drivers/scsi/sssraid/sssraid.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3342/7652] ld.lld: error: undefined symbol: public_key_free
by kernel test robot 08 May '24

08 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: afd82dd979acad2f99b9d30f8ce8463ca4153a05 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [3342/7652] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-buildonly-randconfig-006-20240508 (https://download.01.org/0day-ci/archive/20240508/202405081222.HGBT9mha-lkp@…) compiler: clang version 18.1.4 (https://github.com/llvm/llvm-project e6c3289804a67ea0bb6a86fadbe454dd93b8d855) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405081222.HGBT9mha-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405081222.HGBT9mha-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: public_key_free >>> referenced by usercopy_64.c >>> vmlinux.o:(pgp_key_parse) -- >> ld.lld: error: undefined symbol: public_key_subtype >>> referenced by usercopy_64.c >>> vmlinux.o:(pgp_key_parse) Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v2 OLK-5.10 0/3] CVE-2024-27000
by GONG, Ruiqi 08 May '24

08 May '24

CVE-2024-27000 Emil Kronborg (1): serial: mxs-auart: add spinlock around changing cts state Randy Dunlap (1): serial: core: fix kernel-doc for uart_port_unlock_irqrestore() Thomas Gleixner (1): serial: core: Provide port lock wrappers drivers/tty/serial/mxs-auart.c | 8 +++- include/linux/serial_core.h | 79 ++++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+), 2 deletions(-) -- 2.25.1

2 4

[PATCH v2 openEuler-1.0-LTS 0/3] CVE-2024-27000
by GONG, Ruiqi 08 May '24

08 May '24

CVE-2024-27000 Emil Kronborg (1): serial: mxs-auart: add spinlock around changing cts state Randy Dunlap (1): serial: core: fix kernel-doc for uart_port_unlock_irqrestore() Thomas Gleixner (1): serial: core: Provide port lock wrappers drivers/tty/serial/mxs-auart.c | 8 +++- include/linux/serial_core.h | 79 ++++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+), 2 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] mac802154: fix llsec key resources release in mac802154_llsec_key_del
by Cai Xinchen 08 May '24

08 May '24

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v5.10.215 commit 068ab2759bc0b4daf0b964de61b2731449c86531 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5OC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8a1e58345cf40b7b272e08ac7b32328b2543e40 ] mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0 [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0 [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0 [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80 [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0 [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0 [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0 [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440 [<ffffffff86ff1d88>] genl_rcv+0x28/0x40 [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820 [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60 [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0 [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0 [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0 [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0 [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org) Fixes: 5d637d5aabd8 ("mac802154: add llsec structures and mutators") Cc: stable(a)vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Acked-by: Alexander Aring <aahringo(a)redhat.com> Message-ID: <20240228163840.6667-1-pchelkin(a)ispras.ru> Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- include/net/cfg802154.h | 1 + net/mac802154/llsec.c | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/include/net/cfg802154.h b/include/net/cfg802154.h index 6ed07844eb24..5290781abba3 100644 --- a/include/net/cfg802154.h +++ b/include/net/cfg802154.h @@ -257,6 +257,7 @@ struct ieee802154_llsec_key { struct ieee802154_llsec_key_entry { struct list_head list; + struct rcu_head rcu; struct ieee802154_llsec_key_id id; struct ieee802154_llsec_key *key; diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c index 55550ead2ced..a4cc9d077c59 100644 --- a/net/mac802154/llsec.c +++ b/net/mac802154/llsec.c @@ -265,19 +265,27 @@ int mac802154_llsec_key_add(struct mac802154_llsec *sec, return -ENOMEM; } +static void mac802154_llsec_key_del_rcu(struct rcu_head *rcu) +{ + struct ieee802154_llsec_key_entry *pos; + struct mac802154_llsec_key *mkey; + + pos = container_of(rcu, struct ieee802154_llsec_key_entry, rcu); + mkey = container_of(pos->key, struct mac802154_llsec_key, key); + + llsec_key_put(mkey); + kfree_sensitive(pos); +} + int mac802154_llsec_key_del(struct mac802154_llsec *sec, const struct ieee802154_llsec_key_id *key) { struct ieee802154_llsec_key_entry *pos; list_for_each_entry(pos, &sec->table.keys, list) { - struct mac802154_llsec_key *mkey; - - mkey = container_of(pos->key, struct mac802154_llsec_key, key); - if (llsec_key_id_equal(&pos->id, key)) { list_del_rcu(&pos->list); - llsec_key_put(mkey); + call_rcu(&pos->rcu, mac802154_llsec_key_del_rcu); return 0; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: nf_tables: fix memleak in map from abort path
by Liu Jian 08 May '24

08 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.9-rc5 commit 86a1471d7cde792941109b93b558b5dc078b9ee9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5OD CVE: CVE-2024-27011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping. Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator. [ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202 [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10 [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Call Trace: [ 6170.287967] <TASK> [ 6170.287973] ? __warn+0x9f/0x1a0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.288104] ? handle_bug+0x3c/0x70 [ 6170.288112] ? exc_invalid_op+0x17/0x40 [ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20 [ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables] Fixes: 591054469b3e ("netfilter: nf_tables: revisit chain/object refcounting from elements") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [Did not backport the commit aaa31047a6d2 ("netfilter: nftables: add catch-all set element support"), commit f80a612dd77c ("netfilter: nf_tables: add support to destroy operation"), and commit 0e1ea651c971 ("netfilter: nf_tables: shrink memory consumption of set elements").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 4089580145fe..f70fedb98695 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4702,6 +4702,16 @@ void nft_data_hold(const struct nft_data *data, enum nft_data_types type) } } +static int nft_setelem_active_next(const struct net *net, + const struct nft_set *set, + struct nft_set_elem *elem) +{ + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); + u8 genmask = nft_genmask_next(net); + + return nft_set_elem_active(ext, genmask); +} + static void nft_set_elem_activate(const struct net *net, const struct nft_set *set, struct nft_set_elem *elem) @@ -6806,8 +6816,10 @@ static int __nf_tables_abort(struct net *net) case NFT_MSG_DELSETELEM: te = (struct nft_trans_elem *)trans->data; - nft_set_elem_activate(net, te->set, &te->elem); - te->set->ops->activate(net, te->set, &te->elem); + if (!nft_setelem_active_next(net, te->set, &te->elem)) { + nft_set_elem_activate(net, te->set, &te->elem); + te->set->ops->activate(net, te->set, &te->elem); + } te->set->ndeact--; nft_trans_destroy(trans); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfp: flower: handle acti_netdevs allocation failure
by Liu Chuang 08 May '24

08 May '24

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-4.19.311 commit d746889db75a76aeee95fb705b8e1ac28c684a2e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NDFD Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 84e95149bd341705f0eca6a7fcb955c548805002 ] The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_netdevs, the null pointer dereference bugs will happen. This patch adds a check to judge whether allocation failure occurs. If it happens, the delayed work will be rescheduled and try again. Fixes: bb9a8d031140 ("nfp: flower: monitor and offload LAG groups") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Louis Peens <louis.peens(a)corigine.com> Link: https://lore.kernel.org/r/20240308142540.9674-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/net/ethernet/netronome/nfp/flower/lag_conf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c index bf10598f66ae..1b5e0cef9771 100644 --- a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c +++ b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c @@ -336,6 +336,11 @@ static void nfp_fl_lag_do_work(struct work_struct *work) acti_netdevs = kmalloc_array(entry->slave_cnt, sizeof(*acti_netdevs), GFP_KERNEL); + if (!acti_netdevs) { + schedule_delayed_work(&lag->work, + NFP_FL_LAG_DELAY); + continue; + } /* Include sanity check in the loop. It may be that a bond has * changed between processing the last notification and the -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: fix memleak in map from abort path
by Liu Jian 08 May '24

08 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.9-rc5 commit 86a1471d7cde792941109b93b558b5dc078b9ee9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5OD CVE: CVE-2024-27011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delete set from the abort path could result in restoring twice the refcount of the mapping. Check for inactive element in the next generation for the delete element command in the abort path, skip restoring state if next generation bit has been already cleared. This is similar to the activate logic using the set walk iterator. [ 6170.286929] ------------[ cut here ]------------ [ 6170.286939] WARNING: CPU: 6 PID: 790302 at net/netfilter/nf_tables_api.c:2086 nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287071] Modules linked in: [...] [ 6170.287633] CPU: 6 PID: 790302 Comm: kworker/6:2 Not tainted 6.9.0-rc3+ #365 [ 6170.287768] RIP: 0010:nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.287886] Code: df 48 8d 7d 58 e8 69 2e 3b df 48 8b 7d 58 e8 80 1b 37 df 48 8d 7d 68 e8 57 2e 3b df 48 8b 7d 68 e8 6e 1b 37 df 48 89 ef eb c4 <0f> 0b 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 0f [ 6170.287895] RSP: 0018:ffff888134b8fd08 EFLAGS: 00010202 [ 6170.287904] RAX: 0000000000000001 RBX: ffff888125bffb28 RCX: dffffc0000000000 [ 6170.287912] RDX: 0000000000000003 RSI: ffffffffa20298ab RDI: ffff88811ebe4750 [ 6170.287919] RBP: ffff88811ebe4700 R08: ffff88838e812650 R09: fffffbfff0623a55 [ 6170.287926] R10: ffffffff8311d2af R11: 0000000000000001 R12: ffff888125bffb10 [ 6170.287933] R13: ffff888125bffb10 R14: dead000000000122 R15: dead000000000100 [ 6170.287940] FS: 0000000000000000(0000) GS:ffff888390b00000(0000) knlGS:0000000000000000 [ 6170.287948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6170.287955] CR2: 00007fd31fc00710 CR3: 0000000133f60004 CR4: 00000000001706f0 [ 6170.287962] Call Trace: [ 6170.287967] <TASK> [ 6170.287973] ? __warn+0x9f/0x1a0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.287986] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288092] ? report_bug+0x1b1/0x1e0 [ 6170.288104] ? handle_bug+0x3c/0x70 [ 6170.288112] ? exc_invalid_op+0x17/0x40 [ 6170.288120] ? asm_exc_invalid_op+0x1a/0x20 [ 6170.288132] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288243] ? nf_tables_chain_destroy+0x1f7/0x220 [nf_tables] [ 6170.288366] ? nf_tables_chain_destroy+0x2b/0x220 [nf_tables] [ 6170.288483] nf_tables_trans_destroy_work+0x588/0x590 [nf_tables] Fixes: 591054469b3e ("netfilter: nf_tables: revisit chain/object refcounting from elements") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [Did not backport the commit aaa31047a6d2 ("netfilter: nftables: add catch-all set element support"), commit f80a612dd77c ("netfilter: nf_tables: add support to destroy operation"), and commit 0e1ea651c971 ("netfilter: nf_tables: shrink memory consumption of set elements").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_tables_api.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 1cfd98d76060..7bab8f7c7017 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5843,6 +5843,16 @@ void nft_data_hold(const struct nft_data *data, enum nft_data_types type) } } +static int nft_setelem_active_next(const struct net *net, + const struct nft_set *set, + struct nft_set_elem *elem) +{ + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); + u8 genmask = nft_genmask_next(net); + + return nft_set_elem_active(ext, genmask); +} + static void nft_setelem_data_activate(const struct net *net, const struct nft_set *set, struct nft_set_elem *elem) @@ -8877,8 +8887,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) case NFT_MSG_DELSETELEM: te = (struct nft_trans_elem *)trans->data; - nft_setelem_data_activate(net, te->set, &te->elem); - te->set->ops->activate(net, te->set, &te->elem); + if (!nft_setelem_active_next(net, te->set, &te->elem)) { + nft_setelem_data_activate(net, te->set, &te->elem); + te->set->ops->activate(net, te->set, &te->elem); + } te->set->ndeact--; if (te->set->ops->abort && -- 2.34.1

2 1

[PATCH OLK-5.10] memcg: fix incorrect value of sysctl_memcg_swap_qos_stat
by Liu Shixin 08 May '24

08 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NC0J CVE: NA -------------------------------- The function sysctl_memcg_swap_qos_handler() doesn't handle error case correctly and care nothing about concurrency. To fix it, we should do two thing: 1. reset sysctl_memcg_swap_qos_stat to old value for error case. 2. add a mutex_lock to protect the process. Fixes: 8202acc60f97 ("memcg/swap: add ability to disable memcg swap") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/memcontrol.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index f5add1247f43..aeb9e930cd50 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4095,22 +4095,21 @@ static int sysctl_memcg_swap_qos_handler(struct ctl_table *table, int write, void __user *buffer, size_t *length, loff_t *ppos) { int ret; - int qos_stat_old = sysctl_memcg_swap_qos_stat; + int qos_stat_old; int swap_type; + static DEFINE_MUTEX(sysctl_mutex); + mutex_lock(&sysctl_mutex); + qos_stat_old = sysctl_memcg_swap_qos_stat; ret = proc_dointvec_minmax(table, write, buffer, length, ppos); - if (ret) - return ret; - - if (qos_stat_old == sysctl_memcg_swap_qos_stat) - return 0; - - if (write) { + if (write && !ret) { + if (qos_stat_old == sysctl_memcg_swap_qos_stat) + goto unlock; switch (sysctl_memcg_swap_qos_stat) { case MEMCG_SWAP_STAT_DISABLE: static_branch_disable(&memcg_swap_qos_key); - return 0; + goto unlock; case MEMCG_SWAP_STAT_ALL: swap_type = SWAP_TYPE_ALL; break; @@ -4124,11 +4123,15 @@ static int sysctl_memcg_swap_qos_handler(struct ctl_table *table, int write, static_branch_enable(&memcg_swap_qos_key); enable_swap_slots_cache_max(); } else { - return -EINVAL; + sysctl_memcg_swap_qos_stat = qos_stat_old; + ret = -EINVAL; } } - return 0; +unlock: + mutex_unlock(&sysctl_mutex); + + return ret; } static struct ctl_table memcg_swap_qos_sysctls[] = { -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-27000
by GONG, Ruiqi 08 May '24

08 May '24

CVE-2024-27000 Emil Kronborg (1): serial: mxs-auart: add spinlock around changing cts state Thomas Gleixner (1): serial: core: Provide port lock wrappers drivers/tty/serial/mxs-auart.c | 8 +++- include/linux/serial_core.h | 79 ++++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-27000
by GONG, Ruiqi 08 May '24

08 May '24

CVE-2024-27000 Emil Kronborg (1): serial: mxs-auart: add spinlock around changing cts state Thomas Gleixner (1): serial: core: Provide port lock wrappers drivers/tty/serial/mxs-auart.c | 8 +++- include/linux/serial_core.h | 79 ++++++++++++++++++++++++++++++++++ 2 files changed, 85 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS v2] spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
by Wenyu Huang 08 May '24

08 May '24

From: Fei Shao <fshao(a)chromium.org> stable inclusion from stable-v4.19.313 commit 2342b05ec5342a519e00524a507f7a6ea6791a38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9O8 CVE: CVE-2024-27028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit a20ad45008a7c82f1184dc6dee280096009ece55 ] The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause crashes. Add a check to trans->tx_buf before using it. Fixes: 1ce24864bff4 ("spi: mediatek: Only do dma for 4-byte aligned buffers") Signed-off-by: Fei Shao <fshao(a)chromium.org> Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Link: https://msgid.link/r/20240321070942.1587146-2-fshao@chromium.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/spi/spi-mt65xx.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c index 0c2867deb36f..1a1c54bf2ae1 100644 --- a/drivers/spi/spi-mt65xx.c +++ b/drivers/spi/spi-mt65xx.c @@ -522,17 +522,19 @@ static irqreturn_t mtk_spi_interrupt(int irq, void *dev_id) mdata->xfer_len = min(MTK_SPI_MAX_FIFO_SIZE, len); mtk_spi_setup_packet(master); - cnt = mdata->xfer_len / 4; - iowrite32_rep(mdata->base + SPI_TX_DATA_REG, - trans->tx_buf + mdata->num_xfered, cnt); - - remainder = mdata->xfer_len % 4; - if (remainder > 0) { - reg_val = 0; - memcpy(&reg_val, - trans->tx_buf + (cnt * 4) + mdata->num_xfered, - remainder); - writel(reg_val, mdata->base + SPI_TX_DATA_REG); + if (trans->tx_buf) { + cnt = mdata->xfer_len / 4; + iowrite32_rep(mdata->base + SPI_TX_DATA_REG, + trans->tx_buf + mdata->num_xfered, cnt); + + remainder = mdata->xfer_len % 4; + if (remainder > 0) { + reg_val = 0; + memcpy(&reg_val, + trans->tx_buf + (cnt * 4) + mdata->num_xfered, + remainder); + writel(reg_val, mdata->base + SPI_TX_DATA_REG); + } } mtk_spi_enable_transfer(master); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] USB: core: Fix deadlock in usb_deauthorize_interface()
by Ye Bin 08 May '24

08 May '24

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.9-rc2 commit 80ba43e9f799cbdd83842fc27db667289b3150f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5GW CVE: CVE-2024-26934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which acquires a device lock on an ancestor device: It calls usb_deauthorize_interface(), which locks the interface's parent USB device. The will lead to deadlock if another process already owns that lock and tries to remove the interface, whether through a configuration change or because the device has been disconnected. As part of the removal procedure, device_del() waits for all ongoing sysfs attribute callbacks to complete. But usb_deauthorize_interface() can't complete until the device lock has been released, and the lock won't be released until the removal has finished. The mechanism provided by sysfs to prevent this kind of deadlock is to use the sysfs_break_active_protection() function, which tells sysfs not to wait for the attribute callback. Reported-and-tested by: Yue Sun <samsun1006219(a)gmail.com> Reported by: xingwei lee <xrivendell7(a)gmail.com> Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/linux-usb/CAEkJfYO6jRVC8Tfrd_R=cjO0hguhrV31fDPrLrNO… Fixes: 310d2b4124c0 ("usb: interface authorization: SysFS part of USB interface authorization") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/1c37eea1-9f56-4534-b9d8-b443438dc869@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/usb/core/sysfs.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/core/sysfs.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c index 7e88fdfe3cf5..314f2d996c56 100644 --- a/drivers/usb/core/sysfs.c +++ b/drivers/usb/core/sysfs.c @@ -1069,14 +1069,24 @@ static ssize_t interface_authorized_store(struct device *dev, { struct usb_interface *intf = to_usb_interface(dev); bool val; + struct kernfs_node *kn; if (strtobool(buf, &val) != 0) return -EINVAL; - if (val) + if (val) { usb_authorize_interface(intf); - else - usb_deauthorize_interface(intf); + } else { + /* + * Prevent deadlock if another process is concurrently + * trying to unregister intf. + */ + kn = sysfs_break_active_protection(&dev->kobj, &attr->attr); + if (kn) { + usb_deauthorize_interface(intf); + sysfs_unbreak_active_protection(kn); + } + } return count; } -- 2.31.1

2 1

[PATCH OLK-5.10] speakup: Avoid crash on very long word
by Zhang Xiaoxu 08 May '24

08 May '24

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v6.9-rc5 commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5L5 CVE: CVE-2024-26994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer. Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Fixes: c6e3fd22cd538 ("Staging: add speakup to the staging directory") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240323164843.1426997-1-samuel.thibault@ens-lyon… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/accessibility/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accessibility/speakup/main.c b/drivers/accessibility/speakup/main.c index 63c5444f0f1a..7598778cf37f 100644 --- a/drivers/accessibility/speakup/main.c +++ b/drivers/accessibility/speakup/main.c @@ -576,7 +576,7 @@ static u_long get_word(struct vc_data *vc) } attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; - while (tmpx < vc->vc_cols - 1) { + while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) { tmp_pos += 2; tmpx++; ch = get_char(vc, (u_short *)tmp_pos, &temp); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] ima: fix deadlock when traversing "ima_default_rules".
by GUO Zihua 08 May '24

08 May '24

From: liqiong <liqiong(a)nfschina.com> mainline inclusion from mainline-v5.16-rc1 commit eb0782bbdfd0d7c4786216659277c3fd585afc0e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9AAM6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current IMA ruleset is identified by the variable "ima_rules" that default to "&ima_default_rules". When loading a custom policy for the first time, the variable is updated to "&ima_policy_rules" instead. That update isn't RCU-safe, and deadlocks are possible. Indeed, some functions like ima_match_policy() may loop indefinitely when traversing "ima_default_rules" with list_for_each_entry_rcu(). When iterating over the default ruleset back to head, if the list head is "ima_default_rules", and "ima_rules" have been updated to "&ima_policy_rules", the loop condition (&entry->list != ima_rules) stays always true, traversing won't terminate, causing a soft lockup and RCU stalls. Introduce a temporary value for "ima_rules" when iterating over the ruleset to avoid the deadlocks. Signed-off-by: liqiong <liqiong(a)nfschina.com> Reviewed-by: THOBY Simon <Simon.THOBY(a)viveris.fr> Fixes: 38d859f991f3 ("IMA: policy can now be updated multiple times") Reported-by: kernel test robot <lkp(a)intel.com> (Fix sparse: incompatible types in comparison expression.) Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Conflicts: security/integrity/ima/ima_policy.c [Context conflicts. Besides an additional pair of rcu_read_lock and unlock has been added to ima_update_policy_flag to mitigate a suspicious RCU usage warning. This pair of RCU lock was added with commit 4f2946aa0c45 ("IMA: introduce a new policy option func=SETXATTR_CHECK") on mainstream.] Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- security/integrity/ima/ima_policy.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 08eae4df759e..b5fabce040d4 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -196,7 +196,7 @@ static struct ima_rule_entry secure_boot_rules[] __ro_after_init = { static LIST_HEAD(ima_default_rules); static LIST_HEAD(ima_policy_rules); static LIST_HEAD(ima_temp_rules); -static struct list_head *ima_rules = &ima_default_rules; +static struct list_head __rcu *ima_rules = (struct list_head __rcu *)(&ima_default_rules); static int ima_policy __initdata; @@ -515,9 +515,11 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, { struct ima_rule_entry *entry; int action = 0, actmask = flags | (flags << 1); + struct list_head *ima_rules_tmp; rcu_read_lock(); - list_for_each_entry_rcu(entry, ima_rules, list) { + ima_rules_tmp = rcu_dereference(ima_rules); + list_for_each_entry_rcu(entry, ima_rules_tmp, list) { if (!(entry->action & actmask)) continue; @@ -560,11 +562,15 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, void ima_update_policy_flag(void) { struct ima_rule_entry *entry; + struct list_head *ima_rules_tmp; - list_for_each_entry(entry, ima_rules, list) { + rcu_read_lock(); + ima_rules_tmp = rcu_dereference(ima_rules); + list_for_each_entry_rcu(entry, ima_rules_tmp, list) { if (entry->action & IMA_DO_MASK) ima_policy_flag |= entry->action; } + rcu_read_unlock(); ima_appraise |= (build_ima_appraise | temp_ima_appraise); if (!ima_appraise) @@ -683,9 +689,9 @@ void ima_update_policy(void) list_splice_tail_init_rcu(&ima_temp_rules, policy, synchronize_rcu); - if (ima_rules != policy) { + if (ima_rules != (struct list_head __rcu *)policy) { ima_policy_flag = 0; - ima_rules = policy; + rcu_assign_pointer(ima_rules, policy); } ima_update_policy_flag(); } @@ -760,7 +766,7 @@ static int ima_lsm_rule_init(struct ima_rule_entry *entry, pr_warn("rule for LSM \'%s\' is undefined\n", (char *)entry->lsm[lsm_rule].args_p); - if (ima_rules == &ima_default_rules) { + if (ima_rules == (struct list_head __rcu *)(&ima_default_rules)) { kfree(entry->lsm[lsm_rule].args_p); entry->lsm[lsm_rule].args_p = NULL; result = -EINVAL; @@ -1188,9 +1194,11 @@ void *ima_policy_start(struct seq_file *m, loff_t *pos) { loff_t l = *pos; struct ima_rule_entry *entry; + struct list_head *ima_rules_tmp; rcu_read_lock(); - list_for_each_entry_rcu(entry, ima_rules, list) { + ima_rules_tmp = rcu_dereference(ima_rules); + list_for_each_entry_rcu(entry, ima_rules_tmp, list) { if (!l--) { rcu_read_unlock(); return entry; @@ -1209,7 +1217,8 @@ void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos) rcu_read_unlock(); (*pos)++; - return (&entry->list == ima_rules) ? NULL : entry; + return (&entry->list == &ima_default_rules || + &entry->list == &ima_policy_rules) ? NULL : entry; } void ima_policy_stop(struct seq_file *m, void *v) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] speakup: Avoid crash on very long word
by Zhang Xiaoxu 08 May '24

08 May '24

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v6.9-rc5 commit c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5L5 CVE: CVE-2024-26994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer. Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Fixes: c6e3fd22cd538 ("Staging: add speakup to the staging directory") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240323164843.1426997-1-samuel.thibault@ens-lyon… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/staging/speakup/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c index 869f40ebf1a7..8dd47a995fd9 100644 --- a/drivers/staging/speakup/main.c +++ b/drivers/staging/speakup/main.c @@ -577,7 +577,7 @@ static u_long get_word(struct vc_data *vc) } attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr); buf[cnt++] = attr_ch; - while (tmpx < vc->vc_cols - 1) { + while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) { tmp_pos += 2; tmpx++; ch = get_char(vc, (u_short *)tmp_pos, &temp); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm: nv04: Fix out of bounds access
by Zhang Changzhong 08 May '24

08 May '24

From: Mikhail Kobuk <m.kobuk(a)ispras.ru> stable inclusion from stable-v4.19.313 commit c2b97f26f081ceec3298151481687071075a25cb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5JU CVE: CVE-2024-27008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ] When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4") Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.") Signed-off-by: Mikhail Kobuk <m.kobuk(a)ispras.ru> Signed-off-by: Danilo Krummrich <dakr(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c index 66bf2aff4a3e..adecda51a306 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c @@ -25,6 +25,7 @@ #include <drm/drmP.h> #include "nouveau_drv.h" +#include "nouveau_bios.h" #include "nouveau_reg.h" #include "dispnv04/hw.h" #include "nouveau_encoder.h" @@ -1674,7 +1675,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf) */ if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) { if (*conn == 0xf2005014 && *conf == 0xffffffff) { - fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1); + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B); return false; } } @@ -1760,26 +1761,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios) #ifdef __powerpc__ /* Apple iMac G4 NV17 */ if (of_machine_is_compatible("PowerMac4,5")) { - fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1); - fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2); + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B); + fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C); return; } #endif /* Make up some sane defaults */ fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, - bios->legacy.i2c_indices.crt, 1, 1); + bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B); if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0) fabricate_dcb_output(dcb, DCB_OUTPUT_TV, bios->legacy.i2c_indices.tv, - all_heads, 0); + all_heads, DCB_OUTPUT_A); else if (bios->tmds.output0_script_ptr || bios->tmds.output1_script_ptr) fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, bios->legacy.i2c_indices.panel, - all_heads, 1); + all_heads, DCB_OUTPUT_B); } static int -- 2.34.1

2 1

[PATCH OLK-5.10] USB: core: Fix deadlock in usb_deauthorize_interface()
by Ye Bin 08 May '24

08 May '24

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.9-rc2 commit 80ba43e9f799cbdd83842fc27db667289b3150f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5GW CVE: CVE-2024-26934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which acquires a device lock on an ancestor device: It calls usb_deauthorize_interface(), which locks the interface's parent USB device. The will lead to deadlock if another process already owns that lock and tries to remove the interface, whether through a configuration change or because the device has been disconnected. As part of the removal procedure, device_del() waits for all ongoing sysfs attribute callbacks to complete. But usb_deauthorize_interface() can't complete until the device lock has been released, and the lock won't be released until the removal has finished. The mechanism provided by sysfs to prevent this kind of deadlock is to use the sysfs_break_active_protection() function, which tells sysfs not to wait for the attribute callback. Reported-and-tested by: Yue Sun <samsun1006219(a)gmail.com> Reported by: xingwei lee <xrivendell7(a)gmail.com> Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/linux-usb/CAEkJfYO6jRVC8Tfrd_R=cjO0hguhrV31fDPrLrNO… Fixes: 310d2b4124c0 ("usb: interface authorization: SysFS part of USB interface authorization") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/1c37eea1-9f56-4534-b9d8-b443438dc869@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/usb/core/sysfs.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/core/sysfs.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c index 8d134193fa0c..4de439f799f4 100644 --- a/drivers/usb/core/sysfs.c +++ b/drivers/usb/core/sysfs.c @@ -1195,14 +1195,24 @@ static ssize_t interface_authorized_store(struct device *dev, { struct usb_interface *intf = to_usb_interface(dev); bool val; + struct kernfs_node *kn; if (strtobool(buf, &val) != 0) return -EINVAL; - if (val) + if (val) { usb_authorize_interface(intf); - else - usb_deauthorize_interface(intf); + } else { + /* + * Prevent deadlock if another process is concurrently + * trying to unregister intf. + */ + kn = sysfs_break_active_protection(&dev->kobj, &attr->attr); + if (kn) { + usb_deauthorize_interface(intf); + sysfs_unbreak_active_protection(kn); + } + } return count; } -- 2.31.1

2 1

[PATCH OLK-5.10] net: enetc: deny offload of tc-based TSN features on VF interfaces
by Ziyang Xuan 08 May '24

08 May '24

From: Vladimir Oltean <vladimir.oltean(a)nxp.com> mainline inclusion from mainline-v6.0-rc7 commit 5641c751fe2f92d3d9e8a8e03c1263ac8caa0b42 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9KHKJ CVE: CVE-2022-48645 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- TSN features on the ENETC (taprio, cbs, gate, police) are configured through a mix of command BD ring messages and port registers: enetc_port_rd(), enetc_port_wr(). Port registers are a region of the ENETC memory map which are only accessible from the PCIe Physical Function. They are not accessible from the Virtual Functions. Moreover, attempting to access these registers crashes the kernel: $ echo 1 > /sys/bus/pci/devices/0000\:00\:00.0/sriov_numvfs pci 0000:00:01.0: [1957:ef00] type 00 class 0x020001 fsl_enetc_vf 0000:00:01.0: Adding to iommu group 15 fsl_enetc_vf 0000:00:01.0: enabling device (0000 -> 0002) fsl_enetc_vf 0000:00:01.0 eno0vf0: renamed from eth0 $ tc qdisc replace dev eno0vf0 root taprio num_tc 8 map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \ sched-entry S 0x7f 900000 sched-entry S 0x80 100000 flags 0x2 Unable to handle kernel paging request at virtual address ffff800009551a08 Internal error: Oops: 96000007 [#1] PREEMPT SMP pc : enetc_setup_tc_taprio+0x170/0x47c lr : enetc_setup_tc_taprio+0x16c/0x47c Call trace: enetc_setup_tc_taprio+0x170/0x47c enetc_setup_tc+0x38/0x2dc taprio_change+0x43c/0x970 taprio_init+0x188/0x1e0 qdisc_create+0x114/0x470 tc_modify_qdisc+0x1fc/0x6c0 rtnetlink_rcv_msg+0x12c/0x390 Split enetc_setup_tc() into separate functions for the PF and for the VF drivers. Also remove enetc_qos.o from being included into enetc-vf.ko, since it serves absolutely no purpose there. Fixes: 34c6adf1977b ("enetc: Configure the Time-Aware Scheduler via tc-taprio offload") Signed-off-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Link: https://lore.kernel.org/r/20220916133209.3351399-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/freescale/enetc/Makefile drivers/net/ethernet/freescale/enetc/enetc.c drivers/net/ethernet/freescale/enetc/enetc.h drivers/net/ethernet/freescale/enetc/enetc_pf.c drivers/net/ethernet/freescale/enetc/enetc_vf.c [The version does not include commit d1b15102dd16 and a76053707dbf.] Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/ethernet/freescale/enetc/Makefile | 1 - drivers/net/ethernet/freescale/enetc/enetc.c | 21 +------------------ drivers/net/ethernet/freescale/enetc/enetc.h | 3 +-- .../net/ethernet/freescale/enetc/enetc_pf.c | 21 ++++++++++++++++++- .../net/ethernet/freescale/enetc/enetc_vf.c | 13 +++++++++++- 5 files changed, 34 insertions(+), 25 deletions(-) diff --git a/drivers/net/ethernet/freescale/enetc/Makefile b/drivers/net/ethernet/freescale/enetc/Makefile index 74f7ac253b8b..5dbb0509e0fb 100644 --- a/drivers/net/ethernet/freescale/enetc/Makefile +++ b/drivers/net/ethernet/freescale/enetc/Makefile @@ -9,7 +9,6 @@ fsl-enetc-$(CONFIG_FSL_ENETC_QOS) += enetc_qos.o obj-$(CONFIG_FSL_ENETC_VF) += fsl-enetc-vf.o fsl-enetc-vf-y := enetc_vf.o $(common-objs) -fsl-enetc-vf-$(CONFIG_FSL_ENETC_QOS) += enetc_qos.o obj-$(CONFIG_FSL_ENETC_MDIO) += fsl-enetc-mdio.o fsl-enetc-mdio-y := enetc_pci_mdio.o enetc_mdio.o diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c index 5f9603d4c049..c526edea914f 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc.c +++ b/drivers/net/ethernet/freescale/enetc/enetc.c @@ -1560,7 +1560,7 @@ int enetc_close(struct net_device *ndev) return 0; } -static int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data) +int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data) { struct enetc_ndev_priv *priv = netdev_priv(ndev); struct tc_mqprio_qopt *mqprio = type_data; @@ -1615,25 +1615,6 @@ static int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data) return 0; } -int enetc_setup_tc(struct net_device *ndev, enum tc_setup_type type, - void *type_data) -{ - switch (type) { - case TC_SETUP_QDISC_MQPRIO: - return enetc_setup_tc_mqprio(ndev, type_data); - case TC_SETUP_QDISC_TAPRIO: - return enetc_setup_tc_taprio(ndev, type_data); - case TC_SETUP_QDISC_CBS: - return enetc_setup_tc_cbs(ndev, type_data); - case TC_SETUP_QDISC_ETF: - return enetc_setup_tc_txtime(ndev, type_data); - case TC_SETUP_BLOCK: - return enetc_setup_tc_psfp(ndev, type_data); - default: - return -EOPNOTSUPP; - } -} - struct net_device_stats *enetc_get_stats(struct net_device *ndev) { struct enetc_ndev_priv *priv = netdev_priv(ndev); diff --git a/drivers/net/ethernet/freescale/enetc/enetc.h b/drivers/net/ethernet/freescale/enetc/enetc.h index 725c3d1cbb19..844d92310bed 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc.h +++ b/drivers/net/ethernet/freescale/enetc/enetc.h @@ -304,8 +304,7 @@ netdev_tx_t enetc_xmit(struct sk_buff *skb, struct net_device *ndev); struct net_device_stats *enetc_get_stats(struct net_device *ndev); void enetc_set_features(struct net_device *ndev, netdev_features_t features); int enetc_ioctl(struct net_device *ndev, struct ifreq *rq, int cmd); -int enetc_setup_tc(struct net_device *ndev, enum tc_setup_type type, - void *type_data); +int enetc_setup_tc_mqprio(struct net_device *ndev, void *type_data); /* ethtool */ void enetc_set_ethtool_ops(struct net_device *ndev); diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c index 515db7e6e649..6d98a41d168e 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c +++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c @@ -696,6 +696,25 @@ static int enetc_pf_set_features(struct net_device *ndev, return 0; } +static int enetc_pf_setup_tc(struct net_device *ndev, enum tc_setup_type type, + void *type_data) +{ + switch (type) { + case TC_SETUP_QDISC_MQPRIO: + return enetc_setup_tc_mqprio(ndev, type_data); + case TC_SETUP_QDISC_TAPRIO: + return enetc_setup_tc_taprio(ndev, type_data); + case TC_SETUP_QDISC_CBS: + return enetc_setup_tc_cbs(ndev, type_data); + case TC_SETUP_QDISC_ETF: + return enetc_setup_tc_txtime(ndev, type_data); + case TC_SETUP_BLOCK: + return enetc_setup_tc_psfp(ndev, type_data); + default: + return -EOPNOTSUPP; + } +} + static const struct net_device_ops enetc_ndev_ops = { .ndo_open = enetc_open, .ndo_stop = enetc_close, @@ -710,7 +729,7 @@ static const struct net_device_ops enetc_ndev_ops = { .ndo_set_vf_spoofchk = enetc_pf_set_vf_spoofchk, .ndo_set_features = enetc_pf_set_features, .ndo_do_ioctl = enetc_ioctl, - .ndo_setup_tc = enetc_setup_tc, + .ndo_setup_tc = enetc_pf_setup_tc, }; static void enetc_pf_netdev_setup(struct enetc_si *si, struct net_device *ndev, diff --git a/drivers/net/ethernet/freescale/enetc/enetc_vf.c b/drivers/net/ethernet/freescale/enetc/enetc_vf.c index 5ce3e2593bdd..75ef92d52e1e 100644 --- a/drivers/net/ethernet/freescale/enetc/enetc_vf.c +++ b/drivers/net/ethernet/freescale/enetc/enetc_vf.c @@ -93,6 +93,17 @@ static int enetc_vf_set_features(struct net_device *ndev, return 0; } +static int enetc_vf_setup_tc(struct net_device *ndev, enum tc_setup_type type, + void *type_data) +{ + switch (type) { + case TC_SETUP_QDISC_MQPRIO: + return enetc_setup_tc_mqprio(ndev, type_data); + default: + return -EOPNOTSUPP; + } +} + /* Probing/ Init */ static const struct net_device_ops enetc_ndev_ops = { .ndo_open = enetc_open, @@ -102,7 +113,7 @@ static const struct net_device_ops enetc_ndev_ops = { .ndo_set_mac_address = enetc_vf_set_mac_addr, .ndo_set_features = enetc_vf_set_features, .ndo_do_ioctl = enetc_ioctl, - .ndo_setup_tc = enetc_setup_tc, + .ndo_setup_tc = enetc_vf_setup_tc, }; static void enetc_vf_netdev_setup(struct enetc_si *si, struct net_device *ndev, -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] bpf: Fix hashtab overflow check on 32-bit arches
by Pu Lehui 08 May '24

08 May '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.214 commit 64f00b4df0597590b199b62a37a165473bf658a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK6X CVE: CVE-2024-26884 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6787d916c2cf9850c97a0a3f73e08c43e7d973b1 ] The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup. Fixes: daaf427c6ab3 ("bpf: fix arraymap NULL deref and missing overflow and zero size checks") Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Message-ID: <20240307120340.99577-3-toke(a)redhat.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/hashtab.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 0ce445aadfdf..d05614a2bdc7 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -443,7 +443,13 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) num_possible_cpus()); } - /* hash table size must be power of 2 */ + /* hash table size must be power of 2; roundup_pow_of_two() can overflow + * into UB on 32-bit arches, so check that first + */ + err = -E2BIG; + if (htab->map.max_entries > 1UL << 31) + goto free_htab; + htab->n_buckets = roundup_pow_of_two(htab->map.max_entries); htab->elem_size = sizeof(struct htab_elem) + @@ -453,10 +459,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr) else htab->elem_size += round_up(htab->map.value_size, 8); - err = -E2BIG; - /* prevent zero size kmalloc and check for u32 overflow */ - if (htab->n_buckets == 0 || - htab->n_buckets > U32_MAX / sizeof(struct bucket)) + /* check for u32 overflow */ + if (htab->n_buckets > U32_MAX / sizeof(struct bucket)) goto free_htab; cost = (u64) htab->n_buckets * sizeof(struct bucket) + -- 2.34.1

2 1

[openeuler:OLK-6.6 1786/7652] kernel/livepatch/core.c:2006:12: warning: no previous prototype for function 'arch_klp_check_breakpoint'
by kernel test robot 08 May '24

08 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: afd82dd979acad2f99b9d30f8ce8463ca4153a05 commit: 470628a716984e1325b92bef4fa2140ff5a062a5 [1786/7652] livepatch: Use breakpoint exception to optimize enabling livepatch config: arm64-randconfig-004-20240508 (https://download.01.org/0day-ci/archive/20240508/202405080901.aTVbuOkv-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 0ab4458df0688955620b72cc2c72a32dffad3615) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240508/202405080901.aTVbuOkv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405080901.aTVbuOkv-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/livepatch/core.c:17: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ kernel/livepatch/core.c:1728:12: warning: no previous prototype for function 'arch_klp_check_activeness_func' [-Wmissing-prototypes] 1728 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^ kernel/livepatch/core.c:1728:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1728 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^ | static kernel/livepatch/core.c:1983:14: warning: no previous prototype for function 'arch_klp_mem_alloc' [-Wmissing-prototypes] 1983 | void __weak *arch_klp_mem_alloc(size_t size) | ^ kernel/livepatch/core.c:1983:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1983 | void __weak *arch_klp_mem_alloc(size_t size) | ^ | static kernel/livepatch/core.c:1988:13: warning: no previous prototype for function 'arch_klp_mem_free' [-Wmissing-prototypes] 1988 | void __weak arch_klp_mem_free(void *mem) | ^ kernel/livepatch/core.c:1988:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1988 | void __weak arch_klp_mem_free(void *mem) | ^ | static kernel/livepatch/core.c:1993:13: warning: no previous prototype for function 'arch_klp_code_modify_prepare' [-Wmissing-prototypes] 1993 | void __weak arch_klp_code_modify_prepare(void) | ^ kernel/livepatch/core.c:1993:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1993 | void __weak arch_klp_code_modify_prepare(void) | ^ | static kernel/livepatch/core.c:1997:13: warning: no previous prototype for function 'arch_klp_code_modify_post_process' [-Wmissing-prototypes] 1997 | void __weak arch_klp_code_modify_post_process(void) | ^ kernel/livepatch/core.c:1997:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1997 | void __weak arch_klp_code_modify_post_process(void) | ^ | static >> kernel/livepatch/core.c:2006:12: warning: no previous prototype for function 'arch_klp_check_breakpoint' [-Wmissing-prototypes] 2006 | int __weak arch_klp_check_breakpoint(struct arch_klp_data *arch_data, void *old_func) | ^ kernel/livepatch/core.c:2006:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2006 | int __weak arch_klp_check_breakpoint(struct arch_klp_data *arch_data, void *old_func) | ^ | static kernel/livepatch/core.c:2011:12: warning: no previous prototype for function 'arch_klp_add_breakpoint' [-Wmissing-prototypes] 2011 | int __weak arch_klp_add_breakpoint(struct arch_klp_data *arch_data, void *old_func) | ^ kernel/livepatch/core.c:2011:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2011 | int __weak arch_klp_add_breakpoint(struct arch_klp_data *arch_data, void *old_func) | ^ | static kernel/livepatch/core.c:2016:13: warning: no previous prototype for function 'arch_klp_remove_breakpoint' [-Wmissing-prototypes] 2016 | void __weak arch_klp_remove_breakpoint(struct arch_klp_data *arch_data, void *old_func) | ^ kernel/livepatch/core.c:2016:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2016 | void __weak arch_klp_remove_breakpoint(struct arch_klp_data *arch_data, void *old_func) | ^ | static kernel/livepatch/core.c:2020:13: warning: no previous prototype for function 'arch_klp_set_brk_func' [-Wmissing-prototypes] 2020 | void __weak arch_klp_set_brk_func(struct klp_func_node *func_node, void *new_func) | ^ kernel/livepatch/core.c:2020:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2020 | void __weak arch_klp_set_brk_func(struct klp_func_node *func_node, void *new_func) | ^ | static 13 warnings generated. vim +/arch_klp_check_breakpoint +2006 kernel/livepatch/core.c 2005 > 2006 int __weak arch_klp_check_breakpoint(struct arch_klp_data *arch_data, void *old_func) 2007 { 2008 return 0; 2009 } 2010 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0