- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-v5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: 189657 CVE: CVE-2021-46952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- fs/nfs/fs_context.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c index 29ec8b09a52d..05b39e8f97b9 100644 --- a/fs/nfs/fs_context.c +++ b/fs/nfs/fs_context.c @@ -937,6 +937,15 @@ static int nfs23_parse_monolithic(struct fs_context *fc, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_fs_context, which nfs_fill_super * can deal with. @@ -1037,6 +1046,9 @@ static int nfs23_parse_monolithic(struct fs_context *fc, out_invalid_fh: return nfs_invalf(fc, "NFS: invalid root filehandle"); + +out_invalid_data: + return nfs_invalf(fc, "NFS: invalid binary mount data"); } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

1 0

[PATCH OLK-6.6] modpost: Optimize symbol search from linear to binary search
by Hongchen Zhang 11 Mar '24

11 Mar '24

From: Jack Brennen <jbrennen(a)google.com> mainline inclusion from mainline-v6.7-rc1 commit 4074532758c5c367d3fcb8d124150824a254659d category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I97HOU CVE: NA -------------------------------- Modify modpost to use binary search for converting addresses back into symbol references. Previously it used linear search. This change saves a few seconds of wall time for defconfig builds, but can save several minutes on allyesconfigs. Before: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 198.38user 1.27system 3:19.71elapsed After: $ make LLVM=1 -j128 allyesconfig vmlinux -s KCFLAGS="-Wno-error" $ time scripts/mod/modpost -M -m -a -N -o vmlinux.symvers vmlinux.o 11.91user 0.85system 0:12.78elapsed Signed-off-by: Jack Brennen <jbrennen(a)google.com> Tested-by: Nick Desaulniers <ndesaulniers(a)google.com> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> --- scripts/mod/Makefile | 4 +- scripts/mod/modpost.c | 70 ++------------ scripts/mod/modpost.h | 25 +++++ scripts/mod/symsearch.c | 199 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 232 insertions(+), 66 deletions(-) create mode 100644 scripts/mod/symsearch.c diff --git a/scripts/mod/Makefile b/scripts/mod/Makefile index c9e38ad937fd..3c54125eb373 100644 --- a/scripts/mod/Makefile +++ b/scripts/mod/Makefile @@ -5,7 +5,7 @@ CFLAGS_REMOVE_empty.o += $(CC_FLAGS_LTO) hostprogs-always-y += modpost mk_elfconfig always-y += empty.o -modpost-objs := modpost.o file2alias.o sumversion.o +modpost-objs := modpost.o file2alias.o sumversion.o symsearch.o devicetable-offsets-file := devicetable-offsets.h @@ -16,7 +16,7 @@ targets += $(devicetable-offsets-file) devicetable-offsets.s # dependencies on generated files need to be listed explicitly -$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o: $(obj)/elfconfig.h +$(obj)/modpost.o $(obj)/file2alias.o $(obj)/sumversion.o $(obj)/symsearch.o: $(obj)/elfconfig.h $(obj)/file2alias.o: $(obj)/$(devicetable-offsets-file) quiet_cmd_elfconfig = MKELF $@ diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index ac4ef3e206bb..e6c8b096362e 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -22,7 +22,6 @@ #include <errno.h> #include "modpost.h" #include "../../include/linux/license.h" -#include "../../include/linux/module_symbol.h" static bool module_enabled; /* Are we using CONFIG_MODVERSIONS? */ @@ -577,11 +576,14 @@ static int parse_elf(struct elf_info *info, const char *filename) *p = TO_NATIVE(*p); } + symsearch_init(info); + return 1; } static void parse_elf_finish(struct elf_info *info) { + symsearch_finish(info); release_file(info->hdr, info->size); } @@ -1050,71 +1052,10 @@ static int secref_whitelist(const char *fromsec, const char *fromsym, return 1; } -/* - * If there's no name there, ignore it; likewise, ignore it if it's - * one of the magic symbols emitted used by current tools. - * - * Otherwise if find_symbols_between() returns those symbols, they'll - * fail the whitelist tests and cause lots of false alarms ... fixable - * only by merging __exit and __init sections into __text, bloating - * the kernel (which is especially evil on embedded platforms). - */ -static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) -{ - const char *name = elf->strtab + sym->st_name; - - if (!name || !strlen(name)) - return 0; - return !is_mapping_symbol(name); -} - -/* Look up the nearest symbol based on the section and the address */ -static Elf_Sym *find_nearest_sym(struct elf_info *elf, Elf_Addr addr, - unsigned int secndx, bool allow_negative, - Elf_Addr min_distance) -{ - Elf_Sym *sym; - Elf_Sym *near = NULL; - Elf_Addr sym_addr, distance; - bool is_arm = (elf->hdr->e_machine == EM_ARM); - - for (sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { - if (get_secindex(elf, sym) != secndx) - continue; - if (!is_valid_name(elf, sym)) - continue; - - sym_addr = sym->st_value; - - /* - * For ARM Thumb instruction, the bit 0 of st_value is set - * if the symbol is STT_FUNC type. Mask it to get the address. - */ - if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) - sym_addr &= ~1; - - if (addr >= sym_addr) - distance = addr - sym_addr; - else if (allow_negative) - distance = sym_addr - addr; - else - continue; - - if (distance <= min_distance) { - min_distance = distance; - near = sym; - } - - if (min_distance == 0) - break; - } - return near; -} - static Elf_Sym *find_fromsym(struct elf_info *elf, Elf_Addr addr, unsigned int secndx) { - return find_nearest_sym(elf, addr, secndx, false, ~0); + return symsearch_find_nearest(elf, addr, secndx, false, ~0); } static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) @@ -1127,7 +1068,8 @@ static Elf_Sym *find_tosym(struct elf_info *elf, Elf_Addr addr, Elf_Sym *sym) * Strive to find a better symbol name, but the resulting name may not * match the symbol referenced in the original code. */ - return find_nearest_sym(elf, addr, get_secindex(elf, sym), true, 20); + return symsearch_find_nearest(elf, addr, get_secindex(elf, sym), + true, 20); } static bool is_executable_section(struct elf_info *elf, unsigned int secndx) diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h index 5f94c2c9f2d9..6413f26fcb6b 100644 --- a/scripts/mod/modpost.h +++ b/scripts/mod/modpost.h @@ -10,6 +10,7 @@ #include <fcntl.h> #include <unistd.h> #include <elf.h> +#include "../../include/linux/module_symbol.h" #include "list.h" #include "elfconfig.h" @@ -128,6 +129,8 @@ struct elf_info { * take shndx from symtab_shndx_start[N] instead */ Elf32_Word *symtab_shndx_start; Elf32_Word *symtab_shndx_stop; + + struct symsearch *symsearch; }; /* Accessor for sym->st_shndx, hides ugliness of "64k sections" */ @@ -154,6 +157,28 @@ static inline unsigned int get_secindex(const struct elf_info *info, return index; } +/* + * If there's no name there, ignore it; likewise, ignore it if it's + * one of the magic symbols emitted used by current tools. + * + * Internal symbols created by tools should be ignored by modpost. + */ +static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) +{ + const char *name = elf->strtab + sym->st_name; + + if (!name || !strlen(name)) + return 0; + return !is_mapping_symbol(name); +} + +/* symsearch.c */ +void symsearch_init(struct elf_info *elf); +void symsearch_finish(struct elf_info *elf); +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance); + /* file2alias.c */ void handle_moddevtable(struct module *mod, struct elf_info *info, Elf_Sym *sym, const char *symname); diff --git a/scripts/mod/symsearch.c b/scripts/mod/symsearch.c new file mode 100644 index 000000000000..aa4ed51f9960 --- /dev/null +++ b/scripts/mod/symsearch.c @@ -0,0 +1,199 @@ +// SPDX-License-Identifier: GPL-2.0 + +/* + * Helper functions for finding the symbol in an ELF which is "nearest" + * to a given address. + */ + +#include "modpost.h" + +struct syminfo { + unsigned int symbol_index; + unsigned int section_index; + Elf_Addr addr; +}; + +/* + * Container used to hold an entire binary search table. + * Entries in table are ascending, sorted first by section_index, + * then by addr, and last by symbol_index. The sorting by + * symbol_index is used to ensure predictable behavior when + * multiple symbols are present with the same address; all + * symbols past the first are effectively ignored, by eliding + * them in symsearch_fixup(). + */ +struct symsearch { + unsigned int table_size; + struct syminfo table[]; +}; + +static int syminfo_compare(const void *s1, const void *s2) +{ + const struct syminfo *sym1 = s1; + const struct syminfo *sym2 = s2; + + if (sym1->section_index > sym2->section_index) + return 1; + if (sym1->section_index < sym2->section_index) + return -1; + if (sym1->addr > sym2->addr) + return 1; + if (sym1->addr < sym2->addr) + return -1; + if (sym1->symbol_index > sym2->symbol_index) + return 1; + if (sym1->symbol_index < sym2->symbol_index) + return -1; + return 0; +} + +static unsigned int symbol_count(struct elf_info *elf) +{ + unsigned int result = 0; + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) + result++; + } + return result; +} + +/* + * Populate the search array that we just allocated. + * Be slightly paranoid here. The ELF file is mmap'd and could + * conceivably change between symbol_count() and symsearch_populate(). + * If we notice any difference, bail out rather than potentially + * propagating errors or crashing. + */ +static void symsearch_populate(struct elf_info *elf, + struct syminfo *table, + unsigned int table_size) +{ + bool is_arm = (elf->hdr->e_machine == EM_ARM); + + for (Elf_Sym *sym = elf->symtab_start; sym < elf->symtab_stop; sym++) { + if (is_valid_name(elf, sym)) { + if (table_size-- == 0) + fatal("%s: size mismatch\n", __func__); + table->symbol_index = sym - elf->symtab_start; + table->section_index = get_secindex(elf, sym); + table->addr = sym->st_value; + + /* + * For ARM Thumb instruction, the bit 0 of st_value is + * set if the symbol is STT_FUNC type. Mask it to get + * the address. + */ + if (is_arm && ELF_ST_TYPE(sym->st_info) == STT_FUNC) + table->addr &= ~1; + + table++; + } + } + + if (table_size != 0) + fatal("%s: size mismatch\n", __func__); +} + +/* + * Do any fixups on the table after sorting. + * For now, this just finds adjacent entries which have + * the same section_index and addr, and it propagates + * the first symbol_index over the subsequent entries, + * so that only one symbol_index is seen for any given + * section_index and addr. This ensures that whether + * we're looking at an address from "above" or "below" + * that we see the same symbol_index. + * This does leave some duplicate entries in the table; + * in practice, these are a small fraction of the + * total number of entries, and they are harmless to + * the binary search algorithm other than a few occasional + * unnecessary comparisons. + */ +static void symsearch_fixup(struct syminfo *table, unsigned int table_size) +{ + /* Don't look at index 0, it will never change. */ + for (unsigned int i = 1; i < table_size; i++) { + if (table[i].addr == table[i - 1].addr && + table[i].section_index == table[i - 1].section_index) { + table[i].symbol_index = table[i - 1].symbol_index; + } + } +} + +void symsearch_init(struct elf_info *elf) +{ + unsigned int table_size = symbol_count(elf); + + elf->symsearch = NOFAIL(malloc(sizeof(struct symsearch) + + sizeof(struct syminfo) * table_size)); + elf->symsearch->table_size = table_size; + + symsearch_populate(elf, elf->symsearch->table, table_size); + qsort(elf->symsearch->table, table_size, + sizeof(struct syminfo), syminfo_compare); + + symsearch_fixup(elf->symsearch->table, table_size); +} + +void symsearch_finish(struct elf_info *elf) +{ + free(elf->symsearch); + elf->symsearch = NULL; +} + +/* + * Find the syminfo which is in secndx and "nearest" to addr. + * allow_negative: allow returning a symbol whose address is > addr. + * min_distance: ignore symbols which are further away than this. + * + * Returns a pointer into the symbol table for success. + * Returns NULL if no legal symbol is found within the requested range. + */ +Elf_Sym *symsearch_find_nearest(struct elf_info *elf, Elf_Addr addr, + unsigned int secndx, bool allow_negative, + Elf_Addr min_distance) +{ + unsigned int hi = elf->symsearch->table_size; + unsigned int lo = 0; + struct syminfo *table = elf->symsearch->table; + struct syminfo target; + + target.addr = addr; + target.section_index = secndx; + target.symbol_index = ~0; /* compares greater than any actual index */ + while (hi > lo) { + unsigned int mid = lo + (hi - lo) / 2; /* Avoids overflow */ + + if (syminfo_compare(&table[mid], &target) > 0) + hi = mid; + else + lo = mid + 1; + } + + /* + * table[hi], if it exists, is the first entry in the array which + * lies beyond target. table[hi - 1], if it exists, is the last + * entry in the array which comes before target, including the + * case where it perfectly matches the section and the address. + * + * Note -- if the address we're looking up falls perfectly + * in the middle of two symbols, this is written to always + * prefer the symbol with the lower address. + */ + Elf_Sym *result = NULL; + + if (allow_negative && + hi < elf->symsearch->table_size && + table[hi].section_index == secndx && + table[hi].addr - addr <= min_distance) { + min_distance = table[hi].addr - addr; + result = &elf->symtab_start[table[hi].symbol_index]; + } + if (hi > 0 && + table[hi - 1].section_index == secndx && + addr - table[hi - 1].addr <= min_distance) { + result = &elf->symtab_start[table[hi - 1].symbol_index]; + } + return result; +} -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds
by ZhaoLong Wang 11 Mar '24

11 Mar '24

From: Randy Dunlap <rdunlap(a)infradead.org> stable inclusion from stable-5.10.36 commit 96fa26b74cdcf9f5c98996bf36bec9fb5b19ffe2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/I949C5 CVE: CVE-2021-46952 -------------------------------- commit c09f11ef35955785f92369e25819bf0629df2e59 upstream. Fix shift out-of-bounds in xprt_calc_majortimeo(). This is caused by a garbage timeout (retrans) mount option being passed to nfs mount, in this case from syzkaller. If the protocol is XPRT_TRANSPORT_UDP, then 'retrans' is a shift value for a 64-bit long integer, so 'retrans' cannot be >= 64. If it is >= 64, fail the mount and return an error. Fixes: 9954bf92c0cd ("NFS: Move mount parameterisation bits into their own file") Reported-by: syzbot+ba2e91df8f74809417fa(a)syzkaller.appspotmail.com Reported-by: syzbot+f3a0fa110fd630ab56c8(a)syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap(a)infradead.org> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Anna Schumaker <anna.schumaker(a)netapp.com> Cc: linux-nfs(a)vger.kernel.org Cc: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfs/fs_context.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nfs/super.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/nfs/super.c b/fs/nfs/super.c index a05e1eb2c3fd..15f4e6d34fdd 100644 --- a/fs/nfs/super.c +++ b/fs/nfs/super.c @@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options, memset(mntfh->data + mntfh->size, 0, sizeof(mntfh->data) - mntfh->size); + /* + * for proto == XPRT_TRANSPORT_UDP, which is what uses + * to_exponential, implying shift: limit the shift value + * to BITS_PER_LONG (majortimeo is unsigned long) + */ + if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */ + if (data->retrans >= 64) /* shift value is too large */ + goto out_invalid_data; + /* * Translate to nfs_parsed_mount_data, which nfs_fill_super * can deal with. @@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options, out_invalid_fh: dfprintk(MOUNT, "NFS: invalid root filehandle\n"); return -EINVAL; + +out_invalid_data: + dfprintk(MOUNT, "NFS: invalid binary mount data\n"); + return -EINVAL; } #if IS_ENABLED(CONFIG_NFS_V4) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46926
by Liu Mingrui 11 Mar '24

11 Mar '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller Pierre-Louis Bossart (1): soundwire: intel: filter SoundWire controller device search drivers/soundwire/intel_init.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/19] net: hns3: provides some customized interfaces for storage devices
by Jijie Shao 11 Mar '24

11 Mar '24

From: Jiantao Xiao <xiaojiantao1(a)h-partners.com> Hao Chen (2): net: hns3: add support to get/set 1d torus param net: hns3: add support modified tx timeout Jian Shen (2): net: hns3: add extend interface support for read and write phy register net: hns3: add input parameters checking Jie Wang (1): net: hns3: add support PF provides customized interfaces to detect port faults. shaojijie (13): net: hns3: add support customized exception handling interfaces. net: hns3: add supports pfc storm detection and suppression net: hns3: add supports fast reporting of faulty nodes net: hns3: add support clear mac statistics net: hns3: add support configuring function-level interrupt affinity net: hns3: add support query port ext information net: hns3: add support query the presence of optical module net: hns3: add supports configure optical module enable net: hns3: add support config and query serdes lane status net: hns3: add support disable nic clock net: hns3: support set pfc pause trans time net: hns3: add support detect port wire type net: hns3: add support set led wangpeiyang (1): net: hns3: add support set mac state drivers/net/ethernet/hisilicon/hns3/Makefile | 3 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 7 + .../net/ethernet/hisilicon/hns3/hnae3_ext.h | 121 ++ .../hns3/hns3_common/hclge_comm_cmd.c | 1 + .../hns3/hns3_common/hclge_comm_cmd.h | 1 + .../net/ethernet/hisilicon/hns3/hns3_enet.c | 7 +- .../net/ethernet/hisilicon/hns3/hns3_ext.c | 543 ++++++ .../net/ethernet/hisilicon/hns3/hns3_ext.h | 67 + .../hisilicon/hns3/hns3pf/hclge_cmd.h | 14 +- .../hisilicon/hns3/hns3pf/hclge_ext.c | 1490 +++++++++++++++++ .../hisilicon/hns3/hns3pf/hclge_ext.h | 180 ++ .../hisilicon/hns3/hns3pf/hclge_main.c | 58 +- .../hisilicon/hns3/hns3pf/hclge_main.h | 12 +- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 7 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 2 + 16 files changed, 2488 insertions(+), 27 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hnae3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_ext.h create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.c create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ext.h -- 2.30.0

2 20

[PATCH openEuler-1.0-LTS] crypto: scomp - fix req->dst buffer overflow
by GUO Zihua 11 Mar '24

11 Mar '24

From: Chengming Zhou <zhouchengming(a)bytedance.com> stable inclusion from stable-v4.19.306 commit 1142d65c5b881590962ad763f94505b6dd67d2fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I970CO CVE: NA Reference: https://github.com/gregkh/linux/commit/1142d65c5b881590962ad763f94505b6dd67… -------------------------------- [ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ] The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem. Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface") Reported-by: syzbot+3eff5e51bf1db122a16e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/ Signed-off-by: Chengming Zhou <zhouchengming(a)bytedance.com> Reviewed-by: Barry Song <v-songbaohua(a)oppo.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: crypto/scompress.c Signed-off-by: GUO Zihua <guozihua(a)huawei.com> --- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/scompress.c b/crypto/scompress.c index 15641c96ff99..5f3fb6cbf531 100644 --- a/crypto/scompress.c +++ b/crypto/scompress.c @@ -149,6 +149,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) const int cpu = get_cpu(); u8 *scratch_src = *per_cpu_ptr(scomp_src_scratches, cpu); u8 *scratch_dst = *per_cpu_ptr(scomp_dst_scratches, cpu); + unsigned int dlen; int ret; if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE) { @@ -164,6 +165,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE) req->dlen = SCOMP_SCRATCH_SIZE; + dlen = req->dlen; + scatterwalk_map_and_copy(scratch_src, req->src, 0, req->slen, 0); if (dir) ret = crypto_scomp_compress(scomp, scratch_src, req->slen, @@ -178,6 +181,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM; goto out; } + } else if (req->dlen > dlen) { + ret = -ENOSPC; + goto out; } scatterwalk_map_and_copy(scratch_dst, req->dst, 0, req->dlen, 1); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 13375/21829] include/linux/uaccess.h:112:17: warning: 'kbrep' may be used uninitialized
by kernel test robot 11 Mar '24

11 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bf1b7dd5d431b4248d92755c06e76094bbe2b7b4 commit: c20f651cb5a90254b561f218b967e04ff626853e [13375/21829] vt: vt_ioctl: remove unnecessary console allocation checks config: arm64-randconfig-003-20240308 (https://download.01.org/0day-ci/archive/20240311/202403110630.3gj4ph83-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240311/202403110630.3gj4ph83-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403110630.3gj4ph83-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/termios.h:6, from ./arch/arm64/include/generated/uapi/asm/termios.h:1, from include/uapi/linux/termios.h:6, from include/linux/tty.h:7, from drivers/tty/vt/vt_ioctl.c:15: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_event_wait_ioctl' at drivers/tty/vt/vt_ioctl.c:187:6: include/linux/uaccess.h:112:17: warning: 'vw' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/kernel.h:10, from include/linux/list.h:9, from include/linux/rculist.h:10, from include/linux/sched/signal.h:6, from drivers/tty/vt/vt_ioctl.c:14: include/linux/kasan-checks.h: In function 'vt_event_wait_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:185:30: note: 'vw' declared here 185 | struct vt_event_wait vw; | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:450:7: >> include/linux/uaccess.h:112:17: warning: 'kbrep' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:445:35: note: 'kbrep' declared here 445 | struct kbd_repeat kbrep; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:605:7: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:601:32: note: 'tmp' declared here 601 | struct vt_mode tmp; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:703:7: >> include/linux/uaccess.h:112:17: warning: 'vsa' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:698:39: note: 'vsa' declared here 698 | struct vt_setactivate vsa; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:859:7: include/linux/uaccess.h:112:17: warning: 'v' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:856:35: note: 'v' declared here 856 | struct vt_consize v; | ^ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_fontx_ioctl' at drivers/tty/vt/vt_ioctl.c:246:6, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:936:9: include/linux/uaccess.h:112:17: warning: 'cfdarg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:243:32: note: 'cfdarg' declared here 243 | struct consolefontdesc cfdarg; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:965:7: include/linux/uaccess.h:112:17: warning: 'op' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:352:32: note: 'op' declared here 352 | struct console_font_op op; /* used in multiple places here */ | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_unimap_ioctl' at drivers/tty/vt/vt_ioctl.c:285:6, inlined from 'vt_ioctl' at drivers/tty/vt/vt_ioctl.c:1009:9: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:283:27: note: 'tmp' declared here 283 | struct unimapdesc tmp; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_fontx_ioctl' at drivers/tty/vt/vt_ioctl.c:1090:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1202:9: include/linux/uaccess.h:112:17: warning: 'cfdarg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:1087:39: note: 'cfdarg' declared here 1087 | struct compat_consolefontdesc cfdarg; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_kdfontop_ioctl' at drivers/tty/vt/vt_ioctl.c:1137:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1206:9: include/linux/uaccess.h:112:17: warning: 'op' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/tty/vt/vt_ioctl.c:1183:32: note: 'op' declared here 1183 | struct console_font_op op; /* used in multiple places here */ | ^~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_unimap_ioctl' at drivers/tty/vt/vt_ioctl.c:1163:6, inlined from 'vt_compat_ioctl' at drivers/tty/vt/vt_ioctl.c:1211:9: include/linux/uaccess.h:112:17: warning: 'tmp' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vt_compat_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here vim +/kbrep +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] fix CVE-2023-52527
by Zhengchao Shao 10 Mar '24

10 Mar '24

fix CVE-2023-52527. David Howells (1): ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Tom Parkin (1): l2tp: pass correct message length to ip6_append_data net/l2tp/l2tp_ip6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
by Zhengchao Shao 10 Mar '24

10 Mar '24

From: David Howells <dhowells(a)redhat.com> stable inclusion from stable-v5.10.198 commit 96b2e1090397217839fcd6c9b6d8f5d439e705ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2G CVE: CVE-2023-52527 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9d4c75800f61e5d75c1659ba201b6c0c7ead3070 ] Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) when appending to an IPv4 or IPv6 packet as we don't want to repeat the transport header or account for it twice. This can happen under some circumstances, such as splicing into an L2TP socket. The symptom observed is a warning in __ip6_append_data(): WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800 that occurs when MSG_SPLICE_PAGES is used to append more data to an already partially occupied skbuff. The warning occurs when 'copy' is larger than the amount of data in the message iterator. This is because the requested length includes the transport header length when it shouldn't. This can be triggered by, for example: sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP); bind(sfd, ...); // ::1 connect(sfd, ...); // ::1 port 7 send(sfd, buffer, 4100, MSG_MORE); sendfile(sfd, dfd, NULL, 1024); Fix this by only adding transhdrlen into the length if the write queue is empty in l2tp_ip6_sendmsg(), analogously to how UDP does things. l2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds the UDP packet itself. Fixes: a32e0eec7042 ("l2tp: introduce L2TPv3 IP encapsulation support for IPv6") Reported-by: syzbot+62cbf263225ae13ff153(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/0000000000001c12b30605378ce8@google.com/ Suggested-by: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> Signed-off-by: David Howells <dhowells(a)redhat.com> cc: Eric Dumazet <edumazet(a)google.com> cc: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> cc: "David S. Miller" <davem(a)davemloft.net> cc: David Ahern <dsahern(a)kernel.org> cc: Paolo Abeni <pabeni(a)redhat.com> cc: Jakub Kicinski <kuba(a)kernel.org> cc: netdev(a)vger.kernel.org cc: bpf(a)vger.kernel.org cc: syzkaller-bugs(a)googlegroups.com Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/l2tp/l2tp_ip6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c index 382124d6f764..9746c624a550 100644 --- a/net/l2tp/l2tp_ip6.c +++ b/net/l2tp/l2tp_ip6.c @@ -508,7 +508,6 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) */ if (len > INT_MAX - transhdrlen) return -EMSGSIZE; - ulen = len + transhdrlen; /* Mirror BSD error message compatibility */ if (msg->msg_flags & MSG_OOB) @@ -629,6 +628,7 @@ static int l2tp_ip6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) back_from_confirm: lock_sock(sk); + ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; err = ip6_append_data(sk, ip_generic_getfrag, msg, ulen, transhdrlen, &ipc6, &fl6, (struct rt6_info *)dst, -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION bf1b7dd5d431b4248d92755c06e76094bbe2b7b4
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bf1b7dd5d431b4248d92755c06e76094bbe2b7b4 !5092 wifi: mac80211: fix potential key use-after-free Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- x86_64-buildonly-randconfig-005-20240309 |-- drivers-char-hw_random-zhaoxin-rng.o:warning:objtool:missing-symbol-for-section-.init.text `-- net-can-j1939-main.o:warning:objtool:missing-symbol-for-section-.init.text clang_recent_errors `-- x86_64-buildonly-randconfig-003-20240309 `-- drivers-scsi-scsi_logging.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 730m configs tested: 35 configs skipped: 150 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 gcc arm64 randconfig-003-20240309 gcc arm64 randconfig-004-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 2915e2435fc93e9142e018ee932a37d762aa5d2d
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2915e2435fc93e9142e018ee932a37d762aa5d2d !5063 dccp: fix dccp_v4_err()/dccp_v6_err() again Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 725m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 clang arm64 randconfig-003-20240309 clang arm64 randconfig-004-20240309 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION d34411e46747fbc3ea6a9f6d8a299c46fd6334b0
by kernel test robot 10 Mar '24

10 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: d34411e46747fbc3ea6a9f6d8a299c46fd6334b0 !5059 dm: limit the number of targets and parameter size area Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- loongarch-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- x86_64-buildonly-randconfig-004-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-buildonly-randconfig-005-20240309 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-002-20240309 | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-003-20240309 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-is-invalid-in-C99-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-is-invalid-in-C99-Werror-Wimplicit-function-declaration |-- arm64-randconfig-004-20240309 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- x86_64-allyesconfig |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true elapsed time: 721m configs tested: 40 configs skipped: 128 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 clang arm64 randconfig-003-20240309 clang arm64 randconfig-004-20240309 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240309 gcc loongarch randconfig-002-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240309 clang x86_64 buildonly-randconfig-002-20240309 gcc x86_64 buildonly-randconfig-003-20240309 clang x86_64 buildonly-randconfig-004-20240309 gcc x86_64 buildonly-randconfig-005-20240309 gcc x86_64 buildonly-randconfig-006-20240309 clang x86_64 defconfig gcc x86_64 randconfig-001-20240309 gcc x86_64 randconfig-002-20240309 clang x86_64 randconfig-003-20240309 clang x86_64 randconfig-004-20240309 gcc x86_64 randconfig-005-20240309 clang x86_64 randconfig-006-20240309 gcc x86_64 randconfig-011-20240309 clang x86_64 randconfig-012-20240309 clang x86_64 randconfig-013-20240309 clang x86_64 randconfig-014-20240309 gcc x86_64 randconfig-015-20240309 gcc x86_64 randconfig-016-20240309 gcc x86_64 randconfig-071-20240309 gcc x86_64 randconfig-072-20240309 gcc x86_64 randconfig-073-20240309 gcc x86_64 randconfig-074-20240309 gcc x86_64 randconfig-075-20240309 gcc x86_64 randconfig-076-20240309 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 38 ++++++++++++++++++++++++++++++++++++++ include/net/dst.h | 5 ++--- net/bridge/br_forward.c | 4 ++-- net/bridge/br_input.c | 4 ++-- net/core/dev.c | 14 +++----------- 5 files changed, 47 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP2 0/6] CVE-2024-26586
by Liu Jian 09 Mar '24

09 Mar '24

CVE-2024-26586 sync from PR4690 Amit Cohen (1): mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Christophe JAILLET (1): mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable Ido Schimmel (4): mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() mlxsw: spectrum_acl_tcam: Make fini symmetric to init mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations mlxsw: spectrum_acl_tcam: Fix stack corruption .../mellanox/mlxsw/spectrum_acl_atcam.c | 8 +- .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +- .../mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++++++--------- .../ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +- .../mellanox/mlxsw/spectrum_switchdev.c | 11 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++++++++- 6 files changed, 187 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-22.03-LTS-SP2] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 92a7628560cc..a6697954fd68 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 4409f56fc37e..488893962708 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 196285b0fe46..cb50b1c91aa6 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index b137006f0fd2..d209f989bb70 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -728,7 +731,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -882,7 +886,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -981,6 +985,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1171,7 +1178,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1192,7 +1200,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1373,7 +1381,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1390,7 +1399,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1512,13 +1521,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1548,7 +1559,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1566,7 +1578,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 196285b0fe46..cb50b1c91aa6 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1765,6 +1765,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 503a0056b60f..e1e21bbb07eb 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -732,7 +735,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -886,7 +890,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -985,6 +989,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1175,7 +1182,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1196,7 +1204,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1377,7 +1385,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1394,7 +1403,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1516,13 +1525,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1552,7 +1563,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1570,7 +1582,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() Zhengchao Shao (1): net: fix kabi check warning include/linux/netdevice.h | 81 ++++++++++++++++++++++++++++----------- include/net/dst.h | 5 +-- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/dev.c | 14 ++----- 5 files changed, 67 insertions(+), 41 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 92a7628560cc..a6697954fd68 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1768,6 +1768,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index 4409f56fc37e..488893962708 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -47,6 +47,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -99,7 +101,8 @@ static void _cifs_mid_q_entry_release(struct kref *refcount) struct TCP_Server_Info *server = midEntry->server; if (midEntry->resp_buf && (midEntry->mid_flags & MID_WAIT_CANCELLED) && - midEntry->mid_state == MID_RESPONSE_RECEIVED && + (midEntry->mid_state == MID_RESPONSE_RECEIVED || + midEntry->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid(midEntry, server); @@ -733,7 +736,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance; add_credits(server, &credits, mid->optype); + + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } static void @@ -1172,7 +1179,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, send_cancel(server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; @@ -1193,7 +1201,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1372,7 +1380,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1389,7 +1398,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_server_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1509,13 +1518,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) { @@ -1545,7 +1556,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1563,7 +1575,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_tcon_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix UAF in cifs_demultiplex_thread()
by ZhaoLong Wang 09 Mar '24

09 Mar '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.6-rc3 commit d527f51331cace562393a8038d870b3e9916686f category: bugfix bugzilla: 189615 CVE: CVE-2023-52572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The UAF is because: mount(pid: 921) | cifsd(pid: 923) -------------------------------|------------------------------- | cifs_demultiplex_thread SMB2_negotiate | cifs_send_recv | compound_send_recv | smb_send_rqst | wait_for_response | wait_event_state [1] | | standard_receive3 | cifs_handle_standard | handle_mid | mid->resp_buf = buf; [2] | dequeue_mid [3] KILL the process [4] | resp_iov[i].iov_base = buf | free_rsp_buf [5] | | is_network_name_deleted [6] | callback 1. After send request to server, wait the response until mid->mid_state != SUBMITTED; 2. Receive response from server, and set it to mid; 3. Set the mid state to RECEIVED; 4. Kill the process, the mid state already RECEIVED, get 0; 5. Handle and release the negotiate response; 6. UAF. It can be easily reproduce with add some delay in [3] - [6]. Only sync call has the problem since async call's callback is executed in cifsd process. Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely. Fixes: ec637e3ffb6b ("[CIFS] Avoid extra large buffer allocation (and memcpy) in cifs_readpages") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)manguebit.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/transport.c fs/cifs/connect.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 30 ++++++++++++++++++++---------- 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 71c2dd0c7f03..f9abe37c549c 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1597,6 +1597,7 @@ static inline bool is_retryable_error(int error) #define MID_RETRY_NEEDED 8 /* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10 #define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40 /* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 4ca6fd66df03..684dbd580a27 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1079,7 +1079,8 @@ cifs_demultiplex_thread(void *p) if (mids[i] != NULL) { mids[i]->resp_buf_size = server->pdu_size; if ((mids[i]->mid_flags & MID_WAIT_CANCELLED) && - mids[i]->mid_state == MID_RESPONSE_RECEIVED && + (mids[i]->mid_state == MID_RESPONSE_RECEIVED || + mids[i]->mid_state == MID_RESPONSE_READY) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid( mids[i]->resp_buf, diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index eb76f7a59e50..fa83799b3ec0 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -46,6 +46,8 @@ void cifs_wake_up_task(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; wake_up_process(mid->callback_data); } @@ -561,7 +563,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ) int error; error = wait_event_freezekillable_unsafe(server->response_q, - midQ->mid_state != MID_REQUEST_SUBMITTED); + midQ->mid_state != MID_REQUEST_SUBMITTED && + midQ->mid_state != MID_RESPONSE_RECEIVED); if (error < 0) return -ERESTARTSYS; @@ -699,7 +702,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); switch (mid->mid_state) { - case MID_RESPONSE_RECEIVED: + case MID_RESPONSE_READY: spin_unlock(&GlobalMid_Lock); return rc; case MID_RETRY_NEEDED: @@ -790,6 +793,8 @@ cifs_setup_request(struct cifs_ses *ses, struct smb_rqst *rqst) static void cifs_noop_callback(struct mid_q_entry *mid) { + if (mid->mid_state == MID_RESPONSE_RECEIVED) + mid->mid_state = MID_RESPONSE_READY; } int @@ -912,7 +917,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, midQ[i]->mid); send_cancel(ses->server, &rqst[i], midQ[i]); spin_lock(&GlobalMid_Lock); - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || + midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { midQ[i]->mid_flags |= MID_WAIT_CANCELLED; midQ[i]->callback = DeleteMidQEntry; cancelled_mid[i] = true; @@ -938,7 +944,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, } if (!midQ[i]->resp_buf || - midQ[i]->mid_state != MID_RESPONSE_RECEIVED) { + midQ[i]->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(FYI, "Bad MID state?\n"); goto out; @@ -1118,7 +1124,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1135,7 +1142,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, } if (!midQ->resp_buf || !out_buf || - midQ->mid_state != MID_RESPONSE_RECEIVED) { + midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; @@ -1254,13 +1261,15 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, /* Wait for a reply - allow signals to interrupt. */ rc = wait_event_interruptible(ses->server->response_q, - (!(midQ->mid_state == MID_REQUEST_SUBMITTED)) || + (!(midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED)) || ((ses->server->tcpStatus != CifsGood) && (ses->server->tcpStatus != CifsNew))); /* Were we interrupted by a signal ? */ if ((rc == -ERESTARTSYS) && - (midQ->mid_state == MID_REQUEST_SUBMITTED) && + (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) && ((ses->server->tcpStatus == CifsGood) || (ses->server->tcpStatus == CifsNew))) { @@ -1290,7 +1299,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, if (rc) { send_cancel(ses->server, &rqst, midQ); spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { + if (midQ->mid_state == MID_REQUEST_SUBMITTED || + midQ->mid_state == MID_RESPONSE_RECEIVED) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; spin_unlock(&GlobalMid_Lock); @@ -1308,7 +1318,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, return rc; /* rcvd frame is ok */ - if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_RECEIVED) { + if (out_buf == NULL || midQ->mid_state != MID_RESPONSE_READY) { rc = -EIO; cifs_dbg(VFS, "Bad MID state?\n"); goto out; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 09 Mar '24

09 Mar '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v4.19.306 commit 71c17ee02538802ceafc830f0736aa35b564e601 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 34be60fe6892..0fffb393415b 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 09 Mar '24

09 Mar '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v4.19.306 commit 1c17ee02538802ceafc830f0736aa35b564e601 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 34be60fe6892..0fffb393415b 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
by Yongqiang Liu 09 Mar '24

09 Mar '24

From: Pin-yen Lin <treapking(a)chromium.org> stable inclusion from stable-v5.10.198 commit 10a18c8bac7f60d32b7af22da03b66f350beee38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXH CVE: CVE-2023-52525 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aef7a0300047e7b4707ea0411dc9597cba108fc8 ] Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc1042 headers. Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets") Signed-off-by: Pin-yen Lin <treapking(a)chromium.org> Acked-by: Brian Norris <briannorris(a)chromium.org> Reviewed-by: Matthew Wang <matthewmwang(a)chromium.org> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/marvell/mwifiex/sta_rx.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c index 3c555946cb2c..5b16e330014a 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c @@ -98,7 +98,8 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length); rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off; - if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) { + if (sizeof(rx_pkt_hdr->eth803_hdr) + sizeof(rfc1042_header) + + rx_pkt_off > skb->len) { mwifiex_dbg(priv->adapter, ERROR, "wrong rx packet offset: len=%d, rx_pkt_off=%d\n", skb->len, rx_pkt_off); @@ -107,12 +108,13 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, return -1; } - if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, - sizeof(bridge_tunnel_header))) || - (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, - sizeof(rfc1042_header)) && - ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP && - ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) { + if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len && + ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header, + sizeof(bridge_tunnel_header))) || + (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header, + sizeof(rfc1042_header)) && + ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP && + ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX))) { /* * Replace the 803 header and rfc1042 header (llc/snap) with an * EthernetII header, keep the src/dst and snap_type -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 13425/21785] drivers/net/ethernet/huawei/hinic/hinic_main.c:249:23: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'?
by kernel test robot 09 Mar '24

09 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3d10c870b322e5d1a4f8fb923b879a0b73246157 commit: 90f09a01314abe26de1a722d1b51c351d84e1f5b [13425/21785] net/hinic: Add support for X86 Arch config: x86_64-randconfig-015-20240308 (https://download.01.org/0day-ci/archive/20240309/202403091438.ZbJbSAui-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240309/202403091438.ZbJbSAui-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403091438.ZbJbSAui-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/huawei/hinic/hinic_main.c: In function 'hinic_netdev_event': >> drivers/net/ethernet/huawei/hinic/hinic_main.c:249:23: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] 249 | ret = vlan_dev_priv(ndev)->real_dev; | ^~~~~~~~~~~~~ | netdev_priv >> drivers/net/ethernet/huawei/hinic/hinic_main.c:249:42: error: invalid type argument of '->' (have 'int') 249 | ret = vlan_dev_priv(ndev)->real_dev; | ^~ drivers/net/ethernet/huawei/hinic/hinic_main.c:251:49: error: invalid type argument of '->' (have 'int') 251 | ret = vlan_dev_priv(ret)->real_dev; | ^~ drivers/net/ethernet/huawei/hinic/hinic_main.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_main.c:3294:6: warning: no previous prototype for 'nic_event' [-Wmissing-prototypes] 3294 | void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, | ^~~~~~~~~ cc1: some warnings being treated as errors vim +249 drivers/net/ethernet/huawei/hinic/hinic_main.c edd384f682cc29 Aviad Krawczyk 2017-08-21 221 6cb2e756917d12 Xue 2019-01-31 222 #define HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT 2 6cb2e756917d12 Xue 2019-01-31 223 #define HINIC_VLAN_CLEAR_OFFLOAD (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \ 6cb2e756917d12 Xue 2019-01-31 224 NETIF_F_SCTP_CRC | NETIF_F_RXCSUM | \ 6cb2e756917d12 Xue 2019-01-31 225 NETIF_F_ALL_TSO) edd384f682cc29 Aviad Krawczyk 2017-08-21 226 6cb2e756917d12 Xue 2019-01-31 227 int hinic_netdev_event(struct notifier_block *notifier, 6cb2e756917d12 Xue 2019-01-31 228 unsigned long event, void *ptr) edd384f682cc29 Aviad Krawczyk 2017-08-21 229 { 6cb2e756917d12 Xue 2019-01-31 230 struct net_device *ndev = netdev_notifier_info_to_dev(ptr); 6cb2e756917d12 Xue 2019-01-31 231 struct net_device *real_dev, *ret; 6cb2e756917d12 Xue 2019-01-31 232 struct hinic_nic_dev *nic_dev; 6cb2e756917d12 Xue 2019-01-31 233 u16 vlan_depth; 6cb2e756917d12 Xue 2019-01-31 234 6cb2e756917d12 Xue 2019-01-31 235 if (!is_vlan_dev(ndev)) 6cb2e756917d12 Xue 2019-01-31 236 return NOTIFY_DONE; 6cb2e756917d12 Xue 2019-01-31 237 6cb2e756917d12 Xue 2019-01-31 238 dev_hold(ndev); 6cb2e756917d12 Xue 2019-01-31 239 6cb2e756917d12 Xue 2019-01-31 240 switch (event) { 6cb2e756917d12 Xue 2019-01-31 241 case NETDEV_REGISTER: 6cb2e756917d12 Xue 2019-01-31 242 real_dev = vlan_dev_real_dev(ndev); 6cb2e756917d12 Xue 2019-01-31 243 nic_dev = hinic_get_uld_dev_by_ifname(real_dev->name, 6cb2e756917d12 Xue 2019-01-31 244 SERVICE_T_NIC); 6cb2e756917d12 Xue 2019-01-31 245 if (!nic_dev) 6cb2e756917d12 Xue 2019-01-31 246 goto out; 6cb2e756917d12 Xue 2019-01-31 247 6cb2e756917d12 Xue 2019-01-31 248 vlan_depth = 1; 6cb2e756917d12 Xue 2019-01-31 @249 ret = vlan_dev_priv(ndev)->real_dev; 6cb2e756917d12 Xue 2019-01-31 250 while (is_vlan_dev(ret)) { 6cb2e756917d12 Xue 2019-01-31 251 ret = vlan_dev_priv(ret)->real_dev; 6cb2e756917d12 Xue 2019-01-31 252 vlan_depth++; 6cb2e756917d12 Xue 2019-01-31 253 } 6cb2e756917d12 Xue 2019-01-31 254 6cb2e756917d12 Xue 2019-01-31 255 if (vlan_depth == HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 6cb2e756917d12 Xue 2019-01-31 256 ndev->vlan_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 257 } else if (vlan_depth > HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 6cb2e756917d12 Xue 2019-01-31 258 #ifdef HAVE_NDO_SET_FEATURES 6cb2e756917d12 Xue 2019-01-31 259 #ifdef HAVE_RHEL6_NET_DEVICE_OPS_EXT 6cb2e756917d12 Xue 2019-01-31 260 set_netdev_hw_features(ndev, 6cb2e756917d12 Xue 2019-01-31 261 get_netdev_hw_features(ndev) & 6cb2e756917d12 Xue 2019-01-31 262 (~HINIC_VLAN_CLEAR_OFFLOAD)); 6cb2e756917d12 Xue 2019-01-31 263 #else 6cb2e756917d12 Xue 2019-01-31 264 ndev->hw_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 265 #endif 6cb2e756917d12 Xue 2019-01-31 266 #endif 6cb2e756917d12 Xue 2019-01-31 267 ndev->features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 6cb2e756917d12 Xue 2019-01-31 268 } edd384f682cc29 Aviad Krawczyk 2017-08-21 269 6cb2e756917d12 Xue 2019-01-31 270 break; edd384f682cc29 Aviad Krawczyk 2017-08-21 271 6cb2e756917d12 Xue 2019-01-31 272 default: 6cb2e756917d12 Xue 2019-01-31 273 break; 6cb2e756917d12 Xue 2019-01-31 274 }; edd384f682cc29 Aviad Krawczyk 2017-08-21 275 6cb2e756917d12 Xue 2019-01-31 276 out: 6cb2e756917d12 Xue 2019-01-31 277 dev_put(ndev); edd384f682cc29 Aviad Krawczyk 2017-08-21 278 6cb2e756917d12 Xue 2019-01-31 279 return NOTIFY_DONE; edd384f682cc29 Aviad Krawczyk 2017-08-21 280 } 6cb2e756917d12 Xue 2019-01-31 281 #endif edd384f682cc29 Aviad Krawczyk 2017-08-21 282 :::::: The code at line 249 was first introduced by commit :::::: 6cb2e756917d122560e0c52f350682760d004eec net: hinic: Add NIC Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
by Li Huafei 09 Mar '24

09 Mar '24

From: Hans de Goede <hdegoede(a)redhat.com> stable inclusion from stable-v4.19.297 commit 44481b244fcaa2b895a53081d6204c574720c38c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94P85 CVE: CVE-2023-52478 --------------------------- commit dac501397b9d81e4782232c39f94f4307b137452 upstream. hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() primarily runs from a workqueue but it also runs on probe() and if a "device-connected" packet is received by the hw when the thread running hidpp_connect_event() from probe() is waiting on the hw, then a second thread running hidpp_connect_event() will be started from the workqueue. This opens the following races (note the below code is simplified): 1. Retrieving + printing the protocol (harmless race): if (!hidpp->protocol_major) { hidpp_root_get_protocol_version() hidpp->protocol_major = response.rap.params[0]; } We can actually see this race hit in the dmesg in the abrt output attached to rhbz#2227968: [ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. [ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected. Testing with extra logging added has shown that after this the 2 threads take turn grabbing the hw access mutex (send_mutex) so they ping-pong through all the other TOCTOU cases managing to hit all of them: 2. Updating the name to the HIDPP name (harmless race): if (hidpp->name == hdev->name) { ... hidpp->name = new_name; } 3. Initializing the power_supply class for the battery (problematic!): hidpp_initialize_battery() { if (hidpp->battery.ps) return 0; probe_battery(); /* Blocks, threads take turns executing this */ hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); } 4. Creating delayed input_device (potentially problematic): if (hidpp->delayed_input) return; hidpp->delayed_input = hidpp_allocate_input(hdev); The really big problem here is 3. Hitting the race leads to the following sequence: hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); ... hidpp->battery.desc.properties = devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL); hidpp->battery.ps = devm_power_supply_register(&hidpp->hid_dev->dev, &hidpp->battery.desc, cfg); So now we have registered 2 power supplies for the same battery, which looks a bit weird from userspace's pov but this is not even the really big problem. Notice how: 1. This is all devm-maganaged 2. The hidpp->battery.desc struct is shared between the 2 power supplies 3. hidpp->battery.desc.properties points to the result from the second devm_kmemdup() This causes a use after free scenario on USB disconnect of the receiver: 1. The last registered power supply class device gets unregistered 2. The memory from the last devm_kmemdup() call gets freed, hidpp->battery.desc.properties now points to freed memory 3. The first registered power supply class device gets unregistered, this involves sending a remove uevent to userspace which invokes power_supply_uevent() to fill the uevent data 4. power_supply_uevent() uses hidpp->battery.desc.properties which now points to freed memory leading to backtraces like this one: Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08 ... Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0 ... Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0 Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0x10d/0x1d0 Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0 Sep 22 20:01:35 eric kernel: kobject_uevent_env+0x291/0x680 Sep 22 20:01:35 eric kernel: power_supply_unregister+0x8e/0xa0 Sep 22 20:01:35 eric kernel: release_nodes+0x3d/0xb0 Sep 22 20:01:35 eric kernel: devres_release_group+0xfc/0x130 Sep 22 20:01:35 eric kernel: hid_device_remove+0x56/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: logi_dj_remove+0x9a/0x100 [hid_logitech_dj 5c91534a0ead2b65e04dd799a0437e3b99b21bc4] Sep 22 20:01:35 eric kernel: hid_device_remove+0x44/0xa0 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440 Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60 Sep 22 20:01:35 eric kernel: usbhid_disconnect+0x47/0x60 [usbhid 727dcc1c0b94e6b4418727a468398ac3bca492f3] Sep 22 20:01:35 eric kernel: usb_unbind_interface+0x90/0x270 Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200 Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130 Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0 Sep 22 20:01:35 eric kernel: ? kobject_put+0xa0/0x1d0 Sep 22 20:01:35 eric kernel: usb_disable_device+0xcd/0x1e0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xde/0x2c0 Sep 22 20:01:35 eric kernel: usb_disconnect+0xc3/0x2c0 Sep 22 20:01:35 eric kernel: hub_event+0xe80/0x1c10 There have been quite a few bug reports (see Link tags) about this crash. Fix all the TOCTOU issues, including the really bad power-supply related system crash on USB disconnect, by making probe() use the workqueue for running hidpp_connect_event() too, so that it can never run more then once. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227221 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2242189 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412#c58 Cc: stable(a)vger.kernel.org Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> Link: https://lore.kernel.org/r/20231005182638.3776-1-hdegoede@redhat.com Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/hid/hid-logitech-hidpp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index 504e8917b06f..eda8833b8c7f 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -3080,7 +3080,8 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) /* Allow incoming packets */ hid_device_io_start(hdev); - hidpp_connect_event(hidpp); + schedule_work(&hidpp->work); + flush_work(&hidpp->work); return ret; -- 2.25.1

2 1

[PATCH OLK-5.10] wifi: mac80211: fix potential key use-after-free
by Dong Chenchen 09 Mar '24

09 Mar '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v5.12-rc6 commit 31db78a4923ef5e2008f2eed321811ca79e7f71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASP CVE: CVE-2023-52530 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add(). Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall without changing anything") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/cfg.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/mac80211/cfg.c | 3 +++ net/mac80211/key.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index c6a7f1c99abc..70126518ad16 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -509,6 +509,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, sta->cipher_scheme = cs; err = ieee80211_key_link(key, sdata, sta); + /* KRACK protection, shouldn't happen but just silently accept key */ + if (err == -EALREADY) + err = 0; out_unlock: mutex_unlock(&local->sta_mtx); diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 6a72c33679ba..6b089594a9f3 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -843,7 +843,7 @@ int ieee80211_key_link(struct ieee80211_key *key, */ if (ieee80211_key_identical(sdata, old_key, key)) { ieee80211_key_free_unused(key); - ret = 0; + ret = -EALREADY; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: fix potential key use-after-free
by Dong Chenchen 09 Mar '24

09 Mar '24

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v5.12-rc6 commit 31db78a4923ef5e2008f2eed321811ca79e7f71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASP CVE: CVE-2023-52530 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will still return a pointer into the key, in a potential use-after-free. This normally doesn't happen since it's only called by iwlwifi in case of WoWLAN rekey offload which has its own KRACK protection, but still better to fix, do that by returning an error code and converting that to success on the cfg80211 boundary only, leaving the error for bad callers of ieee80211_gtk_rekey_add(). Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Fixes: fdf7cb4185b6 ("mac80211: accept key reinstall without changing anything") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/cfg.c Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/mac80211/cfg.c | 3 +++ net/mac80211/key.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index e46944500cfa..2201923238ed 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -457,6 +457,9 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev, sta->cipher_scheme = cs; err = ieee80211_key_link(key, sdata, sta); + /* KRACK protection, shouldn't happen but just silently accept key */ + if (err == -EALREADY) + err = 0; out_unlock: mutex_unlock(&local->sta_mtx); diff --git a/net/mac80211/key.c b/net/mac80211/key.c index 6775d6cb7d3d..017a9d2b5cec 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c @@ -681,7 +681,7 @@ int ieee80211_key_link(struct ieee80211_key *key, */ if (ieee80211_key_identical(sdata, old_key, key)) { ieee80211_key_free_unused(key); - ret = 0; + ret = -EALREADY; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v1 0/6] Fix CVE-2023-52514
by Wei Li 09 Mar '24

09 Mar '24

This series is meant to fix CVE-2023-52514, with 5 LTS patches which are depended on but not backported before. Sean Christopherson (6): x86/reboot: Force all cpus to exit VMX root if VMX is supported x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) x86/crash: Disable virt in core NMI crash handler to avoid double shootdown x86/reboot: Disable virtualization in an emergency if SVM is supported x86/reboot: Disable SVM, not just VMX, when stopping CPUs x86/reboot: VMCLEAR active VMCSes before emergency reboot arch/x86/include/asm/kexec.h | 2 - arch/x86/include/asm/reboot.h | 4 ++ arch/x86/include/asm/virtext.h | 16 ++++- arch/x86/kernel/crash.c | 47 +------------ arch/x86/kernel/reboot.c | 121 ++++++++++++++++++++++++--------- arch/x86/kernel/smp.c | 6 +- arch/x86/kvm/vmx.c | 12 +--- 7 files changed, 112 insertions(+), 96 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS] drm: bridge/panel: Cleanup connector on bridge detach
by Guo Mengqi 09 Mar '24

09 Mar '24

From: Paul Cercueil <paul(a)crapouillou.net> stable inclusion from stable-v5.10.37 commit ce450934a00cf896e648fde08d0bd1426653d7a2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOL CVE: CVE-2021-47063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4d906839d321c2efbf3fed4bc31ffd9ff55b75c0 upstream. If we don't call drm_connector_cleanup() manually in panel_bridge_detach(), the connector will be cleaned up with the other DRM objects in the call to drm_mode_config_cleanup(). However, since our drm_connector is devm-allocated, by the time drm_mode_config_cleanup() will be called, our connector will be long gone. Therefore, the connector must be cleaned up when the bridge is detached to avoid use-after-free conditions. v2: Cleanup connector only if it was created v3: Add FIXME v4: (Use connector->dev) directly in if() block Fixes: 13dfc0540a57 ("drm/bridge: Refactor out the panel wrapper from the lvds-encoder bridge.") Cc: <stable(a)vger.kernel.org> # 4.12+ Cc: Andrzej Hajda <a.hajda(a)samsung.com> Cc: Neil Armstrong <narmstrong(a)baylibre.com> Cc: Laurent Pinchart <Laurent.pinchart(a)ideasonboard.com> Cc: Jonas Karlman <jonas(a)kwiboo.se> Cc: Jernej Skrabec <jernej.skrabec(a)siol.net> Signed-off-by: Paul Cercueil <paul(a)crapouillou.net> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210327115742.18986-2-paul@c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/gpu/drm/bridge/panel.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/bridge/panel.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/gpu/drm/bridge/panel.c b/drivers/gpu/drm/bridge/panel.c index 7cbaba213ef6..dbeaf1257668 100644 --- a/drivers/gpu/drm/bridge/panel.c +++ b/drivers/gpu/drm/bridge/panel.c @@ -92,6 +92,17 @@ static int panel_bridge_attach(struct drm_bridge *bridge) static void panel_bridge_detach(struct drm_bridge *bridge) { struct panel_bridge *panel_bridge = drm_bridge_to_panel_bridge(bridge); + struct drm_connector *connector = &panel_bridge->connector; + + /* + * Cleanup the connector if we know it was initialized. + * + * FIXME: This wouldn't be needed if the panel_bridge structure was + * allocated with drmm_kzalloc(). This might be tricky since the + * drm_device pointer can only be retrieved when the bridge is attached. + */ + if (connector->dev) + drm_connector_cleanup(connector); drm_panel_detach(panel_bridge->panel); } -- 2.17.1

2 1

[PATCH OLK-5.10 0/3] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS] uio_hv_generic: Fix a memory leak in error handling paths
by Guo Mengqi 09 Mar '24

09 Mar '24

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v5.10.40 commit d84b5e912212b05f6b5bde9f682046accfbe0354 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GH CVE: CVE-2021-47071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3ee098f96b8b6c1a98f7f97915f8873164e6af9d upstream. If 'vmbus_establish_gpadl()' fails, the (recv|send)_gpadl will not be updated and 'hv_uio_cleanup()' in the error handling path will not be able to free the corresponding buffer. In such a case, we need to free the buffer explicitly. Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Link: https://lore.kernel.org/r/4fdaff557deef6f0475d02ba7922ddbaa1ab08a6.16205440… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio_hv_generic.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c index 170fa1f8f00e..b58e7c582d3f 100644 --- a/drivers/uio/uio_hv_generic.c +++ b/drivers/uio/uio_hv_generic.c @@ -250,8 +250,10 @@ hv_uio_probe(struct hv_device *dev, ret = vmbus_establish_gpadl(dev->channel, pdata->recv_buf, RECV_BUFFER_SIZE, &pdata->recv_gpadl); - if (ret) + if (ret) { + vfree(pdata->recv_buf); goto fail_close; + } /* put Global Physical Address Label in name */ snprintf(pdata->recv_name, sizeof(pdata->recv_name), @@ -271,8 +273,10 @@ hv_uio_probe(struct hv_device *dev, ret = vmbus_establish_gpadl(dev->channel, pdata->send_buf, SEND_BUFFER_SIZE, &pdata->send_gpadl); - if (ret) + if (ret) { + vfree(pdata->send_buf); goto fail_close; + } snprintf(pdata->send_name, sizeof(pdata->send_name), "send:%u", pdata->send_gpadl); -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/3] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

Fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() Felix Riemann (1): net: Fix unwanted sign extension in netdev_stats_to_stats64() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] RDMA/rxe: Return CQE error if invalid lkey was supplied
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v5.13-rc3 commit dc07628bd2bbc1da768e265192c28ebd301f509d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956FT CVE: CVE-2021-47076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. [leonro@vm ~]$ mkt test test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0xb11/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_responder+0x5532/0x7620 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0x9c8/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_requester+0x1efd/0x58c0 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_post_send+0x998/0x1860 [rdma_rxe] ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs] ib_uverbs_write+0x847/0xc80 [ib_uverbs] vfs_write+0x1c5/0x840 ksys_write+0x176/0x1d0 do_syscall_64+0x3f/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/11e7b553f3a6f5371c6bb3f57c494bb52b88af99.16207117… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Acked-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/sw/rxe/rxe_comp.c --- drivers/infiniband/sw/rxe/rxe_comp.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c index 0a1e6393250b..aa73a54ea070 100644 --- a/drivers/infiniband/sw/rxe/rxe_comp.c +++ b/drivers/infiniband/sw/rxe/rxe_comp.c @@ -346,13 +346,15 @@ static inline enum comp_state do_read(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, payload_addr(pkt), payload_size(pkt), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; + } if (wqe->dma.resid == 0 && (pkt->mask & RXE_END_MASK)) return COMPST_COMP_ACK; - else - return COMPST_UPDATE_COMP; + + return COMPST_UPDATE_COMP; } static inline enum comp_state do_atomic(struct rxe_qp *qp, @@ -366,10 +368,12 @@ static inline enum comp_state do_atomic(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, &atomic_orig, sizeof(u64), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; - else - return COMPST_COMP_ACK; + } + + return COMPST_COMP_ACK; } static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/rxe: Return CQE error if invalid lkey was supplied
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v5.13-rc3 commit dc07628bd2bbc1da768e265192c28ebd301f509d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956FT CVE: CVE-2021-47076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- RXE is missing update of WQE status in LOCAL_WRITE failures. This caused the following kernel panic if someone sent an atomic operation with an explicitly wrong lkey. [leonro@vm ~]$ mkt test test_atomic_invalid_lkey (tests.test_atomic.AtomicTest) ... WARNING: CPU: 5 PID: 263 at drivers/infiniband/sw/rxe/rxe_comp.c:740 rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Modules linked in: crc32_generic rdma_rxe ip6_udp_tunnel udp_tunnel rdma_ucm rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core ptp pps_core CPU: 5 PID: 263 Comm: python3 Not tainted 5.13.0-rc1+ #2936 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:rxe_completer+0x1a6d/0x2e30 [rdma_rxe] Code: 03 0f 8e 65 0e 00 00 3b 93 10 06 00 00 0f 84 82 0a 00 00 4c 89 ff 4c 89 44 24 38 e8 2d 74 a9 e1 4c 8b 44 24 38 e9 1c f5 ff ff <0f> 0b e9 0c e8 ff ff b8 05 00 00 00 41 bf 05 00 00 00 e9 ab e7 ff RSP: 0018:ffff8880158af090 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888016a78000 RCX: ffffffffa0cf1652 RDX: 1ffff9200004b442 RSI: 0000000000000004 RDI: ffffc9000025a210 RBP: dffffc0000000000 R08: 00000000ffffffea R09: ffff88801617740b R10: ffffed1002c2ee81 R11: 0000000000000007 R12: ffff88800f3b63e8 R13: ffff888016a78008 R14: ffffc9000025a180 R15: 000000000000000c FS: 00007f88b622a740(0000) GS:ffff88806d540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f88b5a1fa10 CR3: 000000000d848004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0xb11/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_responder+0x5532/0x7620 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_rcv+0x9c8/0x1df0 [rdma_rxe] rxe_loopback+0x157/0x1e0 [rdma_rxe] rxe_requester+0x1efd/0x58c0 [rdma_rxe] rxe_do_task+0x130/0x230 [rdma_rxe] rxe_post_send+0x998/0x1860 [rdma_rxe] ib_uverbs_post_send+0xd5f/0x1220 [ib_uverbs] ib_uverbs_write+0x847/0xc80 [ib_uverbs] vfs_write+0x1c5/0x840 ksys_write+0x176/0x1d0 do_syscall_64+0x3f/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/11e7b553f3a6f5371c6bb3f57c494bb52b88af99.16207117… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Acked-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/sw/rxe/rxe_comp.c --- drivers/infiniband/sw/rxe/rxe_comp.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c index ea089cb091ad..5c2bc22bc9d6 100644 --- a/drivers/infiniband/sw/rxe/rxe_comp.c +++ b/drivers/infiniband/sw/rxe/rxe_comp.c @@ -373,13 +373,15 @@ static inline enum comp_state do_read(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, payload_addr(pkt), payload_size(pkt), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; + } if (wqe->dma.resid == 0 && (pkt->mask & RXE_END_MASK)) return COMPST_COMP_ACK; - else - return COMPST_UPDATE_COMP; + + return COMPST_UPDATE_COMP; } static inline enum comp_state do_atomic(struct rxe_qp *qp, @@ -393,10 +395,12 @@ static inline enum comp_state do_atomic(struct rxe_qp *qp, ret = copy_data(qp->pd, IB_ACCESS_LOCAL_WRITE, &wqe->dma, &atomic_orig, sizeof(u64), to_mem_obj, NULL); - if (ret) + if (ret) { + wqe->status = IB_WC_LOC_PROT_ERR; return COMPST_ERROR; - else - return COMPST_COMP_ACK; + } + + return COMPST_COMP_ACK; } static void make_send_cqe(struct rxe_qp *qp, struct rxe_send_wqe *wqe, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2021-47074
by Li Nan 09 Mar '24

09 Mar '24

v3: change bugzilla url. v2: add CVE tag to first patch. Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] x86/reboot: VMCLEAR active VMCSes before emergency reboot
by Wei Li 09 Mar '24

09 Mar '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.6-rc1 commit b23c83ad2c638420ec0608a9de354507c41bec29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B2J CVE: CVE-2023-52514 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… -------------------------------- VMCLEAR active VMCSes before any emergency reboot, not just if the kernel may kexec into a new kernel after a crash. Per Intel's SDM, the VMX architecture doesn't require the CPU to flush the VMCS cache on INIT. If an emergency reboot doesn't RESET CPUs, cached VMCSes could theoretically be kept and only be written back to memory after the new kernel is booted, i.e. could effectively corrupt memory after reboot. Opportunistically remove the setting of the global pointer to NULL to make checkpatch happy. Cc: Andrew Cooper <Andrew.Cooper3(a)citrix.com> Link: https://lore.kernel.org/r/20230721201859.2307736-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Wei Li <liwei391(a)huawei.com> --- arch/x86/include/asm/kexec.h | 2 -- arch/x86/include/asm/reboot.h | 2 ++ arch/x86/kernel/crash.c | 31 ------------------------------- arch/x86/kernel/reboot.c | 22 ++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.c | 9 ++------- 5 files changed, 26 insertions(+), 40 deletions(-) diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h index 3533ede83b42..5f5b83bdaa3e 100644 --- a/arch/x86/include/asm/kexec.h +++ b/arch/x86/include/asm/kexec.h @@ -209,8 +209,6 @@ extern void arch_kexec_pre_free_pages(void *vaddr, unsigned int pages); #endif -typedef void crash_vmclear_fn(void); -extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; extern void kdump_nmi_shootdown_cpus(void); #ifdef CONFIG_KEXEC_CORE diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h index bc5b4d788c08..2551baec927d 100644 --- a/arch/x86/include/asm/reboot.h +++ b/arch/x86/include/asm/reboot.h @@ -25,6 +25,8 @@ void __noreturn machine_real_restart(unsigned int type); #define MRR_BIOS 0 #define MRR_APM 1 +typedef void crash_vmclear_fn(void); +extern crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; void cpu_emergency_disable_virtualization(void); typedef void (*nmi_shootdown_cb)(int, struct pt_regs*); diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c index bd4b566ec917..1247cdafe353 100644 --- a/arch/x86/kernel/crash.c +++ b/arch/x86/kernel/crash.c @@ -48,27 +48,6 @@ struct crash_memmap_data { unsigned int type; }; -/* - * This is used to VMCLEAR all VMCSs loaded on the - * processor. And when loading kvm_intel module, the - * callback function pointer will be assigned. - * - * protected by rcu. - */ -crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss = NULL; -EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss); - -static inline void cpu_crash_vmclear_loaded_vmcss(void) -{ - crash_vmclear_fn *do_vmclear_operation = NULL; - - rcu_read_lock(); - do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss); - if (do_vmclear_operation) - do_vmclear_operation(); - rcu_read_unlock(); -} - /* * When the crashkernel option is specified, only use the low * 1M for the real mode trampoline. @@ -88,11 +67,6 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs) { crash_save_cpu(regs, cpu); - /* - * VMCLEAR VMCSs loaded on all cpus if needed. - */ - cpu_crash_vmclear_loaded_vmcss(); - /* * Disable Intel PT to stop its logging */ @@ -146,11 +120,6 @@ void native_machine_crash_shutdown(struct pt_regs *regs) crash_smp_send_stop(); - /* - * VMCLEAR VMCSs loaded on this cpu if needed. - */ - cpu_crash_vmclear_loaded_vmcss(); - cpu_emergency_disable_virtualization(); /* diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c index 52c77932c4d2..970296f4403b 100644 --- a/arch/x86/kernel/reboot.c +++ b/arch/x86/kernel/reboot.c @@ -787,6 +787,26 @@ void machine_crash_shutdown(struct pt_regs *regs) } #endif +/* + * This is used to VMCLEAR all VMCSs loaded on the + * processor. And when loading kvm_intel module, the + * callback function pointer will be assigned. + * + * protected by rcu. + */ +crash_vmclear_fn __rcu *crash_vmclear_loaded_vmcss; +EXPORT_SYMBOL_GPL(crash_vmclear_loaded_vmcss); + +static inline void cpu_crash_vmclear_loaded_vmcss(void) +{ + crash_vmclear_fn *do_vmclear_operation = NULL; + + rcu_read_lock(); + do_vmclear_operation = rcu_dereference(crash_vmclear_loaded_vmcss); + if (do_vmclear_operation) + do_vmclear_operation(); + rcu_read_unlock(); +} /* This is the CPU performing the emergency shutdown work. */ int crashing_cpu = -1; @@ -798,6 +818,8 @@ int crashing_cpu = -1; */ void cpu_emergency_disable_virtualization(void) { + cpu_crash_vmclear_loaded_vmcss(); + cpu_emergency_vmxoff(); cpu_emergency_svm_disable(); } diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 74a717ca46e7..ff783fed0fd0 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -40,7 +40,7 @@ #include <asm/idtentry.h> #include <asm/io.h> #include <asm/irq_remapping.h> -#include <asm/kexec.h> +#include <asm/reboot.h> #include <asm/perf_event.h> #include <asm/mce.h> #include <asm/mmu_context.h> @@ -780,7 +780,6 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx, return ret; } -#ifdef CONFIG_KEXEC_CORE static void crash_vmclear_local_loaded_vmcss(void) { int cpu = raw_smp_processor_id(); @@ -790,7 +789,6 @@ static void crash_vmclear_local_loaded_vmcss(void) loaded_vmcss_on_cpu_link) vmcs_clear(v->vmcs); } -#endif /* CONFIG_KEXEC_CORE */ static void __loaded_vmcs_clear(void *arg) { @@ -8514,10 +8512,8 @@ static void vmx_cleanup_l1d_flush(void) static void vmx_exit(void) { -#ifdef CONFIG_KEXEC_CORE RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL); synchronize_rcu(); -#endif kvm_exit(); @@ -8612,10 +8608,9 @@ static int __init vmx_init(void) pi_init_cpu(cpu); } -#ifdef CONFIG_KEXEC_CORE rcu_assign_pointer(crash_vmclear_loaded_vmcss, crash_vmclear_local_loaded_vmcss); -#endif + vmx_check_vmcs12_offsets(); /* -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-52578
by Zhengchao Shao 09 Mar '24

09 Mar '24

Fix CVE-2023-52578 Eric Dumazet (2): net: add atomic_long_t to net_device_stats fields net: bridge: use DEV_STATS_INC() include/linux/netdevice.h | 58 +++++++++++++++++++++++---------------- include/net/dst.h | 5 ++-- net/bridge/br_forward.c | 4 +-- net/bridge/br_input.c | 4 +-- net/core/dev.c | 14 ++-------- 5 files changed, 44 insertions(+), 41 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/rxe: Clear all QP fields if creation failed
by Liu Jian 09 Mar '24

09 Mar '24

From: Leon Romanovsky <leonro(a)nvidia.com> stable inclusion from stable-v4.19.192 commit f3783c415bf6d2ead3d7aa2c38802bbe10723646 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956GP CVE: CVE-2021-47078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 67f29896fdc83298eed5a6576ff8f9873f709228 ] rxe_qp_do_cleanup() relies on valid pointer values in QP for the properly created ones, but in case rxe_qp_from_init() failed it was filled with garbage and caused tot the following error. refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 12560 at lib/refcount.c:28 refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 12560 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:refcount_warn_saturate+0x1d1/0x1e0 lib/refcount.c:28 Code: e9 db fe ff ff 48 89 df e8 2c c2 ea fd e9 8a fe ff ff e8 72 6a a7 fd 48 c7 c7 e0 b2 c1 89 c6 05 dc 3a e6 09 01 e8 ee 74 fb 04 <0f> 0b e9 af fe ff ff 0f 1f 84 00 00 00 00 00 41 56 41 55 41 54 55 RSP: 0018:ffffc900097ceba8 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff815bb075 RDI: fffff520012f9d67 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815b4eae R11: 0000000000000000 R12: ffff8880322a4800 R13: ffff8880322a4940 R14: ffff888033044e00 R15: 0000000000000000 FS: 00007f6eb2be3700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdbe5d41000 CR3: 000000001d181000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] kref_put include/linux/kref.h:64 [inline] rxe_qp_do_cleanup+0x96f/0xaf0 drivers/infiniband/sw/rxe/rxe_qp.c:805 execute_in_process_context+0x37/0x150 kernel/workqueue.c:3327 rxe_elem_release+0x9f/0x180 drivers/infiniband/sw/rxe/rxe_pool.c:391 kref_put include/linux/kref.h:65 [inline] rxe_create_qp+0x2cd/0x310 drivers/infiniband/sw/rxe/rxe_verbs.c:425 _ib_create_qp drivers/infiniband/core/core_priv.h:331 [inline] ib_create_named_qp+0x2ad/0x1370 drivers/infiniband/core/verbs.c:1231 ib_create_qp include/rdma/ib_verbs.h:3644 [inline] create_mad_qp+0x177/0x2d0 drivers/infiniband/core/mad.c:2920 ib_mad_port_open drivers/infiniband/core/mad.c:3001 [inline] ib_mad_init_device+0xd6f/0x1400 drivers/infiniband/core/mad.c:3092 add_client_context+0x405/0x5e0 drivers/infiniband/core/device.c:717 enable_device_and_get+0x1cd/0x3b0 drivers/infiniband/core/device.c:1331 ib_register_device drivers/infiniband/core/device.c:1413 [inline] ib_register_device+0x7c7/0xa50 drivers/infiniband/core/device.c:1365 rxe_register_device+0x3d5/0x4a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1147 rxe_add+0x12fe/0x16d0 drivers/infiniband/sw/rxe/rxe.c:247 rxe_net_add+0x8c/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:503 rxe_newlink drivers/infiniband/sw/rxe/rxe.c:269 [inline] rxe_newlink+0xb7/0xe0 drivers/infiniband/sw/rxe/rxe.c:250 nldev_newlink+0x30e/0x550 drivers/infiniband/core/nldev.c:1555 rdma_nl_rcv_msg+0x36d/0x690 drivers/infiniband/core/netlink.c:195 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0x2ee/0x430 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:674 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/7bf8d548764d406dbbbaf4b574960ebfd5af8387.16207179… Reported-by: syzbot+36a7f280de4e11c6f04e(a)syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Reviewed-by: Zhu Yanjun <zyjzyj2000(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c index c58452daffc7..4c0caca6da50 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c +++ b/drivers/infiniband/sw/rxe/rxe_qp.c @@ -249,6 +249,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, if (err) { kvfree(qp->sq.queue->buf); kfree(qp->sq.queue); + qp->sq.queue = NULL; return err; } @@ -302,6 +303,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, if (err) { kvfree(qp->rq.queue->buf); kfree(qp->rq.queue); + qp->rq.queue = NULL; return err; } } @@ -362,6 +364,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, err2: rxe_queue_cleanup(qp->sq.queue); err1: + qp->pd = NULL; + qp->rcq = NULL; + qp->scq = NULL; + qp->srq = NULL; + if (srq) rxe_drop_ref(srq); rxe_drop_ref(scq); -- 2.34.1

2 1

[PATCH OLK-5.10] net: rds: Fix possible NULL-pointer dereference
by Zhengchao Shao 09 Mar '24

09 Mar '24

From: Artem Chernyshev <artem.chernyshev(a)red-soft.ru> stable inclusion from stable-v5.10.198 commit f515112e833791001aaa8ab886af3ca78503617f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATK CVE: CVE-2023-52573 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f1d95df0f31048f1c59092648997686e3f7d9478 ] In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: fd261ce6a30e ("rds: rdma: update rdma transport for tos") Signed-off-by: Artem Chernyshev <artem.chernyshev(a)red-soft.ru> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/rds/rdma_transport.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c index 5f741e51b4ba..bb38124a5d3d 100644 --- a/net/rds/rdma_transport.c +++ b/net/rds/rdma_transport.c @@ -86,10 +86,12 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id, break; case RDMA_CM_EVENT_ADDR_RESOLVED: - rdma_set_service_type(cm_id, conn->c_tos); - /* XXX do we need to clean up if this fails? */ - ret = rdma_resolve_route(cm_id, + if (conn) { + rdma_set_service_type(cm_id, conn->c_tos); + /* XXX do we need to clean up if this fails? */ + ret = rdma_resolve_route(cm_id, RDS_RDMA_RESOLVE_TIMEOUT_MS); + } break; case RDMA_CM_EVENT_ROUTE_RESOLVED: -- 2.34.1

2 1

[PATCH OLK-5.10] dccp: fix dccp_v4_err()/dccp_v6_err() again
by Ziyang Xuan 09 Mar '24

09 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.198 commit 60d73c62e3e4464f375758b6f2459c13d46465b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT6 CVE: CVE-2023-52577 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6af289746a636f71f4c0535a9801774118486c7a ] dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions). syzbot reported: BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Fixes: 977ad86c2a1b ("dccp: Fix out of bounds access in DCCP error handler") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Jann Horn <jannh(a)google.com> Reviewed-by: Jann Horn <jannh(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/dccp/ipv4.c | 9 ++------- net/dccp/ipv6.c | 9 ++------- 2 files changed, 4 insertions(+), 14 deletions(-) diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c index 398dc3e47d0c8..f2a0a4e6dd748 100644 --- a/net/dccp/ipv4.c +++ b/net/dccp/ipv4.c @@ -243,13 +243,8 @@ static int dccp_v4_err(struct sk_buff *skb, u32 info) int err; struct net *net = dev_net(skb->dev); - /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, - * which is in byte 7 of the dccp header. - * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. - * - * Later on, we want to access the sequence number fields, which are - * beyond 8 bytes, so we have to pskb_may_pull() ourselves. - */ + if (!pskb_may_pull(skb, offset + sizeof(*dh))) + return -EINVAL; dh = (struct dccp_hdr *)(skb->data + offset); if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) return -EINVAL; diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index bfe11e96af7c9..6d6bbd43a1419 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -76,13 +76,8 @@ static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, __u64 seq; struct net *net = dev_net(skb->dev); - /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, - * which is in byte 7 of the dccp header. - * Our caller (icmpv6_notify()) already pulled 8 bytes for us. - * - * Later on, we want to access the sequence number fields, which are - * beyond 8 bytes, so we have to pskb_may_pull() ourselves. - */ + if (!pskb_may_pull(skb, offset + sizeof(*dh))) + return -EINVAL; dh = (struct dccp_hdr *)(skb->data + offset); if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10] team: fix null-ptr-deref when team device type is changed
by Ziyang Xuan 09 Mar '24

09 Mar '24

stable inclusion from stable-v5.10.198 commit b44dd92e2afd89eb6e9d27616858e72a67bdc1a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATZ CVE: CVE-2023-52574 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 492032760127251e5540a5716a70996bacf2a3fd ] Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q] ... Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x150 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? vlan_dev_hard_header+0x35/0x140 [8021q] ? vlan_dev_hard_header+0x8e/0x140 [8021q] neigh_connected_output+0xb2/0x100 ip6_finish_output2+0x1cb/0x520 ? nf_hook_slow+0x43/0xc0 ? ip6_mtu+0x46/0x80 ip6_finish_output+0x2a/0xb0 mld_sendpack+0x18f/0x250 mld_ifc_work+0x39/0x160 process_one_work+0x1e6/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 [1] $ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}' $ ip link add name t-dummy type dummy $ ip link add link t-dummy name t-dummy.100 type vlan id 100 $ ip link add name t-nlmon type nlmon $ ip link set t-nlmon master team0 $ ip link set t-nlmon nomaster $ ip link set t-dummy up $ ip link set team0 up $ ip link set t-dummy.100 down $ ip link set t-dummy.100 master team0 When enslave a vlan device to team device and team device type is changed from non-ether to ether, header_ops of team device is changed to vlan_header_ops. That is incorrect and will trigger null-ptr-deref for vlan->real_dev in vlan_dev_hard_header() because team device is not a vlan device. Cache eth_header_ops in team_setup(), then assign cached header_ops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug. Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Suggested-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20230918123011.1884401-1-william.xuanziyang@huawe… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/team/team.c | 10 +++++++++- include/linux/if_team.h | 2 ++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 721b536ce8861..97a77dabed64c 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2122,7 +2122,12 @@ static const struct ethtool_ops team_ethtool_ops = { static void team_setup_by_port(struct net_device *dev, struct net_device *port_dev) { - dev->header_ops = port_dev->header_ops; + struct team *team = netdev_priv(dev); + + if (port_dev->type == ARPHRD_ETHER) + dev->header_ops = team->header_ops_cache; + else + dev->header_ops = port_dev->header_ops; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; dev->needed_headroom = port_dev->needed_headroom; @@ -2169,8 +2174,11 @@ static int team_dev_type_check_change(struct net_device *dev, static void team_setup(struct net_device *dev) { + struct team *team = netdev_priv(dev); + ether_setup(dev); dev->max_mtu = ETH_MAX_MTU; + team->header_ops_cache = dev->header_ops; dev->netdev_ops = &team_netdev_ops; dev->ethtool_ops = &team_ethtool_ops; diff --git a/include/linux/if_team.h b/include/linux/if_team.h index 5dd1657947b75..762c77d13e7dd 100644 --- a/include/linux/if_team.h +++ b/include/linux/if_team.h @@ -189,6 +189,8 @@ struct team { struct net_device *dev; /* associated netdevice */ struct team_pcpu_stats __percpu *pcpu_stats; + const struct header_ops *header_ops_cache; + struct mutex lock; /* used for overall locking, e.g. port lists write */ /* -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS eac3c6a044aaf481751d9f7fb4b6096ae431e167
by kernel test robot 09 Mar '24

09 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: eac3c6a044aaf481751d9f7fb4b6096ae431e167 !5046 usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear. Warning reports: https://lore.kernel.org/oe-kbuild-all/202403090244.2pF6BywY-lkp@intel.com Unverified Warning (likely false positive, please contact us if interested): drivers/tty/n_gsm.c:2067:2-8: preceding lock on line 2044 Warning ids grouped by kconfigs: clang_recent_errors |-- x86_64-randconfig-103-20240308 | `-- drivers-tty-n_gsm.c:preceding-lock-on-line `-- x86_64-randconfig-r131-20240304 |-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-flags-got-int-flags `-- kernel-sched-topology.c:sparse:sparse:incorrect-type-in-initializer-(different-base-types)-expected-int-flags-got-restricted-gfp_t elapsed time: 881m configs tested: 11 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240309 gcc arm64 randconfig-002-20240309 gcc arm64 randconfig-003-20240309 gcc arm64 randconfig-004-20240309 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15642/21783] kernel/sched/topology.c:1624:32: sparse: sparse: incorrect type in initializer (different base types)
by kernel test robot 09 Mar '24

09 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: eac3c6a044aaf481751d9f7fb4b6096ae431e167 commit: b3cf6ed8fbc01dda9fe93f5d4c1877a68d344678 [15642/21783] sched/topology: Provide cfs_overload_cpus bitmap config: x86_64-randconfig-r131-20240304 (https://download.01.org/0day-ci/archive/20240309/202403090244.2pF6BywY-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240309/202403090244.2pF6BywY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403090244.2pF6BywY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/topology.c:11:15: sparse: sparse: symbol 'sched_domains_tmpmask' was not declared. Should it be static? kernel/sched/topology.c:12:15: sparse: sparse: symbol 'sched_domains_tmpmask2' was not declared. Should it be static? >> kernel/sched/topology.c:1624:32: sparse: sparse: incorrect type in initializer (different base types) @@ expected int flags @@ got restricted gfp_t @@ kernel/sched/topology.c:1624:32: sparse: expected int flags kernel/sched/topology.c:1624:32: sparse: got restricted gfp_t >> kernel/sched/topology.c:1632:61: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted gfp_t [usertype] flags @@ got int flags @@ kernel/sched/topology.c:1632:61: sparse: expected restricted gfp_t [usertype] flags kernel/sched/topology.c:1632:61: sparse: got int flags kernel/sched/topology.c:428:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:428:9: sparse: struct sparsemask [noderef] __rcu * kernel/sched/topology.c:428:9: sparse: struct sparsemask * kernel/sched/topology.c:429:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:429:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:429:9: sparse: struct sched_domain * kernel/sched/topology.c:432:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:432:9: sparse: struct sched_domain_shared [noderef] __rcu * kernel/sched/topology.c:432:9: sparse: struct sched_domain_shared * kernel/sched/topology.c:435:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:435:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:435:9: sparse: struct sched_domain * kernel/sched/topology.c:438:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:438:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:438:9: sparse: struct sched_domain * kernel/sched/topology.c:485:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/topology.c:485:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/topology.c:485:9: sparse: struct sched_domain * kernel/sched/topology.c: note: in included file: kernel/sched/sched.h:1206:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1206:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1206:9: sparse: struct sched_domain * kernel/sched/sched.h:1219:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1219:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1219:9: sparse: struct sched_domain * kernel/sched/sched.h:1206:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:1206:9: sparse: struct sched_domain [noderef] __rcu * kernel/sched/sched.h:1206:9: sparse: struct sched_domain * In file included from kernel/sched/topology.c:5: In file included from kernel/sched/sched.h:39: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/topology.c:5: kernel/sched/sched.h:1169:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1169 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. vim +1624 kernel/sched/topology.c 1618 1619 static int sd_llc_alloc(struct sched_domain *sd) 1620 { 1621 struct sched_domain_shared *sds = sd->shared; 1622 struct cpumask *span = sched_domain_span(sd); 1623 int nid = cpu_to_node(cpumask_first(span)); > 1624 int flags = __GFP_ZERO | GFP_KERNEL; 1625 struct sparsemask *mask; 1626 1627 /* 1628 * Allocate the bitmap if not already allocated. This is called for 1629 * every CPU in the LLC but only allocates once per sd_llc_shared. 1630 */ 1631 if (!sds->cfs_overload_cpus) { > 1632 mask = sparsemask_alloc_node(nr_cpu_ids, 3, flags, nid); 1633 if (!mask) 1634 return 1; 1635 sds->cfs_overload_cpus = mask; 1636 } 1637 1638 return 0; 1639 } 1640 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION bba41c2321f7449ec0a8140042c2ba34a0bef88d
by kernel test robot 09 Mar '24

09 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: bba41c2321f7449ec0a8140042c2ba34a0bef88d !5021 LoongArch: fix some known issue and update defconfig Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-004-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-r111-20240227 | `-- kernel-sched-fair.c:sparse:sparse:symbol-qos_smt_expell_switch-was-not-declared.-Should-it-be-static |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-defconfig | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-002-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-003-20240308 | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-buildonly-randconfig-005-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-006-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-001-20240308 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-001-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-002-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-003-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-buildonly-randconfig-001-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-buildonly-randconfig-004-20240308 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- x86_64-randconfig-002-20240308 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 723m configs tested: 24 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240308 clang arm64 randconfig-002-20240308 clang arm64 randconfig-003-20240308 clang arm64 randconfig-004-20240308 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240308 gcc loongarch randconfig-002-20240308 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240308 clang x86_64 buildonly-randconfig-002-20240308 gcc x86_64 buildonly-randconfig-003-20240308 gcc x86_64 buildonly-randconfig-004-20240308 clang x86_64 buildonly-randconfig-005-20240308 gcc x86_64 buildonly-randconfig-006-20240308 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240308 gcc x86_64 randconfig-002-20240308 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.6-rc5 commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/core/neighbour.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 778be5866d0a..3f1520755282 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -855,7 +855,9 @@ static void neigh_periodic_work(struct work_struct *work) if (refcount_read(&n->refcnt) == 1 && (state == NUD_FAILED || time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); n->dead = 1; write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH OLK-6.6] dm: limit the number of targets and parameter size area
by Li Lingfeng 08 Mar '24

08 Mar '24

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit bd504bcfec41a503b32054da5472904b404341a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YCAG CVE: CVE-2024-23851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kvmalloc function fails with a warning if the size is larger than INT_MAX. The warning was triggered by a syscall testing robot. In order to avoid the warning, this commit limits the number of targets to 1048576 and the size of the parameter area to 1073741824. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-core.h | 2 ++ drivers/md/dm-ioctl.c | 3 ++- drivers/md/dm-table.c | 9 +++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h index 095b9b49aa82..e6757a30dcca 100644 --- a/drivers/md/dm-core.h +++ b/drivers/md/dm-core.h @@ -22,6 +22,8 @@ #include "dm-ima.h" #define DM_RESERVED_MAX_IOS 1024 +#define DM_MAX_TARGETS 1048576 +#define DM_MAX_TARGET_PARAMS 1024 struct dm_io; diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 5efe0193b2e8..3bda85ad73ec 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1952,7 +1952,8 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern minimum_data_size - sizeof(param_kernel->version))) return -EFAULT; - if (param_kernel->data_size < minimum_data_size) { + if (unlikely(param_kernel->data_size < minimum_data_size) || + unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) { DMERR("Invalid data size in the ioctl structure: %u", param_kernel->data_size); return -EINVAL; diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c index 37b48f63ae6a..fd84e06670e8 100644 --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -129,7 +129,12 @@ static int alloc_targets(struct dm_table *t, unsigned int num) int dm_table_create(struct dm_table **result, blk_mode_t mode, unsigned int num_targets, struct mapped_device *md) { - struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL); + struct dm_table *t; + + if (num_targets > DM_MAX_TARGETS) + return -EOVERFLOW; + + t = kzalloc(sizeof(*t), GFP_KERNEL); if (!t) return -ENOMEM; @@ -144,7 +149,7 @@ int dm_table_create(struct dm_table **result, blk_mode_t mode, if (!num_targets) { kfree(t); - return -ENOMEM; + return -EOVERFLOW; } if (alloc_targets(t, num_targets)) { -- 2.31.1

2 1

[PATCH OLK-5.10] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.198 commit 2ea52a2fb8e87067e26bbab4efb8872639240eb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd ] While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 3b642c412cf3..15267428c4f8 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -935,7 +935,9 @@ static void neigh_periodic_work(struct work_struct *work) (state == NUD_FAILED || !time_in_range_open(jiffies, n->used, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); neigh_mark_dead(n); write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: fix possible store tearing in neigh_periodic_work()
by Zhengchao Shao 08 Mar '24

08 Mar '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.6-rc5 commit 25563b581ba3a1f263a00e8c9a97f5e7363be6fd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AWK CVE: CVE-2023-52522 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/core/neighbour.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 778be5866d0a..3f1520755282 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -855,7 +855,9 @@ static void neigh_periodic_work(struct work_struct *work) if (refcount_read(&n->refcnt) == 1 && (state == NUD_FAILED || time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) { - *np = n->next; + rcu_assign_pointer(*np, + rcu_dereference_protected(n->next, + lockdep_is_held(&tbl->lock))); n->dead = 1; write_unlock(&n->lock); neigh_cleanup_and_release(n); -- 2.34.1

2 1

[PATCH OLK-6.6] erofs: fix handling kern_mount() failure
by Zizhi Wo 08 Mar '24

08 Mar '24

From: Al Viro <viro(a)zeniv.linux.org.uk> mainline inclusion from mainline-v6.8-rc6 commit 2c88c16dc20e88dd54d2f6f4d01ae1dce6cc9654 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I971F0 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- if you have a variable that holds NULL or a pointer to live struct mount, do not shove ERR_PTR() into it - not if you later treat "not NULL" as "holds a pointer to object". Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/erofs/fscache.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c index 87ff35bff8d5..1052f75d1dfa 100644 --- a/fs/erofs/fscache.c +++ b/fs/erofs/fscache.c @@ -381,11 +381,12 @@ static int erofs_fscache_init_domain(struct super_block *sb) goto out; if (!erofs_pseudo_mnt) { - erofs_pseudo_mnt = kern_mount(&erofs_fs_type); - if (IS_ERR(erofs_pseudo_mnt)) { - err = PTR_ERR(erofs_pseudo_mnt); + struct vfsmount *mnt = kern_mount(&erofs_fs_type); + if (IS_ERR(mnt)) { + err = PTR_ERR(mnt); goto out; } + erofs_pseudo_mnt = mnt; } domain->volume = sbi->volume; -- 2.39.2

2 1

[PATCH OLK-5.10] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 08 Mar '24

08 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..a9e97d8d2bad 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -78,9 +78,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,8 +170,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + /* There is no msc corresponding to the CPU */ + if (!d) continue; cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 08 Mar '24

08 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..eb7110c4ec0c 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -71,6 +71,7 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, num_partid = mpam_sysprops_num_partid(); comp = NULL; + list_for_each_entry(comp_iter, &class->components, class_list) { if (cpumask_test_cpu(cpu, &comp_iter->fw_affinity)) { comp = comp_iter; @@ -78,9 +79,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,8 +171,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + /* There is no msc corresponding to the CPU */ + if (!d) continue; cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 08 Mar '24

08 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..eb7110c4ec0c 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -71,6 +71,7 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, num_partid = mpam_sysprops_num_partid(); comp = NULL; + list_for_each_entry(comp_iter, &class->components, class_list) { if (cpumask_test_cpu(cpu, &comp_iter->fw_affinity)) { comp = comp_iter; @@ -78,9 +79,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,8 +171,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + /* There is no msc corresponding to the CPU */ + if (!d) continue; cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V3 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 08 Mar '24

08 Mar '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. The commit b0b598ee08f9 (filemap: remove use of wait bookmarks) said the overly long list of waiters on a locked page was solved by commit: 9a1ea439b16b ("mm: put_and_wait_on_page_locked() while page is migrated"). But actually the problem was solved by another commit: 3510ca20ece0 ("Minor page waitqueue cleanups"), so we can remove the bookmark flag now to solve the softlockup problem. Changes in V3: - fixed incorrect mainline patch adaptation: wake_fags -> wake_flags. - Readapt __wake_up_common_lock() Changes in V2: - modified the commit message. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 3 --- kernel/sched/wait.c | 57 ++++++-------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 8 insertions(+), 73 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] dm: limit the number of targets and parameter size area
by Li Lingfeng 08 Mar '24

08 Mar '24

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v6.8-rc3 commit bd504bcfec41a503b32054da5472904b404341a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8YCAG CVE: CVE-2024-23851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kvmalloc function fails with a warning if the size is larger than INT_MAX. The warning was triggered by a syscall testing robot. In order to avoid the warning, this commit limits the number of targets to 1048576 and the size of the parameter area to 1073741824. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Conflicts: drivers/md/dm-core.h drivers/md/dm-ioctl.c drivers/md/dm-table.c commit 91ccbbac1747 ("dm ima: measure data on table load") add "dm ima.h"; commit 8b211aaccb91 ("dm: add two stage requeue mechanism") add "struct dm_io;"; commit 249bed821b4d ("dm ioctl: Avoid double-fetch of version") delete second copy of version; commit dbdcc906d978 ("dm ioctl: log an error if the ioctl structure is corrupted") add log of error when check data_size fail; commit 05bdb9965305 ("block: replace fmode_t with a block-specific type for block open flags") change the type of mode and num_targets. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-core.h | 2 ++ drivers/md/dm-ioctl.c | 3 ++- drivers/md/dm-table.c | 9 +++++++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h index 595e87e03d43..ed7285836692 100644 --- a/drivers/md/dm-core.h +++ b/drivers/md/dm-core.h @@ -19,6 +19,8 @@ #include "dm.h" #define DM_RESERVED_MAX_IOS 1024 +#define DM_MAX_TARGETS 1048576 +#define DM_MAX_TARGET_PARAMS 1024 struct dm_kobject_holder { struct kobject kobj; diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index b95f8c4ed6e9..ea519c4fa7b3 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1771,7 +1771,8 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern if (copy_from_user(param_kernel, user, minimum_data_size)) return -EFAULT; - if (param_kernel->data_size < minimum_data_size) + if (unlikely(param_kernel->data_size < minimum_data_size) || + unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS)) return -EINVAL; secure_data = param_kernel->flags & DM_SECURE_DATA_FLAG; diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c index 78627402b5fb..eb95b5ce7b8f 100644 --- a/drivers/md/dm-table.c +++ b/drivers/md/dm-table.c @@ -144,7 +144,12 @@ static int alloc_targets(struct dm_table *t, unsigned int num) int dm_table_create(struct dm_table **result, fmode_t mode, unsigned num_targets, struct mapped_device *md) { - struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL); + struct dm_table *t; + + if (num_targets > DM_MAX_TARGETS) + return -EOVERFLOW; + + t = kzalloc(sizeof(*t), GFP_KERNEL); if (!t) return -ENOMEM; @@ -158,7 +163,7 @@ int dm_table_create(struct dm_table **result, fmode_t mode, if (!num_targets) { kfree(t); - return -ENOMEM; + return -EOVERFLOW; } if (alloc_targets(t, num_targets)) { -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS v2 0/2] CVE-2021-47074
by Li Nan 08 Mar '24

08 Mar '24

v2: add CVE tag to first patch. Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 00/77] vsva patches
by Kunkun Jiang 08 Mar '24

08 Mar '24

vsva patches Jason Gunthorpe (58): iommu/arm-smmu-v3: Make STE programming independent of the callers iommu/arm-smmu-v3: Consolidate the STE generation for abort/bypass iommu/arm-smmu-v3: Move the STE generation for S1 and S2 domains into functions iommu/arm-smmu-v3: Build the whole STE in arm_smmu_make_s2_domain_ste() iommu/arm-smmu-v3: Hold arm_smmu_asid_lock during all of attach_dev iommu/arm-smmu-v3: Compute the STE only once for each master iommu/arm-smmu-v3: Do not change the STE twice during arm_smmu_attach_dev() iommu/arm-smmu-v3: Put writing the context descriptor in the right order iommu/arm-smmu-v3: Pass smmu_domain to arm_enable/disable_ats() iommu/arm-smmu-v3: Remove arm_smmu_master->domain iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA iommu/arm-smmu-v3: Add a global static IDENTITY domain iommu/arm-smmu-v3: Add a global static BLOCKED domain iommu/arm-smmu-v3: Use the identity/blocked domain during release iommu/arm-smmu-v3: Pass arm_smmu_domain and arm_smmu_device to finalize iommu/arm-smmu-v3: Convert to domain_alloc_paging() iommu/arm-smmu-v3: Add cpu_to_le64() around STRTAB_STE_0_V iommu/arm-smmu-v3: Do not allow a SVA domain to be set on the wrong PASID iommu/arm-smmu-v3: Do not ATC invalidate the entire domain iommu/arm-smmu-v3: Add a type for the CD entry iommu/arm-smmu-v3: Add an ops indirection to the STE code iommu/arm-smmu-v3: Make CD programming use arm_smmu_write_entry() iommu/arm-smmu-v3: Consolidate clearing a CD table entry iommu/arm-smmu-v3: Move the CD generation for S1 domains into a function iommu/arm-smmu-v3: Move allocation of the cdtable into arm_smmu_get_cd_ptr() iommu/arm-smmu-v3: Allocate the CD table entry in advance iommu/arm-smmu-v3: Move the CD generation for SVA into a function iommu/arm-smmu-v3: Build the whole CD in arm_smmu_make_s1_cd() iommu/arm-smmu-v3: Start building a generic PASID layer iommu/arm-smmu-v3: Make smmu_domain->devices into an allocated list iommu/arm-smmu-v3: Make changing domains be hitless for ATS iommu/arm-smmu-v3: Add ssid to struct arm_smmu_master_domain iommu/arm-smmu-v3: Keep track of valid CD entries in the cd_table iommu/arm-smmu-v3: Thread SSID through the arm_smmu_attach_*() interface iommu/arm-smmu-v3: Make SVA allocate a normal arm_smmu_domain iommu/arm-smmu-v3: Keep track of arm_smmu_master_domain for SVA iommu: Add ops->domain_alloc_sva() iommu/arm-smmu-v3: Put the SVA mmu notifier in the smmu_domain iommu/arm-smmu-v3: Consolidate freeing the ASID/VMID iommu/arm-smmu-v3: Move the arm_smmu_asid_xa to per-smmu like vmid iommu/arm-smmu-v3: Bring back SVA BTM support iommu/arm-smmu-v3: Allow IDENTITY/BLOCKED to be set while PASID is used iommu/arm-smmu-v3: Allow a PASID to be set when RID is IDENTITY/BLOCKED iommu/arm-smmu-v3: Allow setting a S1 domain to a PASID iommu/arm-smmu-v3: Split struct arm_smmu_strtab_cfg.strtab iommu/arm-smmu-v3: Split struct arm_smmu_ctx_desc_cfg.cdtab iommu/arm-smmu-v3: Do not use devm for the cd table allocations iommu/arm-smmu-v3: Remove arm_smmu_ctx_desc & arm_smmu_s2_cfg iommu/arm-smmu-v3: Consolidate cache tag allocation iommu/arm-smmu-v3: Replace arm_smmu_tlb_inv_asid with arm_smmu_tlb_inv_all_s1 iommu/arm-smmu-v3: Create arm_smmu_tlb_inv_range_s1() iommu/arm-smmu-v3: Make arm_smmu_tlb_inv_range_s2() iommu/arm-smmu-v3: Add the limit logic to arm_smmu_tlb_inv_range_s2() vfio: Remove VFIO_TYPE1_NESTING_IOMMU iommu/arm-smmu-v3: Implement IOMMU_HWPT_ALLOC_NEST_PARENT iommu/arm-smmu-v3: Support IOMMU_DOMAIN_NESTED iommu/arm-smmu-v3: Add unit tests for arm_smmu_write_entry iommu/arm-smmu-v3: Use the new rb tree helpers Liu Yi L (2): vfio/pci: Emulate PASID/PRI capability for VFs vfio/pci: Expose PCIe PASID capability to userspace Lu Baolu (8): iommu: Add iopf domain attach/detach/replace interface iommu/sva: Use iopf domain attach/detach interface iommufd: Add fault and response message definitions iommufd: Add iommufd fault object iommufd: Associate fault object with iommufd_hw_pgtable iommufd: IOPF-capable hw page table attach/detach/replace iommufd/selftest: Add IOPF support for mock device iommufd/selftest: Add coverage for IOPF test Nicolin Chen (7): iommu/arm-smmu-v3: Support IOMMU_GET_HW_INFO via struct arm_smmu_hw_info iommu/arm-smmu-v3: Implement arm_smmu_get_msi_mapping_domain iommu/arm-smmu-v3: Add CMDQ_OP_TLBI_NH_VAA and CMDQ_OP_TLBI_NH_ALL iommu/arm-smmu-v3: Add a helper queue_ncmds iommu/arm-smmu-v3: Link user SID and physical SID iommu/arm-smmu-v3: Add arm_smmu_cache_invalidate_user Hack: iommu/arm-smmu-v3: Enable ATS for identity domains Robin Murphy (1): iommu/dma: Support MSIs through nested domains Shameer Kolothum (1): vfio/pci: Fix for wrong CAP IDs drivers/iommu/Kconfig | 12 +- drivers/iommu/arm/arm-smmu-v3/Makefile | 2 + .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 658 +++-- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c | 423 +++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2305 ++++++++++++----- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 183 +- drivers/iommu/arm/arm-smmu/arm-smmu.c | 16 - drivers/iommu/dma-iommu.c | 18 +- drivers/iommu/io-pgfault.c | 215 +- drivers/iommu/iommu-sva.c | 63 +- drivers/iommu/iommu.c | 10 - drivers/iommu/iommufd/Makefile | 1 + drivers/iommu/iommufd/device.c | 16 +- drivers/iommu/iommufd/fault.c | 391 +++ drivers/iommu/iommufd/hw_pagetable.c | 36 +- drivers/iommu/iommufd/iommufd_private.h | 41 + drivers/iommu/iommufd/iommufd_test.h | 8 + drivers/iommu/iommufd/main.c | 6 + drivers/iommu/iommufd/selftest.c | 63 + drivers/iommu/iommufd/vfio_compat.c | 7 +- drivers/vfio/pci/vfio_pci_config.c | 325 ++- drivers/vfio/vfio_iommu_type1.c | 12 +- include/linux/iommu.h | 50 +- include/uapi/linux/iommufd.h | 166 ++ include/uapi/linux/vfio.h | 2 +- tools/testing/selftests/iommu/iommufd.c | 17 + .../selftests/iommu/iommufd_fail_nth.c | 2 +- tools/testing/selftests/iommu/iommufd_utils.h | 83 +- 28 files changed, 3925 insertions(+), 1206 deletions(-) create mode 100644 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c create mode 100644 drivers/iommu/iommufd/fault.c -- 2.27.0

2 78

[openeuler:openEuler-1.0-LTS 15383/21781] fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1c33d0b3f9230be83d0a9b8b7b292861cfd72534 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [15383/21781] etmem: add etmem-scan feature config: x86_64-randconfig-r131-20240304 (https://download.01.org/0day-ci/archive/20240308/202403081509.2XWi5xzk-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403081509.2XWi5xzk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403081509.2XWi5xzk-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __user *buf @@ got void *buf @@ fs/proc/etmem_scan.c:244:18: sparse: expected void [noderef] __user *buf fs/proc/etmem_scan.c:244:18: sparse: got void *buf >> fs/proc/etmem_scan.c:1032:40: sparse: sparse: incorrect type in assignment (incompatible argument 2 (different address spaces)) @@ expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) @@ got long ( * )( ... ) @@ fs/proc/etmem_scan.c:1032:40: sparse: expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) fs/proc/etmem_scan.c:1032:40: sparse: got long ( * )( ... ) In file included from fs/proc/etmem_scan.c:2: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +244 fs/proc/etmem_scan.c 240 241 static void setup_page_idle_ctrl(struct page_idle_ctrl *pic, void *buf, 242 int buf_size, unsigned int flags) 243 { > 244 pic->buf = buf; 245 pic->buf_size = buf_size; 246 pic->bytes_copied = 0; 247 pic->next_hva = 0; 248 pic->gpa_to_hva = 0; 249 pic->restart_gpa = 0; 250 pic->last_va = 0; 251 pic->flags = flags; 252 } 253 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 08 Mar '24

08 Mar '24

From: tangyuchen <tangyuchen5(a)huawei.com> v2 -> v3 - fix compile error - bind to correct issue url v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP our recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 ++++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 173 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 378 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
by Zeng Heng 08 Mar '24

08 Mar '24

From: Vincent Pelletier <plr.vincent(a)gmail.com> mainline inclusion from mainline-v5.16-rc8 commit b1e0887379422975f237d43d8839b751a6bcf154 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I947SJ CVE: CVE-2021-46933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported): /sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb84 r6:c3a12260 r5:bf54d014 r4:c229f000 [ 1946.646273] [<bf547d74>] (ffs_fs_kill_sb [usb_f_fs]) from [<c0326d50>] (deactivate_locked_super+0x54/0x9c) [ 1946.664893] r5:bf54d014 r4:c229f000 [ 1946.672921] [<c0326cfc>] (deactivate_locked_super) from [<c0326df8>] (deactivate_super+0x60/0x64) [ 1946.690722] r5:c2a09000 r4:c229f000 [ 1946.698706] [<c0326d98>] (deactivate_super) from [<c0349a28>] (cleanup_mnt+0xe4/0x14c) [ 1946.715553] r5:c2a09000 r4:00000000 [ 1946.723528] [<c0349944>] (cleanup_mnt) from [<c0349b08>] (__cleanup_mnt+0x1c/0x20) [ 1946.739922] r7:c0dfcb84 r6:c3a12260 r5:c3a126fc r4:00000000 [ 1946.750088] [<c0349aec>] (__cleanup_mnt) from [<c0143d10>] (task_work_run+0x84/0xb8) [ 1946.766602] [<c0143c8c>] (task_work_run) from [<c010bdc8>] (do_work_pending+0x470/0x56c) [ 1946.783540] r7:5ac3c35a r6:c0d0424c r5:c200bfb0 r4:c200a000 [ 1946.793614] [<c010b958>] (do_work_pending) from [<c01000c0>] (slow_work_pending+0xc/0x20) [ 1946.810553] Exception stack(0xc200bfb0 to 0xc200bff8) [ 1946.820129] bfa0: 00000000 00000000 000000aa b5e21430 [ 1946.837104] bfc0: bef867a0 00000001 bef86840 00000034 bef86838 bef86790 bef86794 bef867a0 [ 1946.854125] bfe0: 00000000 bef86798 b67b7a1c b6d626a4 60000010 b5a23760 [ 1946.865335] r10:00000000 r9:c200a000 r8:c0100224 r7:00000034 r6:bef86840 r5:00000001 [ 1946.881914] r4:bef867a0 [ 1946.888793] ---[ end trace 7387f2a9725b28d0 ]--- Fixes: 5e33f6fdf735 ("usb: gadget: ffs: add eventfd notification about ffs events") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Vincent Pelletier <plr.vincent(a)gmail.com> Link: https://lore.kernel.org/r/f79eeea29f3f98de6782a064ec0f7351ad2f598f.16397939… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/usb/gadget/function/f_fs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 2050993fb58b..221aee81f012 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1698,11 +1698,15 @@ static void ffs_data_clear(struct ffs_data *ffs) BUG_ON(ffs->gadget); - if (ffs->epfiles) + if (ffs->epfiles) { ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); + ffs->epfiles = NULL; + } - if (ffs->ffs_eventfd) + if (ffs->ffs_eventfd) { eventfd_ctx_put(ffs->ffs_eventfd); + ffs->ffs_eventfd = NULL; + } kfree(ffs->raw_descs_data); kfree(ffs->raw_strings); @@ -1715,7 +1719,6 @@ static void ffs_data_reset(struct ffs_data *ffs) ffs_data_clear(ffs); - ffs->epfiles = NULL; ffs->raw_descs_data = NULL; ffs->raw_descs = NULL; ffs->raw_strings = NULL; -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] bugfix for pbha
by Wupeng Ma 08 Mar '24

08 Mar '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Use corrent pte val in arch_vm_get_page_prot. Use subsequent bits to improve future compatibility for pbha. Ma Wupeng (2): arm64: mm: Use corrent pte val in arch_vm_get_page_prot arm64: mm: Use subsequent bits to improve future compatibility for pbha arch/arm64/include/asm/mman.h | 2 +- arch/arm64/include/uapi/asm/mman.h | 2 +- include/linux/mm.h | 4 +++- include/uapi/asm-generic/mman-common.h | 2 +- tools/include/uapi/asm-generic/mman-common.h | 1 + 5 files changed, 7 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 08 Mar '24

08 Mar '24

v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 ++++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 173 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 378 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 08 Mar '24

08 Mar '24

v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 +++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 174 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 1acb6ad947eee3676d09c5626001d3bc1b69b9ce
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 1acb6ad947eee3676d09c5626001d3bc1b69b9ce !4990 vt: fix memory overlapping when deleting chars in the buffer elapsed time: 746m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 70c98c7d4aac402e0ad746c4312d808d7495c50b
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 70c98c7d4aac402e0ad746c4312d808d7495c50b !5004 nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() Warning reports: https://lore.kernel.org/oe-kbuild-all/202403080622.uNLahRYD-lkp@intel.com Warning ids grouped by kconfigs: clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode `-- x86_64-randconfig-121-20240307 `-- arch-x86-kernel-cpu-common.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__percpu-got-unsigned-short elapsed time: 732m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 28904/30000] arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 70c98c7d4aac402e0ad746c4312d808d7495c50b commit: f4128ae8e6ff03b4c805707fe75d0345797f7f53 [28904/30000] sched: Add cluster scheduler level for x86 config: x86_64-randconfig-121-20240307 (https://download.01.org/0day-ci/archive/20240308/202403080622.uNLahRYD-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080622.uNLahRYD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080622.uNLahRYD-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got unsigned short * @@ arch/x86/kernel/cpu/common.c:92:16: sparse: expected void const [noderef] __percpu *__vpp_verify arch/x86/kernel/cpu/common.c:92:16: sparse: got unsigned short * arch/x86/kernel/cpu/common.c:1901:1: sparse: sparse: symbol 'fixed_percpu_data' redeclared with different type (different address spaces): arch/x86/kernel/cpu/common.c:1901:1: sparse: struct fixed_percpu_data [addressable] [noderef] [toplevel] __percpu fixed_percpu_data arch/x86/kernel/cpu/common.c: note: in included file (through arch/x86/include/asm/cpufeature.h, arch/x86/include/asm/thread_info.h, include/linux/thread_bits.h, ...): arch/x86/include/asm/processor.h:470:1: sparse: note: previously declared as: arch/x86/include/asm/processor.h:470:1: sparse: struct fixed_percpu_data extern [addressable] [toplevel] fixed_percpu_data arch/x86/kernel/cpu/common.c:144:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:145:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:146:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:147:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:148:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:149:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/include/asm/processor.h:474:31: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got char ( * )[40] @@ arch/x86/include/asm/processor.h:474:31: sparse: expected void const [noderef] __percpu *__vpp_verify arch/x86/include/asm/processor.h:474:31: sparse: got char ( * )[40] vim +92 arch/x86/kernel/cpu/common.c f8b64d08dde271 Borislav Petkov 2018-04-27 89 6f01df96c462b7 Kim Phillips 2021-08-17 90 u16 get_llc_id(unsigned int cpu) 6f01df96c462b7 Kim Phillips 2021-08-17 91 { 6f01df96c462b7 Kim Phillips 2021-08-17 @92 return per_cpu(cpu_llc_id, cpu); 6f01df96c462b7 Kim Phillips 2021-08-17 93 } 6f01df96c462b7 Kim Phillips 2021-08-17 94 EXPORT_SYMBOL_GPL(get_llc_id); 6f01df96c462b7 Kim Phillips 2021-08-17 95 :::::: The code at line 92 was first introduced by commit :::::: 6f01df96c462b77915b27d404152c47e75e879cf x86/cpu: Add get_llc_id() helper function :::::: TO: Kim Phillips <kim.phillips(a)amd.com> :::::: CC: Xie Haocheng <haocheng.xie(a)amd.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 97ba28f60ba0c12d39b4d3032121317ffebc06ba
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 97ba28f60ba0c12d39b4d3032121317ffebc06ba !5024 v2 vmemmap optimize bugfix Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403080243.ondrgrmr-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403080412.gcDr9v5Q-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: expecting prototype for rnp_set_rxfh(). Prototype was for rnp_set_rxnfc() instead drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1856: warning: expecting prototype for rnp_tet_rxfh(). Prototype was for rnp_get_rxfh() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2013: warning: expecting prototype for rnp_write_eitr(). Prototype was for rnp_write_eitr_rx() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1175: warning: expecting prototype for rnp_mbx_stat_mark(). Prototype was for rnp_link_stat_mark() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:823: warning: expecting prototype for rnp_mbx_link_event_eanble(). Prototype was for rnp_mbx_link_event_enable() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1135: warning: expecting prototype for rnp_init_hw_n10(). Prototype was for rnp_init_hw_ops_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: expecting prototype for rnp_write_uc_addr_list(). Prototype was for rnp_write_uc_addr_list_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:3270: warning: expecting prototype for rnpm_device_supports_autoneg_fc(). Prototype was for rnp_device_supports_autoneg_fc() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: expecting prototype for rnp_fc_mode_n10(). Prototype was for rnp_mac_fc_mode_n10() instead Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-r111-20240227 | `-- mm-memcontrol.c:sparse:sparse:symbol-hisi_oom_recover-was-not-declared.-Should-it-be-static `-- loongarch-allmodconfig |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 740m configs tested: 10 configs skipped: 94 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3862/3876] drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 97ba28f60ba0c12d39b4d3032121317ffebc06ba commit: 455d45ae080810ae554f5e586adb9004230f9f70 [3862/3876] drivers: initial support for rnp drivers from Mucse Technology config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240308/202403080412.gcDr9v5Q-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080412.gcDr9v5Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080412.gcDr9v5Q-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_mbx_get_temp': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1105:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1105 | int err; | ^~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: At top level: drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:5: warning: no previous prototype for 'rnp_fw_reg_read' [-Wmissing-prototypes] 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_fw_reg_read': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1145:13: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1145 | int value; | ^~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_mbx_reg_write': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:602:9: warning: 'build_writereg_req' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=] 602 | build_writereg_req(&req, NULL, fw_reg, 4, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:602:9: note: referencing argument 5 of type 'int[4]' In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960, from drivers/net/ethernet/mucse/rnp/rnp.h:20, from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:799:20: note: in a call to function 'build_writereg_req' 799 | static inline void build_writereg_req(struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~ In file included from include/linux/string.h:294, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from arch/loongarch/include/asm/processor.h:9, from arch/loongarch/include/asm/thread_info.h:15, from include/linux/thread_bits.h:32, from include/linux/thread_info.h:16, from include/asm-generic/preempt.h:5, from ./arch/loongarch/include/generated/asm/preempt.h:1, from include/linux/preempt.h:79, from include/linux/spinlock.h:56, from include/linux/wait.h:9, from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:4: In function 'fortify_memcpy_chk', inlined from 'rnp_mbx_phy_read' at drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1386:3: include/linux/fortify-string.h:592:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnp/rnp_n10.c:458: warning: Function parameter or member 'sriov_flag' not described in 'rnp_eth_update_rss_key_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:1135: warning: expecting prototype for rnp_init_hw_n10(). Prototype was for rnp_init_hw_ops_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: Function parameter or member 'hw' not described in 'rnp_write_uc_addr_list_n10' drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: Function parameter or member 'sriov_flag' not described in 'rnp_write_uc_addr_list_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: expecting prototype for rnp_write_uc_addr_list(). Prototype was for rnp_write_uc_addr_list_n10() instead >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:3270: warning: expecting prototype for rnpm_device_supports_autoneg_fc(). Prototype was for rnp_device_supports_autoneg_fc() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: Function parameter or member 'mac' not described in 'rnp_mac_fc_mode_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: expecting prototype for rnp_fc_mode_n10(). Prototype was for rnp_mac_fc_mode_n10() instead -- >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:823: warning: expecting prototype for rnp_mbx_link_event_eanble(). Prototype was for rnp_mbx_link_event_enable() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value0' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value1' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value2' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value3' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1024: warning: Function parameter or member 'info' not described in 'rnp_mbx_get_capability' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1024: warning: Excess function parameter 'rnp_info' description in 'rnp_mbx_get_capability' >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1175: warning: expecting prototype for rnp_mbx_stat_mark(). Prototype was for rnp_link_stat_mark() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1414: warning: Function parameter or member 'adv' not described in 'rnp_mbx_phy_link_set' -- drivers/net/ethernet/mucse/rnp/rnp_main.c:175:6: warning: no previous prototype for 'rnp_unmap_and_free_tx_resource' [-Wmissing-prototypes] 175 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:670:5: warning: no previous prototype for 'rnp_rx_ring_reinit' [-Wmissing-prototypes] 670 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:6: warning: no previous prototype for 'rnp_write_eitr_rx' [-Wmissing-prototypes] 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:3176:6: warning: no previous prototype for 'rnp_vlan_stags_flag' [-Wmissing-prototypes] 3176 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:3580:5: warning: no previous prototype for 'rnp_xmit_nop_frame_ring' [-Wmissing-prototypes] 3580 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:4842:6: warning: no previous prototype for 'rnp_service_timer' [-Wmissing-prototypes] 4842 | void rnp_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:4950:6: warning: no previous prototype for 'rnp_service_task' [-Wmissing-prototypes] 4950 | void rnp_service_task(struct work_struct *work) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:5972:5: warning: no previous prototype for 'rnp_delete_knode' [-Wmissing-prototypes] 5972 | int rnp_delete_knode(struct net_device *dev, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6061:5: warning: no previous prototype for 'rnp_config_knode' [-Wmissing-prototypes] 6061 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6120:5: warning: no previous prototype for 'rnp_setup_tc_cls_u32' [-Wmissing-prototypes] 6120 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6197:6: warning: no previous prototype for 'rnp_do_reset' [-Wmissing-prototypes] 6197 | void rnp_do_reset(struct net_device *netdev) | ^~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6452:6: warning: no previous prototype for 'rnp_assign_netdev_ops' [-Wmissing-prototypes] 6452 | void rnp_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6628:5: warning: no previous prototype for 'rnp_can_rpu_start' [-Wmissing-prototypes] 6628 | int rnp_can_rpu_start(struct rnp_adapter *adapter) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c: In function 'rnp_request_msix_irqs': >> drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] 2402 | sizeof(q_vector->name) - 1, "%s-%s-%d-%d", | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2401:25: note: 'snprintf' output between 10 and 37 bytes into a destination of size 24 2401 | snprintf(q_vector->name, | ^~~~~~~~~~~~~~~~~~~~~~~~ 2402 | sizeof(q_vector->name) - 1, "%s-%s-%d-%d", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2403 | netdev->name, "TxRx", i, q_vector->v_idx); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Function parameter or member 'rnp_queue' not described in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Function parameter or member 'rnp_msix_vector' not described in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Excess function parameter 'queue' description in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Excess function parameter 'msix_vector' description in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:288: warning: Function parameter or member 'napi_budget' not described in 'rnp_clean_tx_irq' drivers/net/ethernet/mucse/rnp/rnp_main.c:672: warning: Function parameter or member 'adapter' not described in 'rnp_rx_ring_reinit' drivers/net/ethernet/mucse/rnp/rnp_main.c:1130: warning: Excess function parameter 'skb' description in 'rnp_is_non_eop' >> drivers/net/ethernet/mucse/rnp/rnp_main.c:2013: warning: expecting prototype for rnp_write_eitr(). Prototype was for rnp_write_eitr_rx() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Function parameter or member 'adapter' not described in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Excess function parameter 'netdev' description in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Excess function parameter 'maxrate' description in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:3779: warning: Function parameter or member 'txqueue' not described in 'rnp_tx_timeout' drivers/net/ethernet/mucse/rnp/rnp_main.c:3888: warning: Function parameter or member 'adapter' not described in 'rnp_setup_tx_resources' drivers/net/ethernet/mucse/rnp/rnp_main.c:3981: warning: Function parameter or member 'adapter' not described in 'rnp_setup_rx_resources' drivers/net/ethernet/mucse/rnp/rnp_main.c:4643: warning: Excess function parameter 'link_speed' description in 'rnp_watchdog_update_link' drivers/net/ethernet/mucse/rnp/rnp_main.c:4843: warning: Function parameter or member 't' not described in 'rnp_service_timer' drivers/net/ethernet/mucse/rnp/rnp_main.c:4843: warning: Excess function parameter 'data' description in 'rnp_service_timer' drivers/net/ethernet/mucse/rnp/rnp_main.c:5903: warning: Function parameter or member 'dev' not described in 'rnp_setup_tc' drivers/net/ethernet/mucse/rnp/rnp_main.c:5903: warning: Excess function parameter 'netdev' description in 'rnp_setup_tc' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Function parameter or member 'adapter' not described in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Function parameter or member 'subdevice_id' not described in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Excess function parameter 'hw' description in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Excess function parameter 'subdev_id' description in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:7056: warning: Function parameter or member 'id' not described in 'rnp_probe' drivers/net/ethernet/mucse/rnp/rnp_main.c:7056: warning: Excess function parameter 'ent' description in 'rnp_probe' -- drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:179: warning: Function parameter or member 'data' not described in 'rnp_reg_test' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:466: warning: Function parameter or member 'dev' not described in 'rnp_get_ts_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:466: warning: Excess function parameter 'netdev' description in 'rnp_get_ts_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:527: warning: Function parameter or member 'dev' not described in 'rnp_get_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:527: warning: Excess function parameter 'netdev' description in 'rnp_get_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:561: warning: Function parameter or member 'dev' not described in 'rnp_set_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:561: warning: Excess function parameter 'netdev' description in 'rnp_set_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:600: warning: Function parameter or member 'dev' not described in 'rnp_get_module_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:600: warning: Excess function parameter 'netdev' description in 'rnp_get_module_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:653: warning: Function parameter or member 'dev' not described in 'rnp_get_module_eeprom' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:653: warning: Excess function parameter 'netdev' description in 'rnp_get_module_eeprom' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:700: warning: Function parameter or member 'ker' not described in 'rnp_get_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:700: warning: Function parameter or member 'extack' not described in 'rnp_get_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:725: warning: Function parameter or member 'ker' not described in 'rnp_set_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:725: warning: Function parameter or member 'extack' not described in 'rnp_set_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'coal' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'kernel_coal' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'extack' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Excess function parameter 'cmd' description in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Excess function parameter 'ec' description in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Function parameter or member 'kernel_coal' not described in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Function parameter or member 'extack' not described in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Excess function parameter 'cmd' description in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: Function parameter or member 'dev' not described in 'rnp_set_rxnfc' >> drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: expecting prototype for rnp_set_rxfh(). Prototype was for rnp_set_rxnfc() instead >> drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1856: warning: expecting prototype for rnp_tet_rxfh(). Prototype was for rnp_get_rxfh() instead vim +2402 drivers/net/ethernet/mucse/rnp/rnp_main.c 2378 2379 /** 2380 * rnp_request_msix_irqs - Initialize MSI-X interrupts 2381 * @adapter: board private structure 2382 * 2383 * rnp_request_msix_irqs allocates MSI-X vectors and requests 2384 * interrupts from the kernel. 2385 **/ 2386 static int rnp_request_msix_irqs(struct rnp_adapter *adapter) 2387 { 2388 struct net_device *netdev = adapter->netdev; 2389 int err; 2390 int i = 0; 2391 2392 DPRINTK(IFUP, INFO, "[%s] num_q_vectors:%d\n", __func__, 2393 adapter->num_q_vectors); 2394 2395 for (i = 0; i < adapter->num_q_vectors; i++) { 2396 struct rnp_q_vector *q_vector = adapter->q_vector[i]; 2397 struct msix_entry *entry = 2398 &adapter->msix_entries[i + adapter->q_vector_off]; 2399 2400 if (q_vector->tx.ring && q_vector->rx.ring) { 2401 snprintf(q_vector->name, > 2402 sizeof(q_vector->name) - 1, "%s-%s-%d-%d", 2403 netdev->name, "TxRx", i, q_vector->v_idx); 2404 } else { 2405 WARN(!(q_vector->tx.ring && q_vector->rx.ring), 2406 "%s vector%d tx rx is null, v_idx:%d\n", 2407 netdev->name, i, q_vector->v_idx); 2408 /* skip this unused q_vector */ 2409 continue; 2410 } 2411 err = request_irq(entry->vector, &rnp_msix_clean_rings, 0, 2412 q_vector->name, q_vector); 2413 if (err) { 2414 e_err(probe, 2415 "%s:request_irq failed for MSIX interrupt:%d", 2416 netdev->name, entry->vector); 2417 e_err(probe, "Error: %d\n", err); 2418 goto free_queue_irqs; 2419 } 2420 /* register for affinity change notifications */ 2421 q_vector->affinity_notify.notify = rnp_irq_affinity_notify; 2422 q_vector->affinity_notify.release = 2423 rnp_irq_affinity_release; 2424 irq_set_affinity_notifier(entry->vector, 2425 &q_vector->affinity_notify); 2426 DPRINTK(IFUP, INFO, "[%s] set %s affinity_mask\n", 2427 __func__, q_vector->name); 2428 2429 irq_set_affinity_hint(entry->vector, 2430 &q_vector->affinity_mask); 2431 } 2432 2433 return 0; 2434 2435 free_queue_irqs: 2436 while (i) { 2437 i--; 2438 irq_set_affinity_hint( 2439 adapter->msix_entries[i + adapter->q_vector_off].vector, 2440 NULL); 2441 free_irq(adapter->msix_entries[i + adapter->q_vector_off].vector, 2442 adapter->q_vector[i]); 2443 irq_set_affinity_notifier( 2444 adapter->msix_entries[i + adapter->q_vector_off].vector, 2445 NULL); 2446 irq_set_affinity_hint( 2447 adapter->msix_entries[i + adapter->q_vector_off].vector, 2448 NULL); 2449 } 2450 return err; 2451 } 2452 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3862/3876] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable'
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 97ba28f60ba0c12d39b4d3032121317ffebc06ba commit: 455d45ae080810ae554f5e586adb9004230f9f70 [3862/3876] drivers: initial support for rnp drivers from Mucse Technology config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240308/202403080243.ondrgrmr-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 503c55e17037436dcd45ac69dea8967e67e3f5e8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080243.ondrgrmr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080243.ondrgrmr-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:9: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:571:18: warning: array index 0 is past the end of the array (that has type 'char[0]', cast to 'int *') [-Warray-bounds] 571 | ret = ((int *)(cookie->priv))[0]; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:60:2: note: array 'priv' declared here 60 | char priv[0]; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1105:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1105 | int err; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1145:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1145 | int value; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:5: warning: no previous prototype for function 'rnp_fw_reg_read' [-Wmissing-prototypes] 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ | static >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1519:18: warning: array index 0 is past the end of the array (that has type 'char[0]', cast to 'int *') [-Warray-bounds] 1519 | ret = ((int *)(cookie->priv))[0]; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:60:2: note: array 'priv' declared here 60 | char priv[0]; | ^ In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:4: In file included from include/linux/wait.h:9: In file included from include/linux/spinlock.h:63: In file included from include/linux/lockdep.h:14: In file included from include/linux/smp.h:13: In file included from include/linux/cpumask.h:12: In file included from include/linux/bitmap.h:11: In file included from include/linux/string.h:294: include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^ 12 warnings generated. vim +/rnp_mbx_lldp_all_ports_enable +1456 drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c 1455 > 1456 int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) 1457 { 1458 struct mbx_fw_cmd_req req; 1459 int err; 1460 1461 if (!hw->fw_lldp_ablity) 1462 return -EOPNOTSUPP; 1463 1464 memset(&req, 0, sizeof(req)); 1465 1466 build_lldp_ctrl_set(&req, LLDP_TX_ALL_LANES, enable); 1467 1468 err = rnp_mbx_write_posted_locked(hw, &req); 1469 return err; 1470 } 1471 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
by Zeng Heng 07 Mar '24

07 Mar '24

From: Vincent Pelletier <plr.vincent(a)gmail.com> mainline inclusion from mainline-v5.16-rc8 commit b1e0887379422975f237d43d8839b751a6bcf154 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96S0P CVE: CVE-2021-46933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported): /sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb84 r6:c3a12260 r5:bf54d014 r4:c229f000 [ 1946.646273] [<bf547d74>] (ffs_fs_kill_sb [usb_f_fs]) from [<c0326d50>] (deactivate_locked_super+0x54/0x9c) [ 1946.664893] r5:bf54d014 r4:c229f000 [ 1946.672921] [<c0326cfc>] (deactivate_locked_super) from [<c0326df8>] (deactivate_super+0x60/0x64) [ 1946.690722] r5:c2a09000 r4:c229f000 [ 1946.698706] [<c0326d98>] (deactivate_super) from [<c0349a28>] (cleanup_mnt+0xe4/0x14c) [ 1946.715553] r5:c2a09000 r4:00000000 [ 1946.723528] [<c0349944>] (cleanup_mnt) from [<c0349b08>] (__cleanup_mnt+0x1c/0x20) [ 1946.739922] r7:c0dfcb84 r6:c3a12260 r5:c3a126fc r4:00000000 [ 1946.750088] [<c0349aec>] (__cleanup_mnt) from [<c0143d10>] (task_work_run+0x84/0xb8) [ 1946.766602] [<c0143c8c>] (task_work_run) from [<c010bdc8>] (do_work_pending+0x470/0x56c) [ 1946.783540] r7:5ac3c35a r6:c0d0424c r5:c200bfb0 r4:c200a000 [ 1946.793614] [<c010b958>] (do_work_pending) from [<c01000c0>] (slow_work_pending+0xc/0x20) [ 1946.810553] Exception stack(0xc200bfb0 to 0xc200bff8) [ 1946.820129] bfa0: 00000000 00000000 000000aa b5e21430 [ 1946.837104] bfc0: bef867a0 00000001 bef86840 00000034 bef86838 bef86790 bef86794 bef867a0 [ 1946.854125] bfe0: 00000000 bef86798 b67b7a1c b6d626a4 60000010 b5a23760 [ 1946.865335] r10:00000000 r9:c200a000 r8:c0100224 r7:00000034 r6:bef86840 r5:00000001 [ 1946.881914] r4:bef867a0 [ 1946.888793] ---[ end trace 7387f2a9725b28d0 ]--- Fixes: 5e33f6fdf735 ("usb: gadget: ffs: add eventfd notification about ffs events") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Vincent Pelletier <plr.vincent(a)gmail.com> Link: https://lore.kernel.org/r/f79eeea29f3f98de6782a064ec0f7351ad2f598f.16397939… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/usb/gadget/function/f_fs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 2050993fb58b..221aee81f012 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1698,11 +1698,15 @@ static void ffs_data_clear(struct ffs_data *ffs) BUG_ON(ffs->gadget); - if (ffs->epfiles) + if (ffs->epfiles) { ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); + ffs->epfiles = NULL; + } - if (ffs->ffs_eventfd) + if (ffs->ffs_eventfd) { eventfd_ctx_put(ffs->ffs_eventfd); + ffs->ffs_eventfd = NULL; + } kfree(ffs->raw_descs_data); kfree(ffs->raw_strings); @@ -1715,7 +1719,6 @@ static void ffs_data_reset(struct ffs_data *ffs) ffs_data_clear(ffs); - ffs->epfiles = NULL; ffs->raw_descs_data = NULL; ffs->raw_descs = NULL; ffs->raw_strings = NULL; -- 2.25.1

2 1

[PATCH OLK-6.6 0/8] cpuset featrue
by Chen Ridong 07 Mar '24

07 Mar '24

Harshit Mogalapalli (1): cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check() Kamalesh Babulal (1): cgroup/cpuset: Fix retval in update_cpumask() Waiman Long (6): cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 cgroup/cpuset: Add cpuset.cpus.exclusive for v2 cgroup/cpuset: Introduce remote partition cgroup/cpuset: Check partition conflict with housekeeping setup cgroup/cpuset: Enable invalid to valid local partition transition cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() kernel/cgroup/cpuset.c | 1306 ++++++++++++++++++++++++++++++---------- 1 file changed, 975 insertions(+), 331 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 V3 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 07 Mar '24

07 Mar '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Changes in V3: - corrected the wrong bugzilla number in commit message. Changes in V2: - fixed incorrect mainline patch adaptation of WQ_FLAG_{CUSTOM, DONE}. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 7 ++---- kernel/sched/wait.c | 57 +++++++------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 74 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] net/sched: act_ct: fix wild memory access when clearing fragments
by Zhengchao Shao 07 Mar '24

07 Mar '24

From: Davide Caratti <dcaratti(a)redhat.com> mainline inclusion from mainline-v5.13-rc1 commit f77bd544a6bbe69aa50d9ed09f13494cf36ff806 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JMO CVE: CVE-2021-47014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS. Fixes: ae372cb1750f ("net/sched: act_ct: fix restore the qdisc_skb_cb after defrag") Fixes: 7baf2429a1a9 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support") Reported-by: Shuang Li <shuali(a)redhat.com> Signed-off-by: Davide Caratti <dcaratti(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_ct.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_ct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 2d41d866de3e..35668ce0b4a8 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -735,7 +735,8 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, #endif } - *qdisc_skb_cb(skb) = cb; + if (err != -EINPROGRESS) + *qdisc_skb_cb(skb) = cb; skb_clear_hash(skb); skb->ignore_df = 1; return err; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 07 Mar '24

07 Mar '24

From: tangyuchen <tangyuchen5(a)huawei.com> v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 +++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 174 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS V2 0/2] Fix CVE-2021-47047
by Guan Jing 07 Mar '24

07 Mar '24

fix CVE-2021-47047 Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS V1 0/2] fix dma_map_single fails
by Guan Jing 07 Mar '24

07 Mar '24

fix dma_map_single fails Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Fixed CVE-2021-47037
by Zheng Zengkai 07 Mar '24

07 Mar '24

Q6afe-clocks driver can get reprobed. For example if the APR services are restarted after the firmware crash. However currently Q6afe-clocks driver will oops because hw.init will get cleared during first _probe call. Rewrite the driver to fill the clock data at runtime rather than using big static array of clocks. This issue was identified as CVE-2021-47037. Backport patches from linux 5.13-rc1 to fix this CVE. Dmitry Baryshkov (1): ASoC: q6afe-clocks: fix reprobing of the driver Srinivas Kandagatla (1): ASoC: q6afe-clocks: fix warning on symbol scope sound/soc/qcom/qdsp6/q6afe-clocks.c | 209 ++++++++++++++-------------- sound/soc/qcom/qdsp6/q6afe.c | 2 +- sound/soc/qcom/qdsp6/q6afe.h | 2 +- 3 files changed, 108 insertions(+), 105 deletions(-) -- 2.20.1

2 3

[PATCH v2 OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS] ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
by Liu Jian 07 Mar '24

07 Mar '24

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v4.19.191 commit 25a87b1f566b5eb2af2857a928f0e2310d900976 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCD CVE: CVE-2021-46998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 643001b47adc844ae33510c4bb93c236667008a3 ] In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if some error happens, the skb will be freed by dev_kfree_skb(skb). But the freed skb is still used in skb_tx_timestamp(skb). My patch makes enic_queue_wq_skb() return error and goto spin_unlock() incase of error. The solution is provided by Govind. See https://lkml.org/lkml/2021/4/30/961. Fixes: fb7516d42478e ("enic: add sw timestamp support") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Acked-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/cisco/enic/enic_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c index 733d9172425b..f8e82bc55f0f 100644 --- a/drivers/net/ethernet/cisco/enic/enic_main.c +++ b/drivers/net/ethernet/cisco/enic/enic_main.c @@ -803,7 +803,7 @@ static inline int enic_queue_wq_skb_encap(struct enic *enic, struct vnic_wq *wq, return err; } -static inline void enic_queue_wq_skb(struct enic *enic, +static inline int enic_queue_wq_skb(struct enic *enic, struct vnic_wq *wq, struct sk_buff *skb) { unsigned int mss = skb_shinfo(skb)->gso_size; @@ -849,6 +849,7 @@ static inline void enic_queue_wq_skb(struct enic *enic, wq->to_use = buf->next; dev_kfree_skb(skb); } + return err; } /* netif_tx_lock held, process context with BHs disabled, or BH */ @@ -892,7 +893,8 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, return NETDEV_TX_BUSY; } - enic_queue_wq_skb(enic, wq, skb); + if (enic_queue_wq_skb(enic, wq, skb)) + goto error; if (vnic_wq_desc_avail(wq) < MAX_SKB_FRAGS + ENIC_DESC_MAX_SPLITS) netif_tx_stop_queue(txq); @@ -900,6 +902,7 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, if (!skb->xmit_more || netif_xmit_stopped(txq)) vnic_wq_doorbell(wq); +error: spin_unlock(&enic->wq_lock[txq_map]); return NETDEV_TX_OK; -- 2.34.1

2 1

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-22.03-LTS-SP2] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH 1/2] mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes
by Yuan Can 07 Mar '24

07 Mar '24

mainline inclusion from mainline commit 2eaa6c2abb9dd55041a05c20c451790c124d5cf0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96CYK CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- The decreasing of hugetlb pages number failed with the following message given: sh: page allocation failure: order:0, mode:0x204cc0(GFP_KERNEL|__GFP_RETRY_MAYFAIL|__GFP_THISNODE) CPU: 1 PID: 112 Comm: sh Not tainted 6.5.0-rc7-... #45 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.6+0x84/0xe4 show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x24 warn_alloc+0x100/0x1bc __alloc_pages_slowpath.constprop.107+0xa40/0xad8 __alloc_pages+0x244/0x2d0 hugetlb_vmemmap_restore+0x104/0x1e4 __update_and_free_hugetlb_folio+0x44/0x1f4 update_and_free_hugetlb_folio+0x20/0x68 update_and_free_pages_bulk+0x4c/0xac set_max_huge_pages+0x198/0x334 nr_hugepages_store_common+0x118/0x178 nr_hugepages_store+0x18/0x24 kobj_attr_store+0x18/0x2c sysfs_kf_write+0x40/0x54 kernfs_fop_write_iter+0x164/0x1dc vfs_write+0x3a8/0x460 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.1+0x6c/0xe4 do_el0_svc+0x38/0x94 el0_svc+0x28/0x74 el0t_64_sync_handler+0xa0/0xc4 el0t_64_sync+0x174/0x178 Mem-Info: ... The reason is that the hugetlb pages being released are allocated from movable nodes, and with hugetlb_optimize_vmemmap enabled, vmemmap pages need to be allocated from the same node during the hugetlb pages releasing. With GFP_KERNEL and __GFP_THISNODE set, allocating from movable node is always failed. Fix this problem by removing __GFP_THISNODE. Link: https://lkml.kernel.org/r/20230905124503.24899-1-yuancan@huawei.com Fixes: ad2fa3717b74 ("mm: hugetlb: alloc the vmemmap pages associated with each HugeTLB page") Signed-off-by: Yuan Can <yuancan(a)huawei.com> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Mike Kravetz <mike.kravetz(a)oracle.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb_vmemmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c index 90aee2cd3dab..b3bc59160003 100644 --- a/mm/hugetlb_vmemmap.c +++ b/mm/hugetlb_vmemmap.c @@ -381,7 +381,7 @@ static int vmemmap_remap_free(unsigned long start, unsigned long end, static int alloc_vmemmap_page_list(unsigned long start, unsigned long end, struct list_head *list) { - gfp_t gfp_mask = GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_THISNODE; + gfp_t gfp_mask = GFP_KERNEL | __GFP_RETRY_MAYFAIL; unsigned long nr_pages = (end - start) >> PAGE_SHIFT; int nid = page_to_nid((struct page *)start); struct page *page, *next; -- 2.17.1

1 1

[PATCH OLK-5.10] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 2644e97ceb4e48ac50ba90491e02bc6db6eec979
by kernel test robot 07 Mar '24

07 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2644e97ceb4e48ac50ba90491e02bc6db6eec979 !4925 v2 btrfs: do not ASSERT() if the newly created subvolume already got read Warning: (recently discovered and may have been fixed) drivers/net/ethernet/huawei/hinic/hinic_lld.c:956:33: warning: 'strncpy' output may be truncated copying 15 bytes from a string of length 15 [-Wstringop-truncation] Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240306 `-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 1034m configs tested: 11 configs skipped: 133 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240307 gcc arm64 randconfig-002-20240307 gcc arm64 randconfig-003-20240307 gcc arm64 randconfig-004-20240307 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f1e6c574c7e9942b39f099e93601ea84a6c4f737
by kernel test robot 07 Mar '24

07 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f1e6c574c7e9942b39f099e93601ea84a6c4f737 !4930 erofs: fix lz4 inplace decompression Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240306 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-003-20240306 | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-platform-mpam-mpam_devices.c:error:implicit-declaration-of-function-__acpi_get_mem_attribute | `-- drivers-platform-mpam-mpam_devices.c:error:incompatible-types-when-assigning-to-type-pgprot_t-from-type-int |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-001-20240306 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- loongarch-randconfig-002-20240306 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-002-20240306 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-004-20240306 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 978m configs tested: 16 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240306 gcc arm64 randconfig-002-20240306 clang arm64 randconfig-003-20240306 gcc arm64 randconfig-004-20240306 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240306 gcc loongarch randconfig-002-20240306 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46984
by Li Nan 06 Mar '24

06 Mar '24

Li Nan (1): kyber: fix kabi broken in ->bio_merge() Omar Sandoval (1): kyber: fix out of bounds access when preempted block/kyber-iosched.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47074
by Li Nan 06 Mar '24

06 Mar '24

Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/1] Fixed CVE-2023-52504
by Zheng Zengkai 06 Mar '24

06 Mar '24

Considering that CONFIG_X86_5LEVEL is enabled in openEuler-1.0-LTS, Backport 4.19.297 LTS patch to fix CVE-2023-52504. https://nvd.nist.gov/vuln/detail/CVE-2023-52504 Kirill A. Shutemov (1): x86/alternatives: Disable KASAN in apply_alternatives() arch/x86/kernel/alternative.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) -- 2.20.1

2 2

[PATCH openEuler-1.0-LTS 1/2] nvme-loop: don't put ctrl on nvme_init_ctrl error
by Li Nan 06 Mar '24

06 Mar '24

From: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> mainline inclusion from mainline-v5.10-rc1 commit 1401fcc4e3da97c44dcc7cbf538c07e24768d791 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I956G7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function nvme_init_ctrl() gets the ctrl reference & when it fails it does put the ctrl reference in the error unwind code. When creating loop ctrl in nvme_loop_create_ctrl() if nvme_init_ctrl() returns non zero (i.e. error) value it jumps to the "out_put_ctrl" label which calls nvme_put_ctrl(), that will lead to douple ctrl put in error unwind path. Update nvme_loop_create_ctrl() such that this patch removes the "out_put_ctrl" label, add a new "out" label after nvme_put_ctrl() in error unwind path and jump to newly added label when nvme_init_ctrl() call retuns an error. Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflict: Commit 64d452b3560b and b6cec06d19d9 changed context. Does not affect the logic of this patch. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/nvme/target/loop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c index 1eee21310dee..985479f10597 100644 --- a/drivers/nvme/target/loop.c +++ b/drivers/nvme/target/loop.c @@ -608,7 +608,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops, 0 /* no quirks, we're perfect! */); if (ret) - goto out_put_ctrl; + goto out; ret = -ENOMEM; @@ -661,8 +661,8 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, kfree(ctrl->queues); out_uninit_ctrl: nvme_uninit_ctrl(&ctrl->ctrl); -out_put_ctrl: nvme_put_ctrl(&ctrl->ctrl); +out: if (ret > 0) ret = -EIO; return ERR_PTR(ret); -- 2.39.2

2 2

[PATCH openEuler-1.0-LTS] soundwire: stream: fix memory leak in stream config error path
by Zhu Wang 06 Mar '24

06 Mar '24

From: Rander Wang <rander.wang(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit 48f17f96a81763c7c8bf5500460a359b9939359f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOP CVE: CVE-2021-47020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak. Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") Signed-off-by: Rander Wang <rander.wang(a)intel.com> Reviewed-by: Keyon Jie <yang.jie(a)intel.com> Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.inte… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- drivers/soundwire/stream.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 907a548645b7..42bc701e2304 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, } ret = sdw_config_stream(&slave->dev, stream, stream_config, true); - if (ret) + if (ret) { + /* + * sdw_release_master_stream will release s_rt in slave_rt_list in + * stream_error case, but s_rt is only added to slave_rt_list + * when sdw_config_stream is successful, so free s_rt explicitly + * when sdw_config_stream is failed. + */ + kfree(s_rt); goto stream_error; + } list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); -- 2.34.1

2 1