- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] ext4: dax: Fix inconsistent isize during writing
by Zhihao Cheng 27 Sep '24

27 Sep '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> Zhihao Cheng (1): ext4: dax: fix overflowing extents beyond inode size when partially writing yangerkun (1): ext4: dax: keep orphan list before truncate overflow allocated blocks fs/ext4/file.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.10-rc2 commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 4d91210e6acf..28684316bccb 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -1681,6 +1681,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1759,6 +1761,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-6.6] HID: amd_sfh: free driver_data after destroying hid device
by He Yujie 27 Sep '24

27 Sep '24

From: Olivier Sobrie <olivier(a)sobrie.be> stable inclusion from stable-v6.6.51 commit 60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97155021ae17b86985121b33cf8098bcde00d497 ] HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.219696] load_module+0x5011/0x6af0 [ 13.223096] ? kasan_save_stack+0x30/0x50 [ 13.226743] ? kasan_save_track+0x14/0x30 [ 13.230080] ? kasan_save_free_info+0x3b/0x60 [ 13.233323] ? poison_slab_object+0x109/0x180 [ 13.236778] ? __pfx_load_module+0x10/0x10 [ 13.239703] ? poison_slab_object+0x109/0x180 [ 13.243070] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.245924] ? init_module_from_file+0x13d/0x150 [ 13.248745] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.251503] ? init_module_from_file+0xdf/0x150 [ 13.254198] init_module_from_file+0xdf/0x150 [ 13.256826] ? __pfx_init_module_from_file+0x10/0x10 [ 13.259428] ? kasan_save_track+0x14/0x30 [ 13.261959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.264471] ? kasan_save_free_info+0x3b/0x60 [ 13.267026] ? poison_slab_object+0x109/0x180 [ 13.269494] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.271949] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.274324] ? _raw_spin_lock+0x85/0xe0 [ 13.276671] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.278963] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.281193] idempotent_init_module+0x23b/0x650 [ 13.283420] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.285619] ? __pfx___seccomp_filter+0x10/0x10 [ 13.287714] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.289828] ? __fget_light+0x57/0x420 [ 13.291870] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.293880] ? security_capable+0x74/0xb0 [ 13.295820] __x64_sys_finit_module+0xbe/0x130 [ 13.297874] do_syscall_64+0x82/0x190 [ 13.299898] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.301905] ? irqtime_account_irq+0x3d/0x1f0 [ 13.303877] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.305753] ? __irq_exit_rcu+0x4e/0x130 [ 13.307577] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.309489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.311371] RIP: 0033:0x7a21f96ade9d [ 13.313234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.317051] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.319024] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.321100] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.323314] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.325505] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.327637] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.329737] </TASK> [ 13.333945] Allocated by task 139: [ 13.336111] kasan_save_stack+0x30/0x50 [ 13.336121] kasan_save_track+0x14/0x30 [ 13.336125] __kasan_kmalloc+0xaa/0xb0 [ 13.336129] amdtp_hid_probe+0xb1/0x440 [amd_sfh] [ 13.336138] amd_sfh_hid_client_init+0xb8a/0x10f0 [amd_sfh] [ 13.336144] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.336150] process_one_work+0x673/0xeb0 [ 13.336155] worker_thread+0x795/0x1250 [ 13.336160] kthread+0x290/0x350 [ 13.336164] ret_from_fork+0x34/0x70 [ 13.336169] ret_from_fork_asm+0x1a/0x30 [ 13.338175] Freed by task 139: [ 13.340064] kasan_save_stack+0x30/0x50 [ 13.340072] kasan_save_track+0x14/0x30 [ 13.340076] kasan_save_free_info+0x3b/0x60 [ 13.340081] poison_slab_object+0x109/0x180 [ 13.340085] __kasan_slab_free+0x32/0x50 [ 13.340089] kfree+0xe5/0x310 [ 13.340094] amdtp_hid_remove+0xb2/0x160 [amd_sfh] [ 13.340102] amd_sfh_hid_client_deinit+0x324/0x640 [amd_sfh] [ 13.340107] amd_sfh_hid_client_init+0x94a/0x10f0 [amd_sfh] [ 13.340113] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.340118] process_one_work+0x673/0xeb0 [ 13.340123] worker_thread+0x795/0x1250 [ 13.340127] kthread+0x290/0x350 [ 13.340132] ret_from_fork+0x34/0x70 [ 13.340136] ret_from_fork_asm+0x1a/0x30 [ 13.342482] The buggy address belongs to the object at ffff88813152f400 which belongs to the cache kmalloc-64 of size 64 [ 13.347357] The buggy address is located 8 bytes inside of freed 64-byte region [ffff88813152f400, ffff88813152f440) [ 13.347367] The buggy address belongs to the physical page: [ 13.355409] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13152f [ 13.355416] anon flags: 0x2ffff8000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 13.355423] page_type: 0xffffefff(slab) [ 13.355429] raw: 02ffff8000000000 ffff8881000428c0 ffffea0004c43a00 0000000000000005 [ 13.355435] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ 13.355439] page dumped because: kasan: bad access detected [ 13.357295] Memory state around the buggy address: [ 13.357299] ffff88813152f300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357303] ffff88813152f380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357306] >ffff88813152f400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357309] ^ [ 13.357311] ffff88813152f480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.357315] ffff88813152f500: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 13.357318] ================================================================== [ 13.357405] Disabling lock debugging due to kernel taint [ 13.383534] Oops: general protection fault, probably for non-canonical address 0xe0a1bc4140000013: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 13.383544] KASAN: maybe wild-memory-access in range [0x050e020a00000098-0x050e020a0000009f] [ 13.383551] CPU: 3 PID: 479 Comm: (udev-worker) Tainted: G B 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.383561] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.383565] RIP: 0010:amd_sfh_get_report+0x81/0x530 [amd_sfh] [ 13.383580] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 78 03 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 45 8b 74 24 10 45 [ 13.383585] RSP: 0018:ffff8881261f7388 EFLAGS: 00010212 [ 13.383592] RAX: dffffc0000000000 RBX: ffff88813152f400 RCX: 0000000000000002 [ 13.383597] RDX: 00a1c04140000013 RSI: 0000000000000008 RDI: 050e020a0000009b [ 13.383600] RBP: ffff88814d010000 R08: 0000000000000002 R09: fffffbfff3ddb8c0 [ 13.383604] R10: ffffffff9eedc607 R11: ffff88810ce98000 R12: 050e020a0000008b [ 13.383607] R13: ffff88814d010000 R14: dffffc0000000000 R15: 0000000000000004 [ 13.383611] FS: 00007a21f94d0880(0000) GS:ffff8887e7d80000(0000) knlGS:0000000000000000 [ 13.383615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.383618] CR2: 00007e0014c438f0 CR3: 000000012614c000 CR4: 0000000000f50ef0 [ 13.383622] PKRU: 55555554 [ 13.383625] Call Trace: [ 13.383629] <TASK> [ 13.383632] ? __die_body.cold+0x19/0x27 [ 13.383644] ? die_addr+0x46/0x70 [ 13.383652] ? exc_general_protection+0x150/0x240 [ 13.383664] ? asm_exc_general_protection+0x26/0x30 [ 13.383674] ? amd_sfh_get_report+0x81/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383686] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383697] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383706] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383713] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.383727] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383739] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383745] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383753] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.383762] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.383768] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.383790] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383795] ? __devm_add_action+0x167/0x1d0 [ 13.383806] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383818] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383826] platform_probe+0xa2/0x150 [ 13.383832] really_probe+0x1e3/0x8a0 [ 13.383838] __driver_probe_device+0x18c/0x370 [ 13.383844] driver_probe_device+0x4a/0x120 [ 13.383851] __driver_attach+0x190/0x4a0 [ 13.383857] ? __pfx___driver_attach+0x10/0x10 [ 13.383863] bus_for_each_dev+0x106/0x180 [ 13.383868] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.383874] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.383880] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383887] bus_add_driver+0x29e/0x4d0 [ 13.383895] driver_register+0x1a5/0x360 [ 13.383902] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383910] do_one_initcall+0xa7/0x380 [ 13.383919] ? __pfx_do_one_initcall+0x10/0x10 [ 13.383927] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383933] ? kasan_unpoison+0x44/0x70 [ 13.383943] do_init_module+0x238/0x750 [ 13.383955] load_module+0x5011/0x6af0 [ 13.383962] ? kasan_save_stack+0x30/0x50 [ 13.383968] ? kasan_save_track+0x14/0x30 [ 13.383973] ? kasan_save_free_info+0x3b/0x60 [ 13.383980] ? poison_slab_object+0x109/0x180 [ 13.383993] ? __pfx_load_module+0x10/0x10 [ 13.384007] ? poison_slab_object+0x109/0x180 [ 13.384012] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384018] ? init_module_from_file+0x13d/0x150 [ 13.384025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384032] ? init_module_from_file+0xdf/0x150 [ 13.384037] init_module_from_file+0xdf/0x150 [ 13.384044] ? __pfx_init_module_from_file+0x10/0x10 [ 13.384050] ? kasan_save_track+0x14/0x30 [ 13.384055] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384060] ? kasan_save_free_info+0x3b/0x60 [ 13.384066] ? poison_slab_object+0x109/0x180 [ 13.384071] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384080] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384085] ? _raw_spin_lock+0x85/0xe0 [ 13.384091] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.384096] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.384106] idempotent_init_module+0x23b/0x650 [ 13.384114] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.384120] ? __pfx___seccomp_filter+0x10/0x10 [ 13.384129] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384135] ? __fget_light+0x57/0x420 [ 13.384142] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384147] ? security_capable+0x74/0xb0 [ 13.384157] __x64_sys_finit_module+0xbe/0x130 [ 13.384164] do_syscall_64+0x82/0x190 [ 13.384174] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384179] ? irqtime_account_irq+0x3d/0x1f0 [ 13.384188] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384193] ? __irq_exit_rcu+0x4e/0x130 [ 13.384201] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.384212] RIP: 0033:0x7a21f96ade9d [ 13.384263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.384267] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.384273] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.384277] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.384280] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.384284] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.384288] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.384297] </TASK> [ 13.384299] Modules linked in: soundwire_amd(+) hid_sensor_gyro_3d(+) hid_sensor_magn_3d hid_sensor_accel_3d soundwire_generic_allocation amdxcp hid_sensor_trigger drm_exec industrialio_triggered_buffer soundwire_bus gpu_sched kvm_amd kfifo_buf qmi_helpers joydev drm_buddy hid_sensor_iio_common mousedev snd_soc_core industrialio i2c_algo_bit mac80211 snd_compress drm_suballoc_helper kvm snd_hda_intel drm_ttm_helper ac97_bus snd_pcm_dmaengine snd_intel_dspcfg ttm thinkpad_acpi(+) snd_intel_sdw_acpi hid_sensor_hub snd_rpl_pci_acp6x drm_display_helper snd_hda_codec hid_multitouch libarc4 snd_acp_pci platform_profile think_lmi(+) hid_generic firmware_attributes_class wmi_bmof cec snd_acp_legacy_common sparse_keymap rapl snd_hda_core psmouse cfg80211 pcspkr snd_pci_acp6x snd_hwdep video snd_pcm snd_pci_acp5x snd_timer snd_rn_pci_acp3x ucsi_acpi snd_acp_config snd sp5100_tco rfkill snd_soc_acpi typec_ucsi thunderbolt amd_sfh k10temp mhi soundcore i2c_piix4 snd_pci_acp3x typec i2c_hid_acpi roles i2c_hid wmi acpi_tad amd_pmc [ 13.384454] mac_hid i2c_dev crypto_user loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel serio_raw sha512_ssse3 atkbd sha256_ssse3 libps2 sha1_ssse3 vivaldi_fmap nvme aesni_intel crypto_simd nvme_core cryptd ccp xhci_pci i8042 nvme_auth xhci_pci_renesas serio vfat fat btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq [ 13.384552] ---[ end trace 0000000000000000 ]--- KASAN reports a use-after-free of hid->driver_data in function amd_sfh_get_report(). The backtrace indicates that the function is called by amdtp_hid_request() which is one of the callbacks of hid device. The current make sure that driver_data is freed only once hid_destroy_device() returned. Note that I observed the crash both on v6.9.9 and v6.10.0. The code seems to be as it was from the early days of the driver. Signed-off-by: Olivier Sobrie <olivier(a)sobrie.be> Acked-by: Basavaraj Natikar <Basavaraj.Natikar(a)amd.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c index 705b52337068..81f3024b7b1b 100644 --- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c +++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c @@ -171,11 +171,13 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) void amdtp_hid_remove(struct amdtp_cl_data *cli_data) { int i; + struct amdtp_hid_data *hid_data; for (i = 0; i < cli_data->num_hid_devices; ++i) { if (cli_data->hid_sensor_hubs[i]) { - kfree(cli_data->hid_sensor_hubs[i]->driver_data); + hid_data = cli_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(cli_data->hid_sensor_hubs[i]); + kfree(hid_data); cli_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: unset the binding mark of a reused connection
by Long Li 27 Sep '24

27 Sep '24

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v5.15.166 commit 9914f1bd61d5e838bb1ab15a71076d37a6db65d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWIK CVE: CVE-2024-46795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 78c5a6f1f630172b19af4912e755e1da93ef0ab5 ] Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding session, conn->binding can still remain true and generate_preauth_hash() will not set sess->Preauth_HashValue and it will be NULL. It is used as a material to create an encryption key in ksmbd_gen_smb311_encryptionkey. ->Preauth_HashValue cause null pointer dereference error from crypto_shash_update(). BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 8 PID: 429254 Comm: kworker/8:39 Hardware name: LENOVO 20MAS08500/20MAS08500, BIOS N2CET69W (1.52 ) Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] RIP: 0010:lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] <TASK> ? show_regs+0x6d/0x80 ? __die+0x24/0x80 ? page_fault_oops+0x99/0x1b0 ? do_user_addr_fault+0x2ee/0x6b0 ? exc_page_fault+0x83/0x1b0 ? asm_exc_page_fault+0x27/0x30 ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? lib_sha256_base_do_update.isra.0+0x11e/0x1d0 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] ? __pfx_sha256_transform_rorx+0x10/0x10 [sha256_ssse3] _sha256_update+0x77/0xa0 [sha256_ssse3] sha256_avx2_update+0x15/0x30 [sha256_ssse3] crypto_shash_update+0x1e/0x40 hmac_update+0x12/0x20 crypto_shash_update+0x1e/0x40 generate_key+0x234/0x380 [ksmbd] generate_smb3encryptionkey+0x40/0x1c0 [ksmbd] ksmbd_gen_smb311_encryptionkey+0x72/0xa0 [ksmbd] ntlm_authenticate.isra.0+0x423/0x5d0 [ksmbd] smb2_sess_setup+0x952/0xaa0 [ksmbd] __process_request+0xa3/0x1d0 [ksmbd] __handle_ksmbd_work+0x1c4/0x2f0 [ksmbd] handle_ksmbd_work+0x2d/0xa0 [ksmbd] process_one_work+0x16c/0x350 worker_thread+0x306/0x440 ? __pfx_worker_thread+0x10/0x10 kthread+0xef/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x44/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: f5a544e3bab7 ("ksmbd: add support for SMB3 multichannel") Cc: stable(a)vger.kernel.org # v5.15+ Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 50ef53115cab..f4aeca5e7e57 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1704,6 +1704,8 @@ int smb2_sess_setup(struct ksmbd_work *work) rc = ksmbd_session_register(conn, sess); if (rc) goto out_err; + + conn->binding = false; } else if (conn->dialect >= SMB30_PROT_ID && (server_conf.flags & KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL) && req->Flags & SMB2_SESSION_REQ_FLAG_BINDING) { @@ -1782,6 +1784,8 @@ int smb2_sess_setup(struct ksmbd_work *work) sess = NULL; goto out_err; } + + conn->binding = false; } work->sess = sess; -- 2.39.2

2 1

[PATCH OLK-6.6] HID: amd_sfh: free driver_data after destroying hid device
by He Yujie 27 Sep '24

27 Sep '24

From: Olivier Sobrie <olivier(a)sobrie.be> stable inclusion from stable-v6.6.51 commit 60dc4ee0428d70bcbb41436b6729d29f1cbdfb89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S?from=project-issue CVE: CVE-2024-46746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 97155021ae17b86985121b33cf8098bcde00d497 ] HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.136455] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.140197] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.143602] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.147234] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.150446] ? __devm_add_action+0x167/0x1d0 [ 13.155061] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.158581] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.161814] platform_probe+0xa2/0x150 [ 13.165029] really_probe+0x1e3/0x8a0 [ 13.168243] __driver_probe_device+0x18c/0x370 [ 13.171500] driver_probe_device+0x4a/0x120 [ 13.175000] __driver_attach+0x190/0x4a0 [ 13.178521] ? __pfx___driver_attach+0x10/0x10 [ 13.181771] bus_for_each_dev+0x106/0x180 [ 13.185033] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.188229] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.191446] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.194382] bus_add_driver+0x29e/0x4d0 [ 13.197328] driver_register+0x1a5/0x360 [ 13.200283] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.203362] do_one_initcall+0xa7/0x380 [ 13.206432] ? __pfx_do_one_initcall+0x10/0x10 [ 13.210175] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.213211] ? kasan_unpoison+0x44/0x70 [ 13.216688] do_init_module+0x238/0x750 [ 13.219696] load_module+0x5011/0x6af0 [ 13.223096] ? kasan_save_stack+0x30/0x50 [ 13.226743] ? kasan_save_track+0x14/0x30 [ 13.230080] ? kasan_save_free_info+0x3b/0x60 [ 13.233323] ? poison_slab_object+0x109/0x180 [ 13.236778] ? __pfx_load_module+0x10/0x10 [ 13.239703] ? poison_slab_object+0x109/0x180 [ 13.243070] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.245924] ? init_module_from_file+0x13d/0x150 [ 13.248745] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.251503] ? init_module_from_file+0xdf/0x150 [ 13.254198] init_module_from_file+0xdf/0x150 [ 13.256826] ? __pfx_init_module_from_file+0x10/0x10 [ 13.259428] ? kasan_save_track+0x14/0x30 [ 13.261959] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.264471] ? kasan_save_free_info+0x3b/0x60 [ 13.267026] ? poison_slab_object+0x109/0x180 [ 13.269494] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.271949] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.274324] ? _raw_spin_lock+0x85/0xe0 [ 13.276671] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.278963] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.281193] idempotent_init_module+0x23b/0x650 [ 13.283420] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.285619] ? __pfx___seccomp_filter+0x10/0x10 [ 13.287714] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.289828] ? __fget_light+0x57/0x420 [ 13.291870] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.293880] ? security_capable+0x74/0xb0 [ 13.295820] __x64_sys_finit_module+0xbe/0x130 [ 13.297874] do_syscall_64+0x82/0x190 [ 13.299898] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.301905] ? irqtime_account_irq+0x3d/0x1f0 [ 13.303877] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.305753] ? __irq_exit_rcu+0x4e/0x130 [ 13.307577] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.309489] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.311371] RIP: 0033:0x7a21f96ade9d [ 13.313234] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.317051] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.319024] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.321100] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.323314] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.325505] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.327637] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.329737] </TASK> [ 13.333945] Allocated by task 139: [ 13.336111] kasan_save_stack+0x30/0x50 [ 13.336121] kasan_save_track+0x14/0x30 [ 13.336125] __kasan_kmalloc+0xaa/0xb0 [ 13.336129] amdtp_hid_probe+0xb1/0x440 [amd_sfh] [ 13.336138] amd_sfh_hid_client_init+0xb8a/0x10f0 [amd_sfh] [ 13.336144] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.336150] process_one_work+0x673/0xeb0 [ 13.336155] worker_thread+0x795/0x1250 [ 13.336160] kthread+0x290/0x350 [ 13.336164] ret_from_fork+0x34/0x70 [ 13.336169] ret_from_fork_asm+0x1a/0x30 [ 13.338175] Freed by task 139: [ 13.340064] kasan_save_stack+0x30/0x50 [ 13.340072] kasan_save_track+0x14/0x30 [ 13.340076] kasan_save_free_info+0x3b/0x60 [ 13.340081] poison_slab_object+0x109/0x180 [ 13.340085] __kasan_slab_free+0x32/0x50 [ 13.340089] kfree+0xe5/0x310 [ 13.340094] amdtp_hid_remove+0xb2/0x160 [amd_sfh] [ 13.340102] amd_sfh_hid_client_deinit+0x324/0x640 [amd_sfh] [ 13.340107] amd_sfh_hid_client_init+0x94a/0x10f0 [amd_sfh] [ 13.340113] sfh_init_work+0x47/0x120 [amd_sfh] [ 13.340118] process_one_work+0x673/0xeb0 [ 13.340123] worker_thread+0x795/0x1250 [ 13.340127] kthread+0x290/0x350 [ 13.340132] ret_from_fork+0x34/0x70 [ 13.340136] ret_from_fork_asm+0x1a/0x30 [ 13.342482] The buggy address belongs to the object at ffff88813152f400 which belongs to the cache kmalloc-64 of size 64 [ 13.347357] The buggy address is located 8 bytes inside of freed 64-byte region [ffff88813152f400, ffff88813152f440) [ 13.347367] The buggy address belongs to the physical page: [ 13.355409] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13152f [ 13.355416] anon flags: 0x2ffff8000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 13.355423] page_type: 0xffffefff(slab) [ 13.355429] raw: 02ffff8000000000 ffff8881000428c0 ffffea0004c43a00 0000000000000005 [ 13.355435] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 [ 13.355439] page dumped because: kasan: bad access detected [ 13.357295] Memory state around the buggy address: [ 13.357299] ffff88813152f300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357303] ffff88813152f380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357306] >ffff88813152f400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 13.357309] ^ [ 13.357311] ffff88813152f480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 13.357315] ffff88813152f500: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc [ 13.357318] ================================================================== [ 13.357405] Disabling lock debugging due to kernel taint [ 13.383534] Oops: general protection fault, probably for non-canonical address 0xe0a1bc4140000013: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 13.383544] KASAN: maybe wild-memory-access in range [0x050e020a00000098-0x050e020a0000009f] [ 13.383551] CPU: 3 PID: 479 Comm: (udev-worker) Tainted: G B 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.383561] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.383565] RIP: 0010:amd_sfh_get_report+0x81/0x530 [amd_sfh] [ 13.383580] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 78 03 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 63 08 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 1a 03 00 00 45 8b 74 24 10 45 [ 13.383585] RSP: 0018:ffff8881261f7388 EFLAGS: 00010212 [ 13.383592] RAX: dffffc0000000000 RBX: ffff88813152f400 RCX: 0000000000000002 [ 13.383597] RDX: 00a1c04140000013 RSI: 0000000000000008 RDI: 050e020a0000009b [ 13.383600] RBP: ffff88814d010000 R08: 0000000000000002 R09: fffffbfff3ddb8c0 [ 13.383604] R10: ffffffff9eedc607 R11: ffff88810ce98000 R12: 050e020a0000008b [ 13.383607] R13: ffff88814d010000 R14: dffffc0000000000 R15: 0000000000000004 [ 13.383611] FS: 00007a21f94d0880(0000) GS:ffff8887e7d80000(0000) knlGS:0000000000000000 [ 13.383615] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 13.383618] CR2: 00007e0014c438f0 CR3: 000000012614c000 CR4: 0000000000f50ef0 [ 13.383622] PKRU: 55555554 [ 13.383625] Call Trace: [ 13.383629] <TASK> [ 13.383632] ? __die_body.cold+0x19/0x27 [ 13.383644] ? die_addr+0x46/0x70 [ 13.383652] ? exc_general_protection+0x150/0x240 [ 13.383664] ? asm_exc_general_protection+0x26/0x30 [ 13.383674] ? amd_sfh_get_report+0x81/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383686] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383697] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.383706] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383713] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.383727] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383739] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383745] ? __pfx_hid_sensor_parse_common_attributes+0x10/0x10 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.383753] ? _raw_spin_lock_irqsave+0x96/0xf0 [ 13.383762] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.383768] ? devm_iio_device_alloc+0x34/0x50 [industrialio 3d261d5e5765625d2b052be40e526d62b1d2123b] [ 13.383790] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383795] ? __devm_add_action+0x167/0x1d0 [ 13.383806] hid_gyro_3d_probe+0x120/0x7f0 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383818] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383826] platform_probe+0xa2/0x150 [ 13.383832] really_probe+0x1e3/0x8a0 [ 13.383838] __driver_probe_device+0x18c/0x370 [ 13.383844] driver_probe_device+0x4a/0x120 [ 13.383851] __driver_attach+0x190/0x4a0 [ 13.383857] ? __pfx___driver_attach+0x10/0x10 [ 13.383863] bus_for_each_dev+0x106/0x180 [ 13.383868] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.383874] ? __pfx_bus_for_each_dev+0x10/0x10 [ 13.383880] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383887] bus_add_driver+0x29e/0x4d0 [ 13.383895] driver_register+0x1a5/0x360 [ 13.383902] ? __pfx_hid_gyro_3d_platform_driver_init+0x10/0x10 [hid_sensor_gyro_3d 63da36a143b775846ab2dbb86c343b401b5e3172] [ 13.383910] do_one_initcall+0xa7/0x380 [ 13.383919] ? __pfx_do_one_initcall+0x10/0x10 [ 13.383927] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.383933] ? kasan_unpoison+0x44/0x70 [ 13.383943] do_init_module+0x238/0x750 [ 13.383955] load_module+0x5011/0x6af0 [ 13.383962] ? kasan_save_stack+0x30/0x50 [ 13.383968] ? kasan_save_track+0x14/0x30 [ 13.383973] ? kasan_save_free_info+0x3b/0x60 [ 13.383980] ? poison_slab_object+0x109/0x180 [ 13.383993] ? __pfx_load_module+0x10/0x10 [ 13.384007] ? poison_slab_object+0x109/0x180 [ 13.384012] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384018] ? init_module_from_file+0x13d/0x150 [ 13.384025] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384032] ? init_module_from_file+0xdf/0x150 [ 13.384037] init_module_from_file+0xdf/0x150 [ 13.384044] ? __pfx_init_module_from_file+0x10/0x10 [ 13.384050] ? kasan_save_track+0x14/0x30 [ 13.384055] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384060] ? kasan_save_free_info+0x3b/0x60 [ 13.384066] ? poison_slab_object+0x109/0x180 [ 13.384071] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384080] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384085] ? _raw_spin_lock+0x85/0xe0 [ 13.384091] ? __pfx__raw_spin_lock+0x10/0x10 [ 13.384096] ? __rseq_handle_notify_resume+0x1a6/0xad0 [ 13.384106] idempotent_init_module+0x23b/0x650 [ 13.384114] ? __pfx_idempotent_init_module+0x10/0x10 [ 13.384120] ? __pfx___seccomp_filter+0x10/0x10 [ 13.384129] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384135] ? __fget_light+0x57/0x420 [ 13.384142] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384147] ? security_capable+0x74/0xb0 [ 13.384157] __x64_sys_finit_module+0xbe/0x130 [ 13.384164] do_syscall_64+0x82/0x190 [ 13.384174] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384179] ? irqtime_account_irq+0x3d/0x1f0 [ 13.384188] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384193] ? __irq_exit_rcu+0x4e/0x130 [ 13.384201] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.384206] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 13.384212] RIP: 0033:0x7a21f96ade9d [ 13.384263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 63 de 0c 00 f7 d8 64 89 01 48 [ 13.384267] RSP: 002b:00007ffeae934e78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 13.384273] RAX: ffffffffffffffda RBX: 00005987276bfcf0 RCX: 00007a21f96ade9d [ 13.384277] RDX: 0000000000000004 RSI: 00007a21f8eda376 RDI: 000000000000001c [ 13.384280] RBP: 00007a21f8eda376 R08: 0000000000000001 R09: 00007ffeae934ec0 [ 13.384284] R10: 0000000000000050 R11: 0000000000000246 R12: 0000000000020000 [ 13.384288] R13: 00005987276c1250 R14: 0000000000000000 R15: 00005987276c4530 [ 13.384297] </TASK> [ 13.384299] Modules linked in: soundwire_amd(+) hid_sensor_gyro_3d(+) hid_sensor_magn_3d hid_sensor_accel_3d soundwire_generic_allocation amdxcp hid_sensor_trigger drm_exec industrialio_triggered_buffer soundwire_bus gpu_sched kvm_amd kfifo_buf qmi_helpers joydev drm_buddy hid_sensor_iio_common mousedev snd_soc_core industrialio i2c_algo_bit mac80211 snd_compress drm_suballoc_helper kvm snd_hda_intel drm_ttm_helper ac97_bus snd_pcm_dmaengine snd_intel_dspcfg ttm thinkpad_acpi(+) snd_intel_sdw_acpi hid_sensor_hub snd_rpl_pci_acp6x drm_display_helper snd_hda_codec hid_multitouch libarc4 snd_acp_pci platform_profile think_lmi(+) hid_generic firmware_attributes_class wmi_bmof cec snd_acp_legacy_common sparse_keymap rapl snd_hda_core psmouse cfg80211 pcspkr snd_pci_acp6x snd_hwdep video snd_pcm snd_pci_acp5x snd_timer snd_rn_pci_acp3x ucsi_acpi snd_acp_config snd sp5100_tco rfkill snd_soc_acpi typec_ucsi thunderbolt amd_sfh k10temp mhi soundcore i2c_piix4 snd_pci_acp3x typec i2c_hid_acpi roles i2c_hid wmi acpi_tad amd_pmc [ 13.384454] mac_hid i2c_dev crypto_user loop nfnetlink zram ip_tables x_tables dm_crypt cbc encrypted_keys trusted asn1_encoder tee dm_mod crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic gf128mul ghash_clmulni_intel serio_raw sha512_ssse3 atkbd sha256_ssse3 libps2 sha1_ssse3 vivaldi_fmap nvme aesni_intel crypto_simd nvme_core cryptd ccp xhci_pci i8042 nvme_auth xhci_pci_renesas serio vfat fat btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq [ 13.384552] ---[ end trace 0000000000000000 ]--- KASAN reports a use-after-free of hid->driver_data in function amd_sfh_get_report(). The backtrace indicates that the function is called by amdtp_hid_request() which is one of the callbacks of hid device. The current make sure that driver_data is freed only once hid_destroy_device() returned. Note that I observed the crash both on v6.9.9 and v6.10.0. The code seems to be as it was from the early days of the driver. Signed-off-by: Olivier Sobrie <olivier(a)sobrie.be> Acked-by: Basavaraj Natikar <Basavaraj.Natikar(a)amd.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/hid/amd-sfh-hid/amd_sfh_hid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c index 705b52337068..81f3024b7b1b 100644 --- a/drivers/hid/amd-sfh-hid/amd_sfh_hid.c +++ b/drivers/hid/amd-sfh-hid/amd_sfh_hid.c @@ -171,11 +171,13 @@ int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data) void amdtp_hid_remove(struct amdtp_cl_data *cli_data) { int i; + struct amdtp_hid_data *hid_data; for (i = 0; i < cli_data->num_hid_devices; ++i) { if (cli_data->hid_sensor_hubs[i]) { - kfree(cli_data->hid_sensor_hubs[i]->driver_data); + hid_data = cli_data->hid_sensor_hubs[i]->driver_data; hid_destroy_device(cli_data->hid_sensor_hubs[i]); + kfree(hid_data); cli_data->hid_sensor_hubs[i] = NULL; } } -- 2.34.1

2 1

[openeuler:OLK-6.6 11427/14193] loongarch64-linux-ld: rpm-traces.c:undefined reference to `__trace_trigger_soft_disabled'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 515984f18a6f359887b37e95ef5a785b04ae2da7 commit: d14435b8c5cdcdadede980b086f439a7d6747d0c [11427/14193] LoongArch: Fix callchain parse error with kernel tracepoint events again config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271347.SHAKNDVo-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271347.SHAKNDVo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271347.SHAKNDVo-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L572': power-traces.c:(.text+0x359c): undefined reference to `trace_event_printf' loongarch64-linux-ld: power-traces.c:(.text+0x35c0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L580': power-traces.c:(.text+0x3678): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L581': power-traces.c:(.text+0x36ac): undefined reference to `trace_output_call' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L587': power-traces.c:(.text+0x3788): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_raw_output_pm_qos_update': power-traces.c:(.text+0x37dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L100011': power-traces.c:(.text+0x39d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L606': power-traces.c:(.text+0x3a3c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_wakeup_source': power-traces.c:(.text+0x3ae8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L615': power-traces.c:(.text+0x3b84): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L613': power-traces.c:(.text+0x3c0c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L638': power-traces.c:(.text+0x3f10): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L654': power-traces.c:(.text+0x3fcc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L659': power-traces.c:(.text+0x40a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L667': power-traces.c:(.text+0x414c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L678': power-traces.c:(.text+0x4230): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L697': power-traces.c:(.text+0x43f4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L690': power-traces.c:(.text+0x4420): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: power-traces.c:(.text+0x4474): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L708': power-traces.c:(.text+0x44c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x258): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x280): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2a0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2c8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x2e8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x310): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x330): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x358): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x378): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3a0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3c0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x3e8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x408): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/power-traces.o:(.ref.data+0x430): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_raw_output_rpm_internal': rpm-traces.c:(.text+0x2a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L49': rpm-traces.c:(.text+0x338): undefined reference to `trace_event_printf' loongarch64-linux-ld: rpm-traces.c:(.text+0x358): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_raw_output_rpm_return_int': rpm-traces.c:(.text+0x384): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: rpm-traces.c:(.text+0x3dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L55': rpm-traces.c:(.text+0x3fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L59': rpm-traces.c:(.text+0x4bc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L62': rpm-traces.c:(.text+0x514): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `perf_trace_rpm_internal': rpm-traces.c:(.text+0x694): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L83': rpm-traces.c:(.text+0x734): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L96': rpm-traces.c:(.text+0x8a4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_event_raw_event_rpm_return_int': rpm-traces.c:(.text+0x8d4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L118': rpm-traces.c:(.text+0x95c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L101': rpm-traces.c:(.text+0x9c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L117': rpm-traces.c:(.text+0xa5c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `trace_event_raw_event_rpm_internal': rpm-traces.c:(.text+0xad4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/rpm-traces.o: in function `.L130': rpm-traces.c:(.text+0xb5c): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: rpm-traces.c:(.text+0xba8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/rpm-traces.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rseq.o: in function `perf_trace_rseq_update': rseq.c:(.text+0x3d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/rseq.o: in function `.L34': rseq.c:(.text+0x430): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/rseq.o: in function `perf_trace_rseq_ip_fixup': rseq.c:(.text+0x52c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/rseq.o: in function `.L46': rseq.c:(.text+0x568): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/rseq.o: in function `trace_event_raw_event_rseq_update': rseq.c:(.text+0x650): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/rseq.o: in function `.L61': rseq.c:(.text+0x690): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/rseq.o: in function `.L57': rseq.c:(.text+0x6e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/rseq.o: in function `trace_event_raw_event_rseq_ip_fixup': rseq.c:(.text+0x770): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: rseq.c:(.text+0x78c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/rseq.o: in function `.L68': rseq.c:(.text+0x7e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: rseq.c:(.text+0x81c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rseq.o: in function `trace_raw_output_rseq_update': rseq.c:(.text+0x878): undefined reference to `trace_event_printf' loongarch64-linux-ld: rseq.c:(.text+0x898): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rseq.o: in function `.L84': rseq.c:(.text+0x8c4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rseq.o: in function `trace_raw_output_rseq_ip_fixup': rseq.c:(.text+0x91c): undefined reference to `trace_event_printf' loongarch64-linux-ld: rseq.c:(.text+0x93c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rseq.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_mm_filemap_op_page_cache': filemap.c:(.text+0x2ac): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L54': filemap.c:(.text+0x390): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_filemap_set_wb_err': filemap.c:(.text+0x494): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L68': filemap.c:(.text+0x4e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `perf_trace_file_check_and_advance_wb_err': filemap.c:(.text+0x5d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/filemap.o: in function `.L82': filemap.c:(.text+0x638): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/filemap.o: in function `.L94': filemap.c:(.text+0x720): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `.L99': filemap.c:(.text+0x7e4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L95': filemap.c:(.text+0x86c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L96': filemap.c:(.text+0x8e8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `trace_event_raw_event_filemap_set_wb_err': filemap.c:(.text+0x918): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L115': filemap.c:(.text+0x988): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L116': filemap.c:(.text+0x9f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/filemap.o: in function `trace_event_raw_event_file_check_and_advance_wb_err': filemap.c:(.text+0xa40): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/filemap.o: in function `.L128': filemap.c:(.text+0xaac): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/filemap.o: in function `.L124': filemap.c:(.text+0xae4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_mm_filemap_op_page_cache': filemap.c:(.text+0xb6c): undefined reference to `trace_event_printf' loongarch64-linux-ld: filemap.c:(.text+0xb8c): undefined reference to `trace_handle_return' loongarch64-linux-ld: filemap.c:(.text+0xbb4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `.L142': filemap.c:(.text+0xc20): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_filemap_set_wb_err': filemap.c:(.text+0xc40): undefined reference to `trace_handle_return' loongarch64-linux-ld: filemap.c:(.text+0xc6c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/filemap.o: in function `.L148': filemap.c:(.text+0xce8): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/filemap.o: in function `trace_raw_output_file_check_and_advance_wb_err': filemap.c:(.text+0xd08): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/filemap.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_oom_score_adj_update': oom_kill.c:(.text+0x4a0): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L83': oom_kill.c:(.text+0x4fc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L82': oom_kill.c:(.text+0x578): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_reclaim_retry_zone': oom_kill.c:(.text+0x66c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L85': oom_kill.c:(.text+0x6c4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_mark_victim': oom_kill.c:(.text+0x7b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L97': oom_kill.c:(.text+0x7e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_wake_reaper': oom_kill.c:(.text+0x8b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L109': oom_kill.c:(.text+0x8e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_start_task_reaping': oom_kill.c:(.text+0x9b4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/oom_kill.o: in function `.L121': oom_kill.c:(.text+0x9e4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_finish_task_reaping': oom_kill.c:(.text+0xab4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xae4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_skip_task_reaping': oom_kill.c:(.text+0xbb4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xbe4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `perf_trace_compact_retry': oom_kill.c:(.text+0xcdc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: oom_kill.c:(.text+0xd38): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L156': oom_kill.c:(.text+0xe0c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_oom_score_adj_update': oom_kill.c:(.text+0xe40): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L175': oom_kill.c:(.text+0xe8c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_reclaim_retry_zone': oom_kill.c:(.text+0xf30): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0xf6c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L187': oom_kill.c:(.text+0xfe8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L183': oom_kill.c:(.text+0x1058): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x1068): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_mark_victim': oom_kill.c:(.text+0x10a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L194': oom_kill.c:(.text+0x1118): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x1128): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_wake_reaper': oom_kill.c:(.text+0x1168): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L205': oom_kill.c:(.text+0x11d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: oom_kill.c:(.text+0x11e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L206': oom_kill.c:(.text+0x1228): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L220': oom_kill.c:(.text+0x1298): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L216': oom_kill.c:(.text+0x12a8): undefined reference to `trace_event_buffer_commit' >> loongarch64-linux-ld: oom_kill.c:(.text+0x12e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_finish_task_reaping': oom_kill.c:(.text+0x1358): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L231': oom_kill.c:(.text+0x1368): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `.L227': oom_kill.c:(.text+0x13a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/oom_kill.o: in function `.L242': oom_kill.c:(.text+0x1438): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/oom_kill.o: in function `.L238': oom_kill.c:(.text+0x1474): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_event_raw_event_compact_retry': oom_kill.c:(.text+0x14ec): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: oom_kill.c:(.text+0x1524): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L249': oom_kill.c:(.text+0x1578): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1598): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x15c4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_oom_score_adj_update': oom_kill.c:(.text+0x1610): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1630): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x165c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_mark_victim': oom_kill.c:(.text+0x16b0): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x16d0): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x16fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_wake_reaper': oom_kill.c:(.text+0x1750): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1770): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x179c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L280': oom_kill.c:(.text+0x17f0): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_start_task_reaping': oom_kill.c:(.text+0x1810): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x183c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L286': oom_kill.c:(.text+0x1890): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_finish_task_reaping': oom_kill.c:(.text+0x18b0): undefined reference to `trace_handle_return' loongarch64-linux-ld: oom_kill.c:(.text+0x18dc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `.L292': oom_kill.c:(.text+0x1938): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_skip_task_reaping': oom_kill.c:(.text+0x1970): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1994): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/oom_kill.o: in function `.L298': oom_kill.c:(.text+0x19bc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/oom_kill.o: in function `trace_raw_output_reclaim_retry_zone': oom_kill.c:(.text+0x1a28): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: oom_kill.c:(.text+0x1a40): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: mm/oom_kill.o: in function `.L304': oom_kill.c:(.text+0x1a68): undefined reference to `trace_event_printf' loongarch64-linux-ld: oom_kill.c:(.text+0x1a94): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/oom_kill.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: mm/swap.o: in function `.L20': swap.c:(.text+0x13c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: swap.c:(.text+0x1dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/swap.o: in function `.L32': swap.c:(.text+0x2d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: mm/swap.o: in function `.L38': swap.c:(.text+0x42c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: mm/swap.o: in function `trace_event_raw_event_mm_lru_insertion': swap.c:(.text+0x560): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/swap.o: in function `.L63': swap.c:(.text+0x69c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/swap.o: in function `.L75': swap.c:(.text+0x72c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: mm/swap.o: in function `trace_event_raw_event_mm_lru_activate': swap.c:(.text+0x7c0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: mm/swap.o: in function `.L80': swap.c:(.text+0x844): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: mm/swap.o: in function `.L76': swap.c:(.text+0x8ac): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: swap.c:(.text+0x8e4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/swap.o: in function `.L105': swap.c:(.text+0x978): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/swap.o: in function `.L107': swap.c:(.text+0x998): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/swap.o: in function `.L102': swap.c:(.text+0xa64): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: mm/swap.o: in function `.L100': swap.c:(.text+0xab4): undefined reference to `trace_event_printf' loongarch64-linux-ld: mm/swap.o: in function `trace_raw_output_mm_lru_activate': swap.c:(.text+0xad4): undefined reference to `trace_handle_return' loongarch64-linux-ld: mm/swap.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: mm/swap.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17806/23779] drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f9510969035e796a27375a80d9d6489440e17a1a commit: 0ea5d304521b68fb459c57e55f3f1bd853127bc7 [17806/23779] intel_rapl: abstract RAPL common code config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409271226.X7vYNpq3-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271226.X7vYNpq3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271226.X7vYNpq3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/powercap/intel_rapl_msr.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 11316/30000] arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6be8d57e8dd89fb93f6a1801c246e70ae85fbfaf commit: 66ae8ddda388386daea0623a65ea2ac85c24ca00 [11316/30000] ascend/arm64: Add ascend_enable_all kernel parameter config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409271256.FaGlmrJY-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409271256.FaGlmrJY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271256.FaGlmrJY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/arm64/mm/init.c:746:9: sparse: sparse: mixing declarations and code >> arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static? vim +/ascend_enable_all_features +730 arch/arm64/mm/init.c 729 > 730 void ascend_enable_all_features(void) 731 { 732 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 733 enable_mmap_dvpp = 1; 734 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13350/23779] ld.lld: error: undefined symbol: kfree_skb
by kernel test robot 27 Sep '24

27 Sep '24

Hi Zhao, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: f9510969035e796a27375a80d9d6489440e17a1a commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/23779] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-002-20240927 (https://download.01.org/0day-ci/archive/20240927/202409271130.zkdDo9UH-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409271130.zkdDo9UH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409271130.zkdDo9UH-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: __alloc_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: kfree_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: __nlmsg_put >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_broadcast >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: init_net >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: __netlink_kernel_create >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_kernel_release >>> referenced by super.c >>> fs/ext4/super.o:(ext4_exit_fs) in archive built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v4.19.321 commit d237c7d06ffddcdb5d36948c527dc01284388218 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 0dc7b5a4fea2..0378fd3eb039 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -652,6 +652,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -659,6 +660,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v5.10.225 commit 9e96dea7eff6f2bbcd0b42a098012fc66af9eb69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 355b16f0b145..34e45c87cae0 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH OLK-5.10] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v5.10.225 commit 9e96dea7eff6f2bbcd0b42a098012fc66af9eb69 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 919ddf8336f0b84c0453bac583808c9f165a85c2 ] aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index 355b16f0b145..34e45c87cae0 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2022-48878
by Yuan Can 27 Sep '24

27 Sep '24

Fix patch of CVE-2022-48878 and its pre requests. Krzysztof Kozlowski (1): Bluetooth: hci_qca: Fix driver shutdown on closed serdev Venkata Lakshmi Narayana Gubba (1): Bluetooth: hci_qca: Wait for timeout during suspend Yang Yingliang (1): Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() drivers/bluetooth/hci_qca.c | 57 ++++++++++++++++++++++++++++++------- 1 file changed, 47 insertions(+), 10 deletions(-) -- 2.17.1

2 4

[PATCH OLK-6.6] scsi: aacraid: Fix double-free on probe failure
by Zheng Qixing 27 Sep '24

27 Sep '24

From: Ben Hutchings <benh(a)debian.org> stable inclusion from stable-v6.6.49 commit 8a3995a3ffeca280a961b59f5c99843d81b15929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR60F CVE: CVE-2024-46673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting.in a double-free. Reported-by: Michael Gordon <m.gordon.zelenoborsky(a)gmail.com> Link: https://bugs.debian.org/1075855 Fixes: 8e0c5ebde82b ("[SCSI] aacraid: Newer adapter communication iterface support") Signed-off-by: Ben Hutchings <benh(a)debian.org> Link: https://lore.kernel.org/r/ZsZvfqlQMveoL5KQ@decadent.org.uk Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/aacraid/comminit.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c index bd99c5492b7d..0f64b0244303 100644 --- a/drivers/scsi/aacraid/comminit.c +++ b/drivers/scsi/aacraid/comminit.c @@ -642,6 +642,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) if (aac_comm_init(dev)<0){ kfree(dev->queues); + dev->queues = NULL; return NULL; } /* @@ -649,6 +650,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev) */ if (aac_fib_setup(dev) < 0) { kfree(dev->queues); + dev->queues = NULL; return NULL; } -- 2.39.2

2 1

[PATCH OLK-6.6] tracing/osnoise: Use a cpumask to know what threads are kthreads
by Zheng Yejian 27 Sep '24

27 Sep '24

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.51 commit 7a5f01828edf152c144d27cf63de446fdf2dc222 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYEK CVE: CVE-2024-46788 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 177e1cc2f41235c145041eed03ef5bab18f32328 upstream. The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to: while true; do rtla timerlat top -u -q & PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; done Causing the following OOPS: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 </TASK> Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]--- This is because it would mistakenly call kthread_stop() on a user space thread making it "exit" before it actually exits. Since kthreads are created based on global behavior, use a cpumask to know when kthreads are running and that they need to be shutdown before proceeding to do new work. Link: https://lore.kernel.org/all/20240820130001.124768-1-tglozar@redhat.com/ This was debugged by using the persistent ring buffer: Link: https://lore.kernel.org/all/20240823013902.135036960@goodmis.org/ Note, locking was originally used to fix this, but that proved to cause too many deadlocks to work around: https://lore.kernel.org/linux-trace-kernel/20240823102816.5e55753b@gandalf.… Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: "Luis Claudio R. Goncalves" <lgoncalv(a)redhat.com> Link: https://lore.kernel.org/20240904103428.08efdf4c@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Reported-by: Tomas Glozar <tglozar(a)redhat.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_osnoise.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index a8e28f9b9271..49f10c7f7fd0 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c @@ -1612,6 +1612,7 @@ static int run_osnoise(void) static struct cpumask osnoise_cpumask; static struct cpumask save_cpumask; +static struct cpumask kthread_cpumask; /* * osnoise_sleep - sleep until the next period @@ -1675,6 +1676,7 @@ static inline int osnoise_migration_pending(void) */ mutex_lock(&interface_lock); this_cpu_osn_var()->kthread = NULL; + cpumask_clear_cpu(smp_processor_id(), &kthread_cpumask); mutex_unlock(&interface_lock); return 1; @@ -1947,9 +1949,10 @@ static void stop_kthread(unsigned int cpu) kthread = per_cpu(per_cpu_osnoise_var, cpu).kthread; if (kthread) { - if (test_bit(OSN_WORKLOAD, &osnoise_options)) { + if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask) && + !WARN_ON(!test_bit(OSN_WORKLOAD, &osnoise_options))) { kthread_stop(kthread); - } else { + } else if (!WARN_ON(test_bit(OSN_WORKLOAD, &osnoise_options))) { /* * This is a user thread waiting on the timerlat_fd. We need * to close all users, and the best way to guarantee this is @@ -2021,6 +2024,7 @@ static int start_kthread(unsigned int cpu) } per_cpu(per_cpu_osnoise_var, cpu).kthread = kthread; + cpumask_set_cpu(cpu, &kthread_cpumask); return 0; } @@ -2048,8 +2052,16 @@ static int start_per_cpu_kthreads(void) */ cpumask_and(current_mask, cpu_online_mask, &osnoise_cpumask); - for_each_possible_cpu(cpu) + for_each_possible_cpu(cpu) { + if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask)) { + struct task_struct *kthread; + + kthread = per_cpu(per_cpu_osnoise_var, cpu).kthread; + if (!WARN_ON(!kthread)) + kthread_stop(kthread); + } per_cpu(per_cpu_osnoise_var, cpu).kthread = NULL; + } for_each_cpu(cpu, current_mask) { retval = start_kthread(cpu); -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: rtw88: usb: schedule rx work after everything is set up
by Chen Zhongjin 27 Sep '24

27 Sep '24

From: Marcin Ślusarz <mslusarz(a)renau.com> mainline inclusion from mainline-v6.11-rc1 commit adc539784c98a7cc602cbf557debfc2e7b9be8b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYFO CVE: CVE-2024-46760 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Right now it's possible to hit NULL pointer dereference in rtw_rx_fill_rx_status on hw object and/or its fields because initialization routine can start getting USB replies before rtw_dev is fully setup. The stack trace looks like this: rtw_rx_fill_rx_status rtw8821c_query_rx_desc rtw_usb_rx_handler ... queue_work rtw_usb_read_port_complete ... usb_submit_urb rtw_usb_rx_resubmit rtw_usb_init_rx rtw_usb_probe So while we do the async stuff rtw_usb_probe continues and calls rtw_register_hw, which does all kinds of initialization (e.g. via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on. Fix this by moving the first usb_submit_urb after everything is set up. For me, this bug manifested as: [ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped [ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status because I'm using Larry's backport of rtw88 driver with the NULL checks in rtw_rx_fill_rx_status. Link: https://lore.kernel.org/linux-wireless/CA+shoWQ7P49jhQasofDcTdQhiuarPTjYEDa… Signed-off-by: Marcin Ślusarz <mslusarz(a)renau.com> Cc: Tim K <tpkuester(a)gmail.com> Cc: Ping-Ke Shih <pkshih(a)realtek.com> Cc: Larry Finger <Larry.Finger(a)lwfinger.net> Cc: Kalle Valo <kvalo(a)kernel.org> Cc: linux-wireless(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240528110246.477321-1-marcin.slusarz@gmail.com Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/net/wireless/realtek/rtw88/usb.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c index efd0c2915a05..04a64afcbf8a 100644 --- a/drivers/net/wireless/realtek/rtw88/usb.c +++ b/drivers/net/wireless/realtek/rtw88/usb.c @@ -742,7 +742,6 @@ static struct rtw_hci_ops rtw_usb_ops = { static int rtw_usb_init_rx(struct rtw_dev *rtwdev) { struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); - int i; rtwusb->rxwq = create_singlethread_workqueue("rtw88_usb: rx wq"); if (!rtwusb->rxwq) { @@ -754,13 +753,19 @@ static int rtw_usb_init_rx(struct rtw_dev *rtwdev) INIT_WORK(&rtwusb->rx_work, rtw_usb_rx_handler); + return 0; +} + +static void rtw_usb_setup_rx(struct rtw_dev *rtwdev) +{ + struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev); + int i; + for (i = 0; i < RTW_USB_RXCB_NUM; i++) { struct rx_usb_ctrl_block *rxcb = &rtwusb->rx_cb[i]; rtw_usb_rx_resubmit(rtwusb, rxcb); } - - return 0; } static void rtw_usb_deinit_rx(struct rtw_dev *rtwdev) @@ -897,6 +902,8 @@ int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id) goto err_destroy_rxwq; } + rtw_usb_setup_rx(rtwdev); + return 0; err_destroy_rxwq: -- 2.25.1

2 1

[PATCH OLK-5.10] hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
by Tong Tiangen 27 Sep '24

27 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v5.10.226 commit 56cfdeb2c77291f0b5e4592731adfb6ca8fc7c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX5F CVE: CVE-2024-46756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c1de37969b7bc0abcb20b86e91e70caebbd4f89 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/hwmon/w83627ehf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c index 3964ceab2817..acf36862851a 100644 --- a/drivers/hwmon/w83627ehf.c +++ b/drivers/hwmon/w83627ehf.c @@ -897,7 +897,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -922,7 +922,7 @@ store_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit the temp to 0C - 15C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000); mutex_lock(&data->update_lock); reg = w83627ehf_read_value(data, W83627EHF_REG_TOLERANCE[nr]); -- 2.25.1

2 1

[openeuler:OLK-5.10 5206/30000] drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 6be8d57e8dd89fb93f6a1801c246e70ae85fbfaf commit: ec4ae62c07d56281aacec51770e0453414a76ded [5206/30000] sw64: gpu/drm: solve driver load cause kernel crash config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240927/202409270508.u8KdTEFv-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270508.u8KdTEFv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270508.u8KdTEFv-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void volatile [noderef] __iomem * @@ got void *[addressable] cpu_addr @@ drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: expected void volatile [noderef] __iomem * drivers/gpu/drm/radeon/radeon_vce.c:247:25: sparse: got void *[addressable] cpu_addr drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:368:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:369:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:370:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:372:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:373:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:374:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:375:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:376:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:377:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:378:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:379:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:380:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:381:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:382:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:383:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:385:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:386:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:387:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:388:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:389:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:392:27: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:435:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:436:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:437:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:439:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:440:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:441:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:442:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:443:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:445:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:446:32: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: expected unsigned int [usertype] drivers/gpu/drm/radeon/radeon_vce.c:449:27: sparse: got restricted __le32 [usertype] drivers/gpu/drm/radeon/radeon_vce.c:706:33: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned int [usertype] v @@ got restricted __le32 [usertype] @@ drivers/gpu/drm/radeon/radeon_vce.c:706:33: sparse: expected unsigned int [usertype] v vim +247 drivers/gpu/drm/radeon/radeon_vce.c 214 215 /** 216 * radeon_vce_resume - pin VCE fw memory 217 * 218 * @rdev: radeon_device pointer 219 * 220 */ 221 int radeon_vce_resume(struct radeon_device *rdev) 222 { 223 void *cpu_addr; 224 int r; 225 226 if (rdev->vce.vcpu_bo == NULL) 227 return -EINVAL; 228 229 r = radeon_bo_reserve(rdev->vce.vcpu_bo, false); 230 if (r) { 231 dev_err(rdev->dev, "(%d) failed to reserve VCE bo\n", r); 232 return r; 233 } 234 235 r = radeon_bo_kmap(rdev->vce.vcpu_bo, &cpu_addr); 236 if (r) { 237 radeon_bo_unreserve(rdev->vce.vcpu_bo); 238 dev_err(rdev->dev, "(%d) VCE map failed\n", r); 239 return r; 240 } 241 242 memset(cpu_addr, 0, radeon_bo_size(rdev->vce.vcpu_bo)); 243 if (rdev->family < CHIP_BONAIRE) 244 r = vce_v1_0_load_fw(rdev, cpu_addr); 245 else { 246 if (IS_ENABLED(CONFIG_SW64)) > 247 memcpy_toio(cpu_addr, rdev->vce_fw->data, rdev->vce_fw->size); 248 else 249 memcpy(cpu_addr, rdev->vce_fw->data, rdev->vce_fw->size); 250 } 251 252 radeon_bo_kunmap(rdev->vce.vcpu_bo); 253 254 radeon_bo_unreserve(rdev->vce.vcpu_bo); 255 256 return r; 257 } 258 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9419/14172] main.c:undefined reference to `perf_trace_run_bpf_submit'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e95e7bae9486cc775ed2aa319bf323f6ba2677b commit: c03a541494af4fb1504917412d762247b90380da [9419/14172] LoongArch: Fix callchain parse error with kernel tracepoint events config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240927/202409270442.VcOKC2UZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270442.VcOKC2UZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270442.VcOKC2UZ-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/oom_kill.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/oom_kill.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/swap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/vmscan.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/vmscan.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/percpu.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/percpu.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/slab_common.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/slab_common.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/compaction.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/compaction.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/mmap_lock.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/mmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/rmap.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/rmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/vmalloc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/huge_memory.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `mm/khugepaged.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/khugepaged.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/page_isolation.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/cma.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `mm/damon/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/fs-writeback.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/fs-writeback.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/locks.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/iomap/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/ext4/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/ext4/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/ext2/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/jbd2/journal.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/xfs/xfs_trace.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/xfs/xfs_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/xfs/scrub/trace.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/xfs/scrub/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/btrfs/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/btrfs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/gfs2/glock.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `fs/f2fs/super.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/f2fs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `fs/zonefs/super.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-iocost.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `block/blk-wbt.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `io_uring/io_uring.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpio/gpiolib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/clk/clk.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma/tegra20-apb-dma.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/soc/qcom/rpmh-rsc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/regulator/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/iommu/iommu-traces.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/host1x/dev.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/drm_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/scheduler/sched_main.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/radeon/radeon_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/amd/amdgpu/amdgpu_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/v3d/v3d_trace_points.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/disp/dpu1/dpu_kms.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/msm_atomic_tracepoints.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/msm/msm_gpu_tracepoints.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/tegra/trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/gpu/drm/lima/lima_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/base/regmap/regmap.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma-buf/dma-fence.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/dma-buf/sw_sync.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/scsi/scsi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/scsi/sd_zbc.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/nvme/host/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/target/target_core_transport.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/spi/spi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/spmi/spmi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/usb/host/xhci-trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/usb/musb/musb_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/input/keyboard/applespi.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-base.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-smbus.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/i2c/i2c-core-slave.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/i2c/i2c-core-slave.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/hwmon/hwmon.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/thermal/thermal_core.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/thermal/thermal_core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/mmc/core/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_eval_map' from `drivers/ufs/core/ufshcd.o' being placed in section `_ftrace_eval_map' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/ufs/core/ufshcd.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/platform/chrome/cros_ec_trace.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/devfreq/devfreq.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/android/binder.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-aspeed.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-gpio.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/fsi/fsi-master-ast-cf.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `drivers/interconnect/core.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_native.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_lib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `lib/maple_tree.o' being placed in section `_ftrace_events' loongarch64-linux-ld: init/main.o: in function `.L199': main.c:(.text+0x200): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x250): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_start': main.c:(.text+0x36c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: init/main.o: in function `.L213': >> main.c:(.text+0x3a0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_finish': main.c:(.text+0x47c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: init/main.o: in function `.L225': main.c:(.text+0x4b4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_start': main.c:(.text+0x590): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x5a0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L236': main.c:(.text+0x5e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_finish': main.c:(.text+0x660): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x674): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L247': main.c:(.text+0x6c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: main.c:(.text+0x6fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_level': main.c:(.text+0x754): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x774): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `.L263': main.c:(.text+0x79c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_start': main.c:(.text+0x7f0): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x810): undefined reference to `trace_handle_return' loongarch64-linux-ld: main.c:(.text+0x83c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_finish': main.c:(.text+0x894): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x8b4): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_level': main.c:(.text+0x938): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x954): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L312': main.c:(.text+0x9bc): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: init/main.o: in function `.L299': main.c:(.text+0xa08): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_newtask': fork.c:(.text+0x178): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L34': fork.c:(.text+0x1dc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L21': fork.c:(.text+0x258): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_newtask': fork.c:(.text+0x2d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `.L39': fork.c:(.text+0x30c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L35': fork.c:(.text+0x34c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o: in function `.L36': fork.c:(.text+0x384): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_newtask': fork.c:(.text+0x3dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x3fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L52': fork.c:(.text+0x424): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_rename': fork.c:(.text+0x47c): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x49c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L58': fork.c:(.text+0x510): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_rename': fork.c:(.text+0x580): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L72': fork.c:(.text+0x5f8): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L71': fork.c:(.text+0x678): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_rename': fork.c:(.text+0x6bc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L77': fork.c:(.text+0x708): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_enter': cpu.c:(.text+0x2dc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L35': cpu.c:(.text+0x31c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_multi_enter': cpu.c:(.text+0x40c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L47': cpu.c:(.text+0x44c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_exit': cpu.c:(.text+0x54c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L59': cpu.c:(.text+0x58c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_enter': cpu.c:(.text+0x688): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x6a4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L70': cpu.c:(.text+0x708): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_multi_enter': cpu.c:(.text+0x790): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x7ac): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L81': cpu.c:(.text+0x808): undefined reference to `__trace_trigger_soft_disabled' -- loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_queue_cpu': smp.c:(.text+0x224): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L30': smp.c:(.text+0x264): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_function': smp.c:(.text+0x33c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L42': smp.c:(.text+0x374): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_queue_cpu': smp.c:(.text+0x468): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: smp.c:(.text+0x484): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L53': smp.c:(.text+0x4e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_function': smp.c:(.text+0x560): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: smp.c:(.text+0x574): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L64': smp.c:(.text+0x5c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `.L65': smp.c:(.text+0x5fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_queue_cpu': smp.c:(.text+0x65c): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x67c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o: in function `.L80': smp.c:(.text+0x6a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_function': smp.c:(.text+0x6f4): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x714): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L255': kexec_core.c:(.text+0x1b10): undefined reference to `machine_kexec_cleanup' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L296': kexec_core.c:(.text+0x1d70): undefined reference to `machine_crash_shutdown' loongarch64-linux-ld: kexec_core.c:(.text+0x1d78): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L383': kexec_core.c:(.text+0x2350): undefined reference to `machine_shutdown' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L380': kexec_core.c:(.text+0x2360): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L128': cgroup.c:(.text+0x868): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L129': cgroup.c:(.text+0x8d4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_event': cgroup.c:(.text+0xa40): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L147': cgroup.c:(.text+0xab4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L169': cgroup.c:(.text+0xd70): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L21': cgroup.c:(.text+0xdb4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L193': cgroup.c:(.text+0xe68): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L192': cgroup.c:(.text+0xe9c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L189': cgroup.c:(.text+0xefc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L200': cgroup.c:(.text+0xf1c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xf44): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L201': cgroup.c:(.text+0xfa0): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_root': cgroup.c:(.text+0xfc0): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xfec): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L207': cgroup.c:(.text+0x106c): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup': cgroup.c:(.text+0x108c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0x10b4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L213': cgroup.c:(.text+0x1124): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_migrate': cgroup.c:(.text+0x1144): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L730': cgroup.c:(.text+0x3e5c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L15': cgroup.c:(.text+0x3ef4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L756': cgroup.c:(.text+0x4050): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `css_create': cgroup.c:(.text+0x40c0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L769': cgroup.c:(.text+0x4234): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cgroup.c:(.text+0x4278): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L772': cgroup.c:(.text+0x42d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L775': cgroup.c:(.text+0x4328): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_migrate': cgroup.c:(.text+0x43c4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L782': cgroup.c:(.text+0x43f4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L784': cgroup.c:(.text+0x444c): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: cgroup.c:(.text+0x44a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L788': cgroup.c:(.text+0x4580): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup': cgroup.c:(.text+0x45e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L802': cgroup.c:(.text+0x46c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L12': error_report-traces.c:(.text+0xec): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: error_report-traces.c:(.text+0x124): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_event_raw_event_error_report_template': error_report-traces.c:(.text+0x1f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L27': error_report-traces.c:(.text+0x20c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L23': error_report-traces.c:(.text+0x248): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L24': error_report-traces.c:(.text+0x27c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_raw_output_error_report_template': error_report-traces.c:(.text+0x2d0): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: error_report-traces.c:(.text+0x2e8): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L39': error_report-traces.c:(.text+0x308): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/trace/error_report-traces.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/trace/error_report-traces.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu': power-traces.c:(.text+0xdb4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L209': power-traces.c:(.text+0xdec): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_idle_miss': power-traces.c:(.text+0xec4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L221': power-traces.c:(.text+0xf00): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_pstate_sample': power-traces.c:(.text+0x1010): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L233': power-traces.c:(.text+0x106c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_frequency_limits': power-traces.c:(.text+0x1154): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: power-traces.c:(.text+0x119c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_suspend_resume': power-traces.c:(.text+0x1284): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: power-traces.c:(.text+0x12c0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L267': power-traces.c:(.text+0x1394): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_cpu_latency_qos_request': power-traces.c:(.text+0x13c8): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L268': power-traces.c:(.text+0x14a4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_pm_qos_update': power-traces.c:(.text+0x14e0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L280': power-traces.c:(.text+0x15c4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `perf_trace_guest_halt_poll_ns': power-traces.c:(.text+0x1600): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L292': power-traces.c:(.text+0x16d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x16ec): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu': power-traces.c:(.text+0x1728): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L304': power-traces.c:(.text+0x17a8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x17c0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu_idle_miss': power-traces.c:(.text+0x1808): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L315': power-traces.c:(.text+0x18b0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x18e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_pstate_sample': power-traces.c:(.text+0x194c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L330': power-traces.c:(.text+0x19b8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L326': power-traces.c:(.text+0x19e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: power-traces.c:(.text+0x1a2c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L341': power-traces.c:(.text+0x1ab0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1ac8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L338': power-traces.c:(.text+0x1b28): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_suspend_resume': power-traces.c:(.text+0x1b98): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1ba8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L348': power-traces.c:(.text+0x1be8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_cpu_latency_qos_request': power-traces.c:(.text+0x1c68): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1c80): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `.L359': power-traces.c:(.text+0x1cc8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/trace/power-traces.o: in function `trace_event_raw_event_pm_qos_update': power-traces.c:(.text+0x1d48): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: power-traces.c:(.text+0x1d60): undefined reference to `trace_event_buffer_commit' Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20217/23779] mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static?
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b1d54e6f06c518a52f83edade0da2b959e1c9a4e commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [20217/23779] dhugetlb: backport dynamic hugetlb feature config: x86_64-randconfig-123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270316.mecxJZQM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270316.mecxJZQM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270316.mecxJZQM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/hugetlb.c:1370:6: sparse: sparse: symbol 'free_huge_page_to_dhugetlb_pool' was not declared. Should it be static? mm/hugetlb.c:4438:58: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void [noderef] <asn:1> * @@ got void *buffer @@ mm/hugetlb.c:4438:58: sparse: expected void [noderef] <asn:1> * mm/hugetlb.c:4438:58: sparse: got void *buffer mm/hugetlb.c:4452:60: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void *buffer @@ got void [noderef] <asn:1> *buffer @@ mm/hugetlb.c:4452:60: sparse: expected void *buffer mm/hugetlb.c:4452:60: sparse: got void [noderef] <asn:1> *buffer mm/hugetlb.c:4510:60: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void *buffer @@ got void [noderef] <asn:1> *buffer @@ mm/hugetlb.c:4510:60: sparse: expected void *buffer mm/hugetlb.c:4510:60: sparse: got void [noderef] <asn:1> *buffer mm/hugetlb.c:2018:20: sparse: sparse: context imbalance in 'gather_surplus_pages' - unexpected unlock mm/hugetlb.c:5168:17: sparse: sparse: context imbalance in 'hugetlb_cow' - unexpected unlock mm/hugetlb.c:5881:25: sparse: sparse: context imbalance in 'follow_hugetlb_page' - different lock contexts for basic block mm/hugetlb.c:1370:6: warning: no previous prototype for 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 5053/23779] drivers/platform/x86/intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b1d54e6f06c518a52f83edade0da2b959e1c9a4e commit: 1073f9d006321689fb82bdac7b7af58e8617f128 [5053/23779] platform/x86: Add Intel AtomISP2 dummy / power-management driver config: x86_64-buildonly-randconfig-001-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270224.SJPfAkVu-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240927/202409270224.SJPfAkVu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270224.SJPfAkVu-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/platform/x86/intel_atomisp2_pm.c:15: include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'isp_pci_driver_exit': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1637:1: note: in expansion of macro 'module_exit' 1637 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/pci.h:32, from drivers/platform/x86/intel_atomisp2_pm.c:17: drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'cleanup_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1633:20: note: in definition of macro 'module_driver' 1633 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'isp_pci_driver_init': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1632:1: note: in expansion of macro 'module_init' 1632 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'init_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1628:19: note: in definition of macro 'module_driver' 1628 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/platform/x86/intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 14067/14172] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:403:15: error: no member named 'start' in 'struct iommu_iotlb_gather'
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e95e7bae9486cc775ed2aa319bf323f6ba2677b commit: e4a624e3e991f56f3783c5fafe8fd075a2be861b [14067/14172] net: hns3: add sync command to sync io-pgtable config: arm64-randconfig-r123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270232.uDTz2n2f-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270232.uDTz2n2f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270232.uDTz2n2f-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:403:15: error: no member named 'start' in 'struct iommu_iotlb_gather' iotlb_gather.start = iova; ~~~~~~~~~~~~ ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:404:15: error: no member named 'end' in 'struct iommu_iotlb_gather' iotlb_gather.end = iova + granule - 1; ~~~~~~~~~~~~ ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:405:15: error: no member named 'pgsize' in 'struct iommu_iotlb_gather' iotlb_gather.pgsize = granule; ~~~~~~~~~~~~ ^ 3 errors generated. vim +403 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 388 389 #define HNS3_INVALID_PTYPE \ 390 ARRAY_SIZE(hns3_rx_ptype_tbl) 391 392 static void hns3_dma_map_sync(struct device *dev, unsigned long iova) 393 { 394 struct iommu_domain *domain = iommu_get_domain_for_dev(dev); 395 struct iommu_iotlb_gather iotlb_gather; 396 size_t granule; 397 398 if (!domain || domain->type != IOMMU_DOMAIN_DMA) 399 return; 400 401 granule = 1 << __ffs(domain->pgsize_bitmap); 402 iova = ALIGN_DOWN(iova, granule); > 403 iotlb_gather.start = iova; > 404 iotlb_gather.end = iova + granule - 1; > 405 iotlb_gather.pgsize = granule; 406 407 iommu_iotlb_sync(domain, &iotlb_gather); 408 } 409 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1336/14122] include/linux/uaccess.h:213:16: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 27 Sep '24

27 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: 975e216e36aa3f7aba9d8e1e1d6cbba7cf692ad7 [1336/14122] arm64: add support for machine check error safe config: arm64-randconfig-r123-20240926 (https://download.01.org/0day-ci/archive/20240927/202409270023.ToC1weNo-lkp@…) compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project f28c006a5895fc0e329fe15fead81e37457cb1d1) reproduce: (https://download.01.org/0day-ci/archive/20240927/202409270023.ToC1weNo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409270023.ToC1weNo-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) lib/iov_iter.c: note: in included file (through include/linux/sched/task.h, include/linux/sched/signal.h, include/linux/rcuwait.h, ...): >> include/linux/uaccess.h:213:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __user *ptr @@ got void *dst @@ include/linux/uaccess.h:213:16: sparse: expected void const [noderef] __user *ptr include/linux/uaccess.h:213:16: sparse: got void *dst lib/iov_iter.c: note: in included file: include/net/checksum.h:33:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:33:39: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:33:39: sparse: got unsigned int include/net/checksum.h:33:39: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:33:39: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:33:39: sparse: got unsigned int include/net/checksum.h:41:45: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:41:45: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:41:45: sparse: got unsigned int include/net/checksum.h:41:45: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] sum @@ got unsigned int @@ include/net/checksum.h:41:45: sparse: expected restricted __wsum [usertype] sum include/net/checksum.h:41:45: sparse: got unsigned int vim +213 include/linux/uaccess.h ec6347bb43395c Dan Williams 2020-10-05 207 59feaaa04e929c Tong Tiangen 2023-12-07 208 #ifndef copy_mc_to_user 59feaaa04e929c Tong Tiangen 2023-12-07 209 static inline unsigned long __must_check 59feaaa04e929c Tong Tiangen 2023-12-07 210 copy_mc_to_user(void *dst, const void *src, size_t cnt) 59feaaa04e929c Tong Tiangen 2023-12-07 211 { 59feaaa04e929c Tong Tiangen 2023-12-07 212 check_object_size(src, cnt, true); 59feaaa04e929c Tong Tiangen 2023-12-07 @213 return raw_copy_to_user(dst, src, cnt); 59feaaa04e929c Tong Tiangen 2023-12-07 214 } 59feaaa04e929c Tong Tiangen 2023-12-07 215 #endif 59feaaa04e929c Tong Tiangen 2023-12-07 216 :::::: The code at line 213 was first introduced by commit :::::: 59feaaa04e929cf051c9b29e28fb9e1299785280 uaccess: add generic fallback version of copy_mc_to_user() :::::: TO: Tong Tiangen <tongtiangen(a)huawei.com> :::::: CC: Tong Tiangen <tongtiangen(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v4.19.322 commit 4eb4085c1346d19d4a05c55246eb93e74e671048 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 3276a5e4c430..486fad430958 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -35,7 +35,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -54,7 +53,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-5.10] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v5.10.226 commit bc1faed19db95abf0933b104910a3fb01b138f59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 04565162a449..cf9c0e75f0be 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -38,7 +38,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -57,7 +56,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v5.10.226 commit bc1faed19db95abf0933b104910a3fb01b138f59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 04565162a449..cf9c0e75f0be 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -38,7 +38,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -57,7 +56,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-6.6] pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
by Zeng Heng 26 Sep '24

26 Sep '24

From: Krishna Kumar <krishnak(a)linux.ibm.com> stable inclusion from stable-v6.6.51 commit b82d4d5c736f4fd2ed224c35f554f50d1953d21e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWMF CVE: CVE-2024-46761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 335e35b748527f0c06ded9eebb65387f60647fda ] The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge from the PHB. The crash occurs because although the MSI data structure has been released during disable/hot-unplug path and it has been assigned with NULL, still during unregistration the code was again trying to explicitly disable the MSI which causes the NULL pointer dereference and kernel crash. The patch fixes the check during unregistration path to prevent invoking pci_disable_msi/msix() since its data structure is already freed. Reported-by: Timothy Pearson <tpearson(a)raptorengineering.com> Closes: https://lore.kernel.org/all/1981605666.2142272.1703742465927.JavaMail.zimbr… Acked-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Shawn Anastasio <sanastasio(a)raptorengineering.com> Signed-off-by: Krishna Kumar <krishnak(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20240701074513.94873-2-krishnak@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/hotplug/pnv_php.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/pci/hotplug/pnv_php.c b/drivers/pci/hotplug/pnv_php.c index 881d420637bf..092c9ac0d26d 100644 --- a/drivers/pci/hotplug/pnv_php.c +++ b/drivers/pci/hotplug/pnv_php.c @@ -39,7 +39,6 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, bool disable_device) { struct pci_dev *pdev = php_slot->pdev; - int irq = php_slot->irq; u16 ctrl; if (php_slot->irq > 0) { @@ -58,7 +57,7 @@ static void pnv_php_disable_irq(struct pnv_php_slot *php_slot, php_slot->wq = NULL; } - if (disable_device || irq > 0) { + if (disable_device) { if (pdev->msix_enabled) pci_disable_msix(pdev); else if (pdev->msi_enabled) -- 2.25.1

2 1

[PATCH OLK-6.6] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 21ae34013c35..1e60458e72ff 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5737,10 +5737,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5752,8 +5754,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5761,15 +5765,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5777,8 +5781,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5810,9 +5816,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5838,14 +5845,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5856,7 +5862,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH OLK-6.6] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index 211360eee95a..a9cb04043f08 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index e733be840545..a150855b4b05 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-5.10] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 336daa667fb1..269fb2419325 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5268,10 +5268,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5283,8 +5285,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5292,15 +5296,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5308,8 +5312,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5341,9 +5347,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5369,14 +5376,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5387,7 +5393,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 8ace56c8141b..5ca3201d4f3e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5265,10 +5265,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5280,8 +5282,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5289,15 +5293,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5305,8 +5309,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5338,9 +5344,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5366,14 +5373,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5384,7 +5390,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index e733be840545..a150855b4b05 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -300,8 +297,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] PCI: Add missing bridge lock to pci_bus_lock()
by liwei 26 Sep '24

26 Sep '24

From: Dan Williams <dan.j.williams(a)intel.com> mainline inclusion from mainline-v6.11-rc1 commit a4e772898f8bf2e7e1cf661a12c60a5612c4afab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWL9 CVE: CVE-2024-46750 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70 RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70 Call Trace: <TASK> ? __warn+0x8c/0x190 ? pci_bridge_secondary_bus_reset+0x5d/0x70 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? pci_bridge_secondary_bus_reset+0x5d/0x70 pci_reset_bus+0x1d8/0x270 vmd_probe+0x778/0xa10 pci_device_probe+0x95/0x120 Where pci_reset_bus() users are triggering unlocked secondary bus resets. Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses pci_bus_lock() before issuing the reset which locks everything *but* the bridge itself. For the same motivation as adding: bridge = pci_upstream_bridge(dev); if (bridge) pci_dev_lock(bridge); to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add pci_dev_lock() for @bus->self to pci_bus_lock(). Link: https://lore.kernel.org/r/171711747501.1628941.15217746952476635316.stgit@d… Reported-by: Imre Deak <imre.deak(a)intel.com> Closes: http://lore.kernel.org/r/6657833b3b5ae_14984b29437@dwillia2-xfh.jf.intel.co… Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> [bhelgaas: squash in recursive locking deadlock fix from Keith Busch: https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Tested-by: Hans de Goede <hdegoede(a)redhat.com> Tested-by: Kalle Valo <kvalo(a)kernel.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/pci.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index e58fe13c99e1..b93605616d4e 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5035,10 +5035,12 @@ static void pci_bus_lock(struct pci_bus *bus) { struct pci_dev *dev; + pci_dev_lock(bus->self); list_for_each_entry(dev, &bus->devices, bus_list) { - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5050,8 +5052,10 @@ static void pci_bus_unlock(struct pci_bus *bus) list_for_each_entry(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); } /* Return 1 on successful lock, 0 on contention */ @@ -5059,15 +5063,15 @@ static int pci_bus_trylock(struct pci_bus *bus) { struct pci_dev *dev; + if (!pci_dev_trylock(bus->self)) + return 0; + list_for_each_entry(dev, &bus->devices, bus_list) { - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5075,8 +5079,10 @@ static int pci_bus_trylock(struct pci_bus *bus) list_for_each_entry_continue_reverse(dev, &bus->devices, bus_list) { if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } + pci_dev_unlock(bus->self); return 0; } @@ -5108,9 +5114,10 @@ static void pci_slot_lock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - pci_dev_lock(dev); if (dev->subordinate) pci_bus_lock(dev->subordinate); + else + pci_dev_lock(dev); } } @@ -5136,14 +5143,13 @@ static int pci_slot_trylock(struct pci_slot *slot) list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot != slot) continue; - if (!pci_dev_trylock(dev)) - goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); goto unlock; } - } + } else if (!pci_dev_trylock(dev)) + goto unlock; } return 1; @@ -5154,7 +5160,8 @@ static int pci_slot_trylock(struct pci_slot *slot) continue; if (dev->subordinate) pci_bus_unlock(dev->subordinate); - pci_dev_unlock(dev); + else + pci_dev_unlock(dev); } return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: dwc3: st: fix probed platform device ref count on probe error path
by liwei 26 Sep '24

26 Sep '24

From: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> mainline inclusion from mainline-v6.11-rc6 commit ddfcfeba891064b88bb844208b43bef2ef970f0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR624 CVE: CVE-2024-46674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") Cc: stable(a)vger.kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Acked-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Reviewed-by: Patrice Chotard <patrice.chotard(a)foss.st.com> Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/usb/dwc3/dwc3-st.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c index 16081383c401..6127505770ce 100644 --- a/drivers/usb/dwc3/dwc3-st.c +++ b/drivers/usb/dwc3/dwc3-st.c @@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform_device *pdev) dwc3_data->regmap = regmap; res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); - if (!res) { - ret = -ENXIO; - goto undo_platform_dev_alloc; - } + if (!res) + return -ENXIO; dwc3_data->syscfg_reg_off = res->start; @@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev) devm_reset_control_get_exclusive(dev, "powerdown"); if (IS_ERR(dwc3_data->rstc_pwrdn)) { dev_err(&pdev->dev, "could not get power controller\n"); - ret = PTR_ERR(dwc3_data->rstc_pwrdn); - goto undo_platform_dev_alloc; + return PTR_ERR(dwc3_data->rstc_pwrdn); } /* Manage PowerDown */ @@ -296,8 +293,6 @@ static int st_dwc3_probe(struct platform_device *pdev) reset_control_assert(dwc3_data->rstc_rst); undo_powerdown: reset_control_assert(dwc3_data->rstc_pwrdn); -undo_platform_dev_alloc: - platform_device_put(pdev); return ret; } -- 2.25.1

2 1

[PATCH OLK-6.6] btrfs: handle errors from btrfs_dec_ref() properly
by Long Li 26 Sep '24

26 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.10-rc2 commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ CVE: CVE-2024-46753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Conflict due to not merge mainline commit e094f48040cd] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index c6ecfd05e1db..b6be2e2f1994 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5505,7 +5505,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, ret = btrfs_dec_ref(trans, root, eb, 1); else ret = btrfs_dec_ref(trans, root, eb, 0); - BUG_ON(ret); /* -ENOMEM */ + if (ret) { + btrfs_abort_transaction(trans, ret); + return ret; + } if (is_fstree(root->root_key.objectid)) { ret = btrfs_qgroup_trace_leaf_items(trans, eb); if (ret) { -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: handle errors from btrfs_dec_ref() properly
by Long Li 26 Sep '24

26 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.10-rc2 commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARYDJ CVE: CVE-2024-46753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Conflict due to not merge mainline commit e094f48040cd] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/extent-tree.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 1cf787209798..42617407feb1 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5227,7 +5227,10 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans, ret = btrfs_dec_ref(trans, root, eb, 1); else ret = btrfs_dec_ref(trans, root, eb, 0); - BUG_ON(ret); /* -ENOMEM */ + if (ret) { + btrfs_abort_transaction(trans, ret); + return ret; + } if (is_fstree(root->root_key.objectid)) { ret = btrfs_qgroup_trace_leaf_items(trans, eb); if (ret) { -- 2.39.2

2 1

[PATCH OLK-6.6 0/8] fix CVE-2024-46701
by Yu Kuai 26 Sep '24

26 Sep '24

Chuck Lever (5): libfs: Re-arrange locking in offset_iterate_dir() libfs: Define a minimum directory offset libfs: Add simple_offset_empty() maple_tree: Add mtree_alloc_cyclic() libfs: Convert simple directory offsets to use a Maple Tree Liam R. Howlett (1): test_maple_tree: testing the cyclic allocation Yu Kuai (1): fs: fix kabi kroken in struct offset_ctx yangerkun (1): libfs: fix infinite directory reads for offset dir fs/libfs.c | 129 +++++++++++++++++++++++++------------ include/linux/fs.h | 15 ++++- include/linux/maple_tree.h | 7 ++ lib/maple_tree.c | 93 ++++++++++++++++++++++++++ lib/test_maple_tree.c | 44 +++++++++++++ mm/shmem.c | 4 +- 6 files changed, 247 insertions(+), 45 deletions(-) -- 2.39.2

2 9

[PATCH OLK-5.10] NFSD: Reset cb_seq_status after NFS4ERR_DELAY
by Li Lingfeng 26 Sep '24

26 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.9-rc1 commit 961b4b5e86bf56a2e4b567f81682defa5cba957e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATOAX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I noticed that once an NFSv4.1 callback operation gets a NFS4ERR_DELAY status on CB_SEQUENCE and then the connection is lost, the callback client loops, resending it indefinitely. The switch arm in nfsd4_cb_sequence_done() that handles NFS4ERR_DELAY uses rpc_restart_call() to rearm the RPC state machine for the retransmit, but that path does not call the rpc_prepare_call callback again. Thus cb_seq_status is set to -10008 by the first NFS4ERR_DELAY result, but is never set back to 1 for the retransmits. nfsd4_cb_sequence_done() thinks it's getting nothing but a long series of CB_SEQUENCE NFS4ERR_DELAY replies. Fixes: 7ba6cad6c88f ("nfsd: New helper nfsd4_cb_sequence_done() for processing more cb errors") Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index f5b7ad0847f2..bd79fc4934f0 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1126,6 +1126,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback ret = false; break; case -NFS4ERR_DELAY: + cb->cb_seq_status = 1; if (!rpc_restart_call(task)) goto out; -- 2.31.1

2 1

[PATCH OLK-6.6] NFSD: Reset cb_seq_status after NFS4ERR_DELAY
by Li Lingfeng 26 Sep '24

26 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.9-rc1 commit 961b4b5e86bf56a2e4b567f81682defa5cba957e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATOAX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I noticed that once an NFSv4.1 callback operation gets a NFS4ERR_DELAY status on CB_SEQUENCE and then the connection is lost, the callback client loops, resending it indefinitely. The switch arm in nfsd4_cb_sequence_done() that handles NFS4ERR_DELAY uses rpc_restart_call() to rearm the RPC state machine for the retransmit, but that path does not call the rpc_prepare_call callback again. Thus cb_seq_status is set to -10008 by the first NFS4ERR_DELAY result, but is never set back to 1 for the retransmits. nfsd4_cb_sequence_done() thinks it's getting nothing but a long series of CB_SEQUENCE NFS4ERR_DELAY replies. Fixes: 7ba6cad6c88f ("nfsd: New helper nfsd4_cb_sequence_done() for processing more cb errors") Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index 4039ffcf90ba..49a88dde9631 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1202,6 +1202,7 @@ static bool nfsd4_cb_sequence_done(struct rpc_task *task, struct nfsd4_callback ret = false; break; case -NFS4ERR_DELAY: + cb->cb_seq_status = 1; if (!rpc_restart_call(task)) goto out; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v5.10.226 commit 6c563a29857aa8053b67ee141191f69757f27f6e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pktgen: use cpus_read_lock() in pg_net_init()
by Wang Liang 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.11-rc6 commit 979b581e4c69257acab1af415ddad6b2d78a2fa5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4B3 CVE: CVE-2024-46681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240821175339.1191779-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/pktgen.c [conflicts due to not mergered f568a3d49af9 ("bpf,lsm: Add BPF token LSM hooks") which include linux/bpf.h, and lead to inclusion of linux/cpu.h indirectly. The commit(f568a3d49af9) is complex and irrelevant to this problem. To solve the compile error, include linux/cpu.h manually.] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/pktgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 3fba429f1f57..89ac59ff6598 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -170,6 +170,7 @@ #include <linux/uaccess.h> #include <asm/dma.h> #include <asm/div64.h> /* do_div */ +#include <linux/cpu.h> #define VERSION "2.75" #define IP_NAME_SZ 32 @@ -3464,7 +3465,7 @@ static int pktgen_thread_worker(void *arg) struct pktgen_dev *pkt_dev = NULL; int cpu = t->cpu; - WARN_ON(smp_processor_id() != cpu); + WARN_ON_ONCE(smp_processor_id() != cpu); init_waitqueue_head(&t->queue); complete(&t->start_done); @@ -3800,6 +3801,7 @@ static int __net_init pg_net_init(struct net *net) goto remove; } + cpus_read_lock(); for_each_online_cpu(cpu) { int err; @@ -3808,6 +3810,7 @@ static int __net_init pg_net_init(struct net *net) pr_warn("Cannot create thread for cpu %d (%d)\n", cpu, err); } + cpus_read_unlock(); if (list_empty(&pn->pktgen_threads)) { pr_err("Initialization failed for all threads\n"); -- 2.34.1

2 1

[PATCH OLK-5.10] pktgen: use cpus_read_lock() in pg_net_init()
by Wang Liang 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.11-rc6 commit 979b581e4c69257acab1af415ddad6b2d78a2fa5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4B3 CVE: CVE-2024-46681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240821175339.1191779-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/pktgen.c [conflicts due to not mergered f568a3d49af9 ("bpf,lsm: Add BPF token LSM hooks") which include linux/bpf.h, and lead to inclusion of linux/cpu.h indirectly. The commit(f568a3d49af9) is complex and irrelevant to this problem. To solve the compile error, include linux/cpu.h manually.] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/pktgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index c1e3d3bea128..28ba48d836d5 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -170,6 +170,7 @@ #include <linux/uaccess.h> #include <asm/dma.h> #include <asm/div64.h> /* do_div */ +#include <linux/cpu.h> #define VERSION "2.75" #define IP_NAME_SZ 32 @@ -3464,7 +3465,7 @@ static int pktgen_thread_worker(void *arg) struct pktgen_dev *pkt_dev = NULL; int cpu = t->cpu; - WARN_ON(smp_processor_id() != cpu); + WARN_ON_ONCE(smp_processor_id() != cpu); init_waitqueue_head(&t->queue); complete(&t->start_done); @@ -3800,6 +3801,7 @@ static int __net_init pg_net_init(struct net *net) goto remove; } + cpus_read_lock(); for_each_online_cpu(cpu) { int err; @@ -3808,6 +3810,7 @@ static int __net_init pg_net_init(struct net *net) pr_warn("Cannot create thread for cpu %d (%d)\n", cpu, err); } + cpus_read_unlock(); if (list_empty(&pn->pktgen_threads)) { pr_err("Initialization failed for all threads\n"); -- 2.34.1

2 1

[PATCH OLK-5.10 v2] drm/amd/display: Ensure index calculation will not overflow
by Tong Tiangen 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.1-rc1 commit 8e2734bf444767fed787305ccdcb36a2be5301a2 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV8L CVE: CVE-2024-46726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess array size. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c [Conflicts from: 1) commit 552b7cb0eed1 move drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c to drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c; 2) commit 91954c6c904b move dcn_bw_update_from_pplib() to dcn_bw_update_from_pplib_fclks() and the code logic is the same.] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c index 51397b565ddf..2186603d915c 100644 --- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c +++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c @@ -1498,10 +1498,9 @@ void dcn_bw_update_from_pplib(struct dc *dc) ASSERT(fclks.num_levels); vmin0p65_idx = 0; - vmid0p72_idx = fclks.num_levels - - (fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1)); - vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1); - vmax0p9_idx = fclks.num_levels - 1; + vmid0p72_idx = fclks.num_levels > 2 ? fclks.num_levels - 3 : 0; + vnom0p8_idx = fclks.num_levels > 1 ? fclks.num_levels - 2 : 0; + vmax0p9_idx = fclks.num_levels > 0 ? fclks.num_levels - 1 : 0; dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0; -- 2.25.1

2 1

[PATCH OLK-6.6] pktgen: use cpus_read_lock() in pg_net_init()
by Wang Liang 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.11-rc6 commit 979b581e4c69257acab1af415ddad6b2d78a2fa5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR4B3 CVE: CVE-2024-46681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must use cpus_read_lock()/cpus_read_unlock() around the for_each_online_cpu(cpu) loop. While we are at it use WARN_ON_ONCE() to avoid a possible syslog flood. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240821175339.1191779-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/pktgen.c [conflicts due to not mergered f568a3d49af9 ("bpf,lsm: Add BPF token LSM hooks") which include linux/bpf.h, and lead to inclusion of linux/cpu.h indirectly. The commit(f568a3d49af9) is complex and irrelevant to this problem. To solve the compile error, include linux/cpu.h manually.] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/pktgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 0e472f6fab85..473503217201 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -170,6 +170,7 @@ #include <linux/uaccess.h> #include <asm/dma.h> #include <asm/div64.h> /* do_div */ +#include <linux/cpu.h> #define VERSION "2.75" #define IP_NAME_SZ 32 @@ -3605,7 +3606,7 @@ static int pktgen_thread_worker(void *arg) struct pktgen_dev *pkt_dev = NULL; int cpu = t->cpu; - WARN_ON(smp_processor_id() != cpu); + WARN_ON_ONCE(smp_processor_id() != cpu); init_waitqueue_head(&t->queue); complete(&t->start_done); @@ -3941,6 +3942,7 @@ static int __net_init pg_net_init(struct net *net) goto remove; } + cpus_read_lock(); for_each_online_cpu(cpu) { int err; @@ -3949,6 +3951,7 @@ static int __net_init pg_net_init(struct net *net) pr_warn("Cannot create thread for cpu %d (%d)\n", cpu, err); } + cpus_read_unlock(); if (list_empty(&pn->pktgen_threads)) { pr_err("Initialization failed for all threads\n"); -- 2.34.1

2 1

[PATCH OLK-5.10] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v5.10.226 commit 6c563a29857aa8053b67ee141191f69757f27f6e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] memcg_write_event_control(): fix a user-triggerable oops
by Jinjiang Tu 26 Sep '24

26 Sep '24

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v4.19.321 commit fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJK CVE: CVE-2024-45021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 046667c4d3196938e992fba0dfcde570aa85cd0e upstream. we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane). Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") Cc: stable(a)vger.kernel.org Cc: Andrew Morton <akpm(a)linux-foundation.org> Acked-by: Michal Hocko <mhocko(a)suse.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/memcontrol.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index f6b6a6c4b491..778e1b5bf80a 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4578,9 +4578,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, buf = endp + 1; cfd = simple_strtoul(buf, &endp, 10); - if ((*endp != ' ') && (*endp != '\0')) + if (*endp == '\0') + buf = endp; + else if (*endp == ' ') + buf = endp + 1; + else return -EINVAL; - buf = endp + 1; event = kzalloc(sizeof(*event), GFP_KERNEL); if (!event) -- 2.34.1

2 1

[PATCH OLK-6.6] hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
by Tong Tiangen 26 Sep '24

26 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v6.6.51 commit 8fecb75bff1b7d87a071c32a37aa0700f2be379d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX5F CVE: CVE-2024-46756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c1de37969b7bc0abcb20b86e91e70caebbd4f89 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/hwmon/w83627ehf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c index fe960c0a624f..7d7d70afde65 100644 --- a/drivers/hwmon/w83627ehf.c +++ b/drivers/hwmon/w83627ehf.c @@ -895,7 +895,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -920,7 +920,7 @@ store_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit the temp to 0C - 15C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000); mutex_lock(&data->update_lock); reg = w83627ehf_read_value(data, W83627EHF_REG_TOLERANCE[nr]); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
by Tong Tiangen 26 Sep '24

26 Sep '24

From: Guenter Roeck <linux(a)roeck-us.net> stable inclusion from stable-v4.19.322 commit 93cf73a7bfdce683bde3a7bb65f270d3bd24497b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX5F CVE: CVE-2024-46756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c1de37969b7bc0abcb20b86e91e70caebbd4f89 ] DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/hwmon/w83627ehf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c index ad68b6d9ff17..8da5f77b8987 100644 --- a/drivers/hwmon/w83627ehf.c +++ b/drivers/hwmon/w83627ehf.c @@ -1519,7 +1519,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 127); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 127000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -1545,7 +1545,7 @@ store_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit the temp to 0C - 15C */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 15); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 15000), 1000); mutex_lock(&data->update_lock); if (sio_data->kind == nct6775 || sio_data->kind == nct6776) { -- 2.25.1

2 1

[PATCH OLK-6.6] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v6.6.51 commit 39e7e593418ccdbd151f2925fa6be1a616d16c96 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-6.6] char: xillybus: Check USB endpoints when probing device
by Ye Bin 26 Sep '24

26 Sep '24

From: Eli Billauer <eli.billauer(a)gmail.com> stable inclusion from stable-v6.6.48 commit 5cff754692ad45d5086b75fef8cc3a99c30a1005 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJN CVE: CVE-2024-45011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2374bf7558de915edc6ec8cb10ec3291dfab9594 upstream. Ensure, as the driver probes the device, that all endpoints that the driver may attempt to access exist and are of the correct type. All XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at address 1. This is verified in xillyusb_setup_base_eps(). On top of that, a XillyUSB device may have additional Bulk OUT endpoints. The information about these endpoints' addresses is deduced from a data structure (the IDT) that the driver fetches from the device while probing it. These endpoints are checked in setup_channels(). A XillyUSB device never has more than one IN endpoint, as all data towards the host is multiplexed in this single Bulk IN endpoint. This is why setup_channels() only checks OUT endpoints. Reported-by: syzbot+eac39cba052f2e750dbe(a)syzkaller.appspotmail.com Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/all/0000000000001d44a6061f7a54ee@google.com/T/ Fixes: a53d1202aef1 ("char: xillybus: Add driver for XillyUSB (Xillybus variant for USB)"). Signed-off-by: Eli Billauer <eli.billauer(a)gmail.com> Link: https://lore.kernel.org/r/20240816070200.50695-2-eli.billauer@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/char/xillybus/xillyusb.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/drivers/char/xillybus/xillyusb.c b/drivers/char/xillybus/xillyusb.c index 5a5afa14ca8c..613c366a2df6 100644 --- a/drivers/char/xillybus/xillyusb.c +++ b/drivers/char/xillybus/xillyusb.c @@ -1906,6 +1906,13 @@ static const struct file_operations xillyusb_fops = { static int xillyusb_setup_base_eps(struct xillyusb_dev *xdev) { + struct usb_device *udev = xdev->udev; + + /* Verify that device has the two fundamental bulk in/out endpoints */ + if (usb_pipe_type_check(udev, usb_sndbulkpipe(udev, MSG_EP_NUM)) || + usb_pipe_type_check(udev, usb_rcvbulkpipe(udev, IN_EP_NUM))) + return -ENODEV; + xdev->msg_ep = endpoint_alloc(xdev, MSG_EP_NUM | USB_DIR_OUT, bulk_out_work, 1, 2); if (!xdev->msg_ep) @@ -1935,14 +1942,15 @@ static int setup_channels(struct xillyusb_dev *xdev, __le16 *chandesc, int num_channels) { - struct xillyusb_channel *chan; + struct usb_device *udev = xdev->udev; + struct xillyusb_channel *chan, *new_channels; int i; chan = kcalloc(num_channels, sizeof(*chan), GFP_KERNEL); if (!chan) return -ENOMEM; - xdev->channels = chan; + new_channels = chan; for (i = 0; i < num_channels; i++, chan++) { unsigned int in_desc = le16_to_cpu(*chandesc++); @@ -1971,6 +1979,15 @@ static int setup_channels(struct xillyusb_dev *xdev, */ if ((out_desc & 0x80) && i < 14) { /* Entry is valid */ + if (usb_pipe_type_check(udev, + usb_sndbulkpipe(udev, i + 2))) { + dev_err(xdev->dev, + "Missing BULK OUT endpoint %d\n", + i + 2); + kfree(new_channels); + return -ENODEV; + } + chan->writable = 1; chan->out_synchronous = !!(out_desc & 0x40); chan->out_seekable = !!(out_desc & 0x20); @@ -1980,6 +1997,7 @@ static int setup_channels(struct xillyusb_dev *xdev, } } + xdev->channels = new_channels; return 0; } -- 2.34.1

2 1

[openeuler:OLK-6.6 8439/14122] cpu.c:undefined reference to `trace_event_buffer_commit'
by kernel test robot 26 Sep '24

26 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: 4c7a7e37c75ec2611be134d953ae976bc25c793b [8439/14122] LoongArch: Change __my_cpu_offset definition to avoid mis-optimization config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240926/202409261955.pho8kSov-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240926/202409261955.pho8kSov-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409261955.pho8kSov-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `sound/core/pcm_lib.o' being placed in section `_ftrace_events' loongarch64-linux-ld: warning: orphan section `_ftrace_events' from `lib/maple_tree.o' being placed in section `_ftrace_events' loongarch64-linux-ld: init/main.o: in function `.L199': main.c:(.text+0x1f0): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x22c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_start': main.c:(.text+0x364): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x38c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `perf_trace_initcall_finish': main.c:(.text+0x44c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: main.c:(.text+0x478): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_start': main.c:(.text+0x550): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x560): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L240': main.c:(.text+0x5a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_finish': main.c:(.text+0x620): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x634): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L251': main.c:(.text+0x688): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o: in function `.L247': main.c:(.text+0x6bc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_level': main.c:(.text+0x714): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x734): undefined reference to `trace_handle_return' loongarch64-linux-ld: main.c:(.text+0x75c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_start': main.c:(.text+0x7b0): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x7d0): undefined reference to `trace_handle_return' loongarch64-linux-ld: main.c:(.text+0x7fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: init/main.o: in function `trace_raw_output_initcall_finish': main.c:(.text+0x854): undefined reference to `trace_event_printf' loongarch64-linux-ld: main.c:(.text+0x874): undefined reference to `trace_handle_return' loongarch64-linux-ld: init/main.o: in function `trace_event_raw_event_initcall_level': main.c:(.text+0x8f8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: main.c:(.text+0x914): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: init/main.o: in function `.L312': main.c:(.text+0x97c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: init/main.o: in function `.L299': main.c:(.text+0x9c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: init/main.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: init/main.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: init/main.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_newtask': fork.c:(.text+0x168): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L34': fork.c:(.text+0x1bc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L33': fork.c:(.text+0x238): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_newtask': fork.c:(.text+0x2f4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `.L39': fork.c:(.text+0x32c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L35': fork.c:(.text+0x36c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o: in function `.L36': fork.c:(.text+0x3a4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_newtask': fork.c:(.text+0x3fc): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x41c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L52': fork.c:(.text+0x444): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/fork.o: in function `trace_raw_output_task_rename': fork.c:(.text+0x49c): undefined reference to `trace_event_printf' loongarch64-linux-ld: fork.c:(.text+0x4bc): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/fork.o: in function `.L58': fork.c:(.text+0x520): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `perf_trace_task_rename': fork.c:(.text+0x580): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/fork.o: in function `.L59': fork.c:(.text+0x5f8): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/fork.o: in function `.L70': fork.c:(.text+0x6b8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/fork.o: in function `trace_event_raw_event_task_rename': fork.c:(.text+0x6fc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/fork.o: in function `.L77': fork.c:(.text+0x748): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/fork.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_enter': cpu.c:(.text+0x2cc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L35': cpu.c:(.text+0x300): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_multi_enter': cpu.c:(.text+0x3dc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L47': cpu.c:(.text+0x410): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `perf_trace_cpuhp_exit': cpu.c:(.text+0x4fc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cpu.o: in function `.L59': cpu.c:(.text+0x530): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_enter': cpu.c:(.text+0x628): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cpu.o: in function `.L74': >> cpu.c:(.text+0x644): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L70': cpu.c:(.text+0x6a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_multi_enter': cpu.c:(.text+0x730): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x74c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L81': cpu.c:(.text+0x7a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cpu.o: in function `trace_event_raw_event_cpuhp_exit': cpu.c:(.text+0x830): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cpu.c:(.text+0x84c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cpu.o: in function `.L92': cpu.c:(.text+0x8a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: cpu.c:(.text+0x8dc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cpu.o: in function `trace_raw_output_cpuhp_enter': cpu.c:(.text+0x93c): undefined reference to `trace_event_printf' loongarch64-linux-ld: cpu.c:(.text+0x95c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cpu.o: in function `.L108': >> cpu.c:(.text+0x984): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cpu.o: in function `trace_raw_output_cpuhp_multi_enter': cpu.c:(.text+0x9dc): undefined reference to `trace_event_printf' loongarch64-linux-ld: cpu.c:(.text+0x9fc): undefined reference to `trace_handle_return' loongarch64-linux-ld: cpu.c:(.text+0xa24): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cpu.o: in function `trace_raw_output_cpuhp_exit': cpu.c:(.text+0xa7c): undefined reference to `trace_event_printf' loongarch64-linux-ld: cpu.c:(.text+0xa9c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cpu.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o: in function `perf_trace_irq_handler_exit': softirq.c:(.text+0x454): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L74': softirq.c:(.text+0x480): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `perf_trace_softirq': softirq.c:(.text+0x544): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L86': softirq.c:(.text+0x56c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `perf_trace_tasklet': softirq.c:(.text+0x62c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L98': softirq.c:(.text+0x658): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_irq_handler_exit': softirq.c:(.text+0x738): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: softirq.c:(.text+0x74c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `.L109': softirq.c:(.text+0x7a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_softirq': softirq.c:(.text+0x818): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: softirq.c:(.text+0x828): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `.L120': softirq.c:(.text+0x868): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_tasklet': softirq.c:(.text+0x8e0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: softirq.c:(.text+0x8f4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `.L131': softirq.c:(.text+0x948): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: softirq.c:(.text+0x97c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_irq_handler_entry': softirq.c:(.text+0x9d8): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0x9f8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/softirq.o: in function `.L147': softirq.c:(.text+0xa24): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_irq_handler_exit': softirq.c:(.text+0xa50): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0xa70): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/softirq.o: in function `.L153': softirq.c:(.text+0xaf4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_tasklet': softirq.c:(.text+0xb54): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0xb74): undefined reference to `trace_handle_return' loongarch64-linux-ld: softirq.c:(.text+0xb9c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/softirq.o: in function `trace_raw_output_softirq': softirq.c:(.text+0xbf4): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: softirq.c:(.text+0xc0c): undefined reference to `trace_event_printf' loongarch64-linux-ld: softirq.c:(.text+0xc2c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/softirq.o: in function `.L206': softirq.c:(.text+0xff4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/softirq.o: in function `.L205': softirq.c:(.text+0x1044): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/softirq.o: in function `.L230': softirq.c:(.text+0x11d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/softirq.o: in function `.L227': softirq.c:(.text+0x1204): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/softirq.o: in function `trace_event_raw_event_irq_handler_entry': softirq.c:(.text+0x1288): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/softirq.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/signal.o: in function `perf_trace_signal_generate': signal.c:(.text+0x260): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/signal.o: in function `.L30': signal.c:(.text+0x2cc): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/signal.o: in function `.L41': signal.c:(.text+0x358): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/signal.o: in function `perf_trace_signal_deliver': signal.c:(.text+0x414): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/signal.o: in function `.L49': signal.c:(.text+0x468): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/signal.o: in function `trace_event_raw_event_signal_generate': signal.c:(.text+0x590): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/signal.o: in function `.L66': signal.c:(.text+0x5e0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/signal.o: in function `.L62': signal.c:(.text+0x688): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/signal.o: in function `trace_event_raw_event_signal_deliver': signal.c:(.text+0x708): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: signal.c:(.text+0x748): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/signal.o: in function `.L78': signal.c:(.text+0x7e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/signal.o: in function `.L92': signal.c:(.text+0x81c): undefined reference to `trace_raw_output_prep' -- update.c:(.text+0x630): undefined reference to `trace_event_printf' loongarch64-linux-ld: update.c:(.text+0x650): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rcu/update.o: in function `.L88': update.c:(.text+0x67c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/rcu/update.o: in function `trace_raw_output_rcu_stall_warning': update.c:(.text+0x6d4): undefined reference to `trace_event_printf' loongarch64-linux-ld: update.c:(.text+0x6f4): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/rcu/update.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L51': swiotlb.c:(.text+0x46c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `trace_raw_output_swiotlb_bounced': swiotlb.c:(.text+0x4a8): undefined reference to `trace_event_printf' loongarch64-linux-ld: swiotlb.c:(.text+0x4c8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L237': swiotlb.c:(.text+0x11c4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `perf_trace_swiotlb_bounced': swiotlb.c:(.text+0x1234): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L239': swiotlb.c:(.text+0x1394): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L264': swiotlb.c:(.text+0x13ec): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `trace_event_raw_event_swiotlb_bounced': swiotlb.c:(.text+0x147c): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/dma/swiotlb.o: in function `.L293': swiotlb.c:(.text+0x14e8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/dma/swiotlb.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/dma/swiotlb.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/entry/common.o: in function `.L22': common.c:(.text+0x154): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: common.c:(.text+0x184): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/entry/common.o: in function `perf_trace_sys_enter': common.c:(.text+0x250): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/entry/common.o: in function `.L46': common.c:(.text+0x298): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/entry/common.o: in function `.L33': common.c:(.text+0x318): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_event_raw_event_sys_enter': common.c:(.text+0x3d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/entry/common.o: in function `.L51': common.c:(.text+0x404): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/entry/common.o: in function `.L47': common.c:(.text+0x448): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_event_raw_event_sys_exit': common.c:(.text+0x4c0): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: common.c:(.text+0x4dc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/entry/common.o: in function `.L58': common.c:(.text+0x528): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: common.c:(.text+0x55c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_raw_output_sys_enter': common.c:(.text+0x5cc): undefined reference to `trace_event_printf' loongarch64-linux-ld: common.c:(.text+0x5ec): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/entry/common.o: in function `.L74': common.c:(.text+0x614): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/entry/common.o: in function `trace_raw_output_sys_exit': common.c:(.text+0x674): undefined reference to `trace_event_printf' loongarch64-linux-ld: common.c:(.text+0x694): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/entry/common.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o: in function `.L114': timer.c:(.text+0x814): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_timer_class': timer.c:(.text+0x83c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_timer_start': timer.c:(.text+0x914): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: timer.c:(.text+0x958): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L143': timer.c:(.text+0xa2c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_timer_expire_entry': timer.c:(.text+0xa6c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L144': timer.c:(.text+0xb34): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_hrtimer_init': timer.c:(.text+0xb64): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L156': timer.c:(.text+0xc2c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `perf_trace_hrtimer_start': timer.c:(.text+0xc70): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L168': timer.c:(.text+0xd2c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `.L179': timer.c:(.text+0xd64): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L180': timer.c:(.text+0xe24): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: timer.c:(.text+0xe4c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L192': timer.c:(.text+0xf14): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/timer.o: in function `.L203': timer.c:(.text+0xf60): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L204': timer.c:(.text+0x1034): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: timer.c:(.text+0x1070): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L219': timer.c:(.text+0x1130): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L216': timer.c:(.text+0x1140): undefined reference to `trace_event_buffer_commit' >> loongarch64-linux-ld: timer.c:(.text+0x1188): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_timer_class': timer.c:(.text+0x1208): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L231': timer.c:(.text+0x1238): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L232': timer.c:(.text+0x1288): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L246': timer.c:(.text+0x1300): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x132c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L242': timer.c:(.text+0x1368): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_timer_expire_entry': timer.c:(.text+0x13e8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L257': timer.c:(.text+0x1400): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L253': timer.c:(.text+0x1448): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_init': timer.c:(.text+0x14b8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x14e8): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L264': timer.c:(.text+0x152c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_start': timer.c:(.text+0x15a8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x15cc): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L279': timer.c:(.text+0x1608): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L276': timer.c:(.text+0x1678): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: timer.c:(.text+0x1688): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_expire_entry': timer.c:(.text+0x16c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L286': timer.c:(.text+0x1748): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `.L287': timer.c:(.text+0x1780): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_hrtimer_class': timer.c:(.text+0x17c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/timer.o: in function `.L298': timer.c:(.text+0x1848): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_itimer_state': timer.c:(.text+0x186c): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/timer.o: in function `.L312': timer.c:(.text+0x18c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: timer.c:(.text+0x18fc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `.L308': timer.c:(.text+0x1950): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_event_raw_event_itimer_expire': timer.c:(.text+0x1970): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x199c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `.L324': timer.c:(.text+0x19fc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/time/timer.o: in function `.L319': timer.c:(.text+0x1a1c): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1a44): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_timer_class': timer.c:(.text+0x1a98): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1ab8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/timer.o: in function `.L338': timer.c:(.text+0x1ae4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_timer_expire_entry': timer.c:(.text+0x1b30): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1b50): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1b7c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_hrtimer_expire_entry': timer.c:(.text+0x1bf0): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1c10): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1c3c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_hrtimer_class': timer.c:(.text+0x1c98): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1cb8): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1ce4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_itimer_state': timer.c:(.text+0x1d84): undefined reference to `trace_print_flags_seq' loongarch64-linux-ld: kernel/time/timer.o: in function `.L362': timer.c:(.text+0x1db0): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1de0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_itimer_expire': timer.c:(.text+0x1e0c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: timer.c:(.text+0x1e68): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: kernel/time/timer.o: in function `.L368': timer.c:(.text+0x1e80): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: timer.c:(.text+0x1e9c): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/time/timer.o: in function `trace_raw_output_timer_start': timer.c:(.text+0x1ec8): undefined reference to `trace_handle_return' loongarch64-linux-ld: timer.c:(.text+0x1ef4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/timer.o: in function `.L374': timer.c:(.text+0x1f70): undefined reference to `trace_print_symbols_seq' loongarch64-linux-ld: timer.c:(.text+0x1f94): undefined reference to `trace_event_printf' loongarch64-linux-ld: timer.c:(.text+0x1fc0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x138): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x160): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x180): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x1a8): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x1c8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x1f0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x210): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x238): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x258): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/timer.o:(.ref.data+0x280): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `perf_trace_alarmtimer_suspend': alarmtimer.c:(.text+0x2d4): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L46': alarmtimer.c:(.text+0x300): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `perf_trace_alarm_class': alarmtimer.c:(.text+0x3cc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L58': alarmtimer.c:(.text+0x408): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_event_raw_event_alarmtimer_suspend': alarmtimer.c:(.text+0x4d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: alarmtimer.c:(.text+0x4ec): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L73': alarmtimer.c:(.text+0x528): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L70': alarmtimer.c:(.text+0x598): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_event_raw_event_alarm_class': alarmtimer.c:(.text+0x5c0): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L84': alarmtimer.c:(.text+0x60c): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L80': alarmtimer.c:(.text+0x644): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_raw_output_alarmtimer_suspend': alarmtimer.c:(.text+0x6a0): undefined reference to `trace_print_flags_seq' loongarch64-linux-ld: alarmtimer.c:(.text+0x6b8): undefined reference to `trace_event_printf' loongarch64-linux-ld: alarmtimer.c:(.text+0x6d8): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `.L96': alarmtimer.c:(.text+0x704): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/time/alarmtimer.o: in function `trace_raw_output_alarm_class': alarmtimer.c:(.text+0x76c): undefined reference to `trace_print_flags_seq' loongarch64-linux-ld: alarmtimer.c:(.text+0x78c): undefined reference to `trace_event_printf' loongarch64-linux-ld: alarmtimer.c:(.text+0x7b0): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/time/alarmtimer.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_queue_cpu': smp.c:(.text+0x214): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L30': smp.c:(.text+0x248): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `perf_trace_csd_function': smp.c:(.text+0x30c): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/smp.o: in function `.L42': smp.c:(.text+0x338): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_queue_cpu': smp.c:(.text+0x428): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/smp.o: in function `.L57': smp.c:(.text+0x444): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L53': smp.c:(.text+0x4a8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `trace_event_raw_event_csd_function': smp.c:(.text+0x520): undefined reference to `trace_event_buffer_reserve' >> loongarch64-linux-ld: smp.c:(.text+0x534): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/smp.o: in function `.L64': smp.c:(.text+0x588): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/smp.o: in function `.L65': smp.c:(.text+0x5bc): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_queue_cpu': smp.c:(.text+0x61c): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x63c): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o: in function `.L80': smp.c:(.text+0x664): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/smp.o: in function `trace_raw_output_csd_function': smp.c:(.text+0x6b4): undefined reference to `trace_event_printf' loongarch64-linux-ld: smp.c:(.text+0x6d4): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/smp.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L255': kexec_core.c:(.text+0x1b10): undefined reference to `machine_kexec_cleanup' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L296': kexec_core.c:(.text+0x1d70): undefined reference to `machine_crash_shutdown' loongarch64-linux-ld: kexec_core.c:(.text+0x1d78): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L383': kexec_core.c:(.text+0x2350): undefined reference to `machine_shutdown' loongarch64-linux-ld: kernel/kexec_core.o: in function `.L380': kexec_core.c:(.text+0x2360): undefined reference to `machine_kexec' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L128': cgroup.c:(.text+0x858): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L129': cgroup.c:(.text+0x8b0): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_event': cgroup.c:(.text+0xa58): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L147': cgroup.c:(.text+0xab8): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L168': cgroup.c:(.text+0xd70): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L21': cgroup.c:(.text+0xdb4): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L192': cgroup.c:(.text+0xe68): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: cgroup.c:(.text+0xe9c): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L189': cgroup.c:(.text+0xefc): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L200': cgroup.c:(.text+0xf1c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xf44): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L190': cgroup.c:(.text+0xfa0): undefined reference to `trace_event_printf' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_root': cgroup.c:(.text+0xfc0): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0xfec): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup': cgroup.c:(.text+0x106c): undefined reference to `trace_event_printf' loongarch64-linux-ld: cgroup.c:(.text+0x108c): undefined reference to `trace_handle_return' loongarch64-linux-ld: cgroup.c:(.text+0x10b4): undefined reference to `trace_raw_output_prep' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `trace_raw_output_cgroup_migrate': cgroup.c:(.text+0x1124): undefined reference to `trace_event_printf' loongarch64-linux-ld: cgroup.c:(.text+0x1144): undefined reference to `trace_handle_return' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L725': cgroup.c:(.text+0x3e50): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L15': cgroup.c:(.text+0x3ed4): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L756': cgroup.c:(.text+0x4020): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L761': cgroup.c:(.text+0x407c): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L779': cgroup.c:(.text+0x41d4): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L769': cgroup.c:(.text+0x4218): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: cgroup.c:(.text+0x4274): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L772': cgroup.c:(.text+0x42c8): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup_migrate': cgroup.c:(.text+0x4364): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: cgroup.c:(.text+0x4394): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L783': cgroup.c:(.text+0x43ec): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L784': cgroup.c:(.text+0x4448): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L799': cgroup.c:(.text+0x4520): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `perf_trace_cgroup': cgroup.c:(.text+0x4588): undefined reference to `trace_event_buffer_commit' loongarch64-linux-ld: kernel/cgroup/cgroup.o: in function `.L802': cgroup.c:(.text+0x4668): undefined reference to `__trace_trigger_soft_disabled' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x18): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x40): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x60): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x88): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xa8): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xd0): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0xf0): undefined reference to `trace_event_reg' loongarch64-linux-ld: kernel/cgroup/cgroup.o:(.ref.data+0x118): undefined reference to `trace_event_raw_init' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L12': error_report-traces.c:(.text+0xdc): undefined reference to `perf_trace_buf_alloc' loongarch64-linux-ld: error_report-traces.c:(.text+0x108): undefined reference to `perf_trace_run_bpf_submit' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `trace_event_raw_event_error_report_template': error_report-traces.c:(.text+0x1d8): undefined reference to `trace_event_buffer_reserve' loongarch64-linux-ld: kernel/trace/error_report-traces.o: in function `.L27': error_report-traces.c:(.text+0x1ec): undefined reference to `trace_event_buffer_commit' .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 v2 0/5] Fix CVE-2024-45025
by Long Li 26 Sep '24

26 Sep '24

This patch set fix cve-2024-45025 Al Viro (1): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE Alexander Lobakin (4): tools: move alignment-related macros to new <linux/align.h> fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64() bitmap: introduce generic optimized bitmap_size() s390/cio: rename bitmap_size() -> idset_bitmap_size() drivers/md/dm-clone-metadata.c | 5 --- drivers/s390/cio/idset.c | 12 ++++--- fs/file.c | 30 +++++++--------- fs/ntfs3/bitmap.c | 4 +-- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 11 +++--- fs/ntfs3/ntfs_fs.h | 4 +-- fs/ntfs3/super.c | 2 +- include/linux/bitmap.h | 20 +++++++++-- include/linux/cpumask.h | 2 +- lib/math/prime_numbers.c | 2 -- tools/include/linux/align.h | 12 +++++++ tools/include/linux/bitmap.h | 9 ++--- .../testing/selftests/core/close_range_test.c | 35 +++++++++++++++++++ 14 files changed, 102 insertions(+), 48 deletions(-) create mode 100644 tools/include/linux/align.h -- 2.39.2

2 6

[PATCH OLK-6.6] arm64/mpam: Fix redefined reference of 'mpam_detect_is_enabled'
by Zeng Heng 26 Sep '24

26 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATSCU -------------------------------- Fix re-defined reference of 'mpam_detect_is_enabled' when CONFIG_ARM64_MPAM is enabled. Fixes: 797c68d3b52d ("arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/cpufeature.h | 7 ------- 1 file changed, 7 deletions(-) diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index f8ec4b20fa69..4c759e0dcc21 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -858,14 +858,7 @@ static inline bool cpus_support_mpam(void) cpus_have_final_cap(ARM64_MPAM); } -#ifdef CONFIG_ARM64_MPAM bool mpam_detect_is_enabled(void); -#else -static inline bool mpam_detect_is_enabled(void) -{ - return false; -} -#endif int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt); bool try_emulate_mrs(struct pt_regs *regs, u32 isn); -- 2.25.1

2 1

[PATCH OLK-5.10] acpi/arm64: Do not add CPU to node_to_cpumask_map in acpi_map_cpu()
by Xiongfeng Wang 26 Sep '24

26 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATDZ5 CVE: NA -------------------------------- When two vCPUs of NUMA1 are hot added and then taken to online, e.g.: In qemu monitor: device_add host-arm-cpu,socket-id=1,cluster-id=0,core-id=0, thread-id=0,id=core4 device_add host-arm-cpu,socket-id=1,cluster-id=0,core-id=0, thread-id=1,id=core5 In guest: echo 1 > /sys/devices/system/cpu/cpu4/online it will appear calltrace as below: WARNING: CPU: 4 PID: 286 at kernel/sched/core.c:2293 __set_cpus_allowed_ptr+0x468/0x4d4 Modules linked in: ... CPU: 4 PID: 286 Comm: cpuhp/4 Tainted: G W OE 5.10.0 #1 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 20400085 (nzCv daIf +PAN -UAO -TCO BTYPE=--) pc : __set_cpus_allowed_ptr+0x468/0x4d4 lr : __set_cpus_allowed_ptr+0x440/0x4d4 sp : ffff800010a43c30 x29: ffff800010a43c30 x28: ffff4e2fbffe7c40 x27: ffffa34037fcb450 x26: ffffa340372f2000 x25: 0000000000000004 x24: ffffa34037c47140 x23: ffff4e2f3ffc7480 x22: 0000000000000000 x21: ffff4e2ec0fee040 x20: ffffa34037cb8530 x19: ffffa34037cb7c80 x18: ffff4e2f80242787 x17: 00000000248943a4 x16: 0000000000000000 x15: ffff800010760000 x14: 0000000000001000 x13: ffff80000fffffff x12: 0000000000007290 x11: ffff4e2fbffeeed0 x10: ffffa3403826eea8 x9 : ffffa340341b8290 x8 : 0000000000000000 x7 : ffffa3403826a3c8 x6 : ffff4e2ec0fee4f8 x5 : 0000000000000000 x4 : 00000000000007c7 x3 : ffffffffffffffff x2 : 00000000000000ff x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __set_cpus_allowed_ptr+0x468/0x4d4 set_cpus_allowed_ptr+0x38/0x5c kcompactd_cpu_online+0xb0/0x190 cpuhp_invoke_callback+0x274/0xbb0 cpuhp_thread_fun+0x188/0x36c smpboot_thread_fn+0x144/0x380 kthread+0x190/0x1fc ret_from_fork+0x10/0x18 When the WARN_ON occurs, the mask variables is as follows. new_mask: 0-4 activ_mask:0-3 nr_cpus_allowed:2 numa_add_cpu() is called in secondary_start_kernel() when the CPU is brought up online. We need to remove numa_add_cpu() in acpi_map_cpu(). So it is for arch/x86. Also fix it in acpi_unmap_cpu() as well. Fixes: 7eaf6534f708 ("arm64: Add CPU hotplug support") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Zhou Wang <wangzhou1(a)hisilicon.com> --- arch/arm64/kernel/acpi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c index a81105cfe57e2..f043bec3ba50f 100644 --- a/arch/arm64/kernel/acpi.c +++ b/arch/arm64/kernel/acpi.c @@ -417,7 +417,6 @@ int acpi_map_cpu(acpi_handle handle, phys_cpuid_t physid, u32 acpi_id, nid = acpi_get_node(handle); if (nid != NUMA_NO_NODE) { set_cpu_numa_node(cpu, nid); - numa_add_cpu(cpu); } *pcpu = cpu; @@ -430,7 +429,7 @@ EXPORT_SYMBOL(acpi_map_cpu); int acpi_unmap_cpu(int cpu) { set_cpu_present(cpu, false); - numa_clear_node(cpu); + set_cpu_numa_node(cpu, NUMA_NO_NODE); return 0; } -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> stable inclusion from stable-v4.19.322 commit f6365931bf7c07b2b397dbb06a4f6573cc9fae73 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 upstream. When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Link: https://lore.kernel.org/r/20240828154338.754746-1-david.fernandez.gonzalez@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index da1ee2e1ba99..2779704e128a 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -152,7 +152,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-46777 for 4.19
by Wupeng Ma 26 Sep '24

26 Sep '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix cve for CVE-2024-46777. Jan Kara (2): udf: Define EFSCORRUPTED error code udf: Avoid excessive partition lengths fs/udf/super.c | 15 +++++++++++++++ fs/udf/udf_sb.h | 2 ++ 2 files changed, 17 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] bcache: fix variable length array abuse in btree_iter
by Yuan Can 26 Sep '24

26 Sep '24

From: Matthew Mirvish <matthew(a)mm12.xyz> stable inclusion from stable-v5.10.221 commit 2c3d7b03b658dc8bfa6112b194b67b92a87e081b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB04K CVE: CVE-2024-39482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 upstream. btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array. Cc: stable(a)vger.kernel.org Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368 Signed-off-by: Matthew Mirvish <matthew(a)mm12.xyz> Signed-off-by: Coly Li <colyli(a)suse.de> Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/md/bcache/bset.c | 44 +++++++++++++++++------------------ drivers/md/bcache/bset.h | 28 ++++++++++++++-------- drivers/md/bcache/btree.c | 40 ++++++++++++++++--------------- drivers/md/bcache/super.c | 5 ++-- drivers/md/bcache/sysfs.c | 2 +- drivers/md/bcache/writeback.c | 10 ++++---- 6 files changed, 70 insertions(+), 59 deletions(-) diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c index 94d38e8a59b3..cb544207427b 100644 --- a/drivers/md/bcache/bset.c +++ b/drivers/md/bcache/bset.c @@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b) int __bch_count_data(struct btree_keys *b) { unsigned int ret = 0; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k; if (b->ops->is_extents) @@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...) { va_list args; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; const char *err; for_each_key(b, k, &iter) { @@ -879,7 +879,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, unsigned int status = BTREE_INSERT_STATUS_NO_INSERT; struct bset *i = bset_tree_last(b)->data; struct bkey *m, *prev = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey preceding_key_on_stack = ZERO_KEY; struct bkey *preceding_key_p = &preceding_key_on_stack; @@ -895,9 +895,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, else preceding_key(k, &preceding_key_p); - m = bch_btree_iter_init(b, &iter, preceding_key_p); + m = bch_btree_iter_stack_init(b, &iter, preceding_key_p); - if (b->ops->insert_fixup(b, k, &iter, replace_key)) + if (b->ops->insert_fixup(b, k, &iter.iter, replace_key)) return status; status = BTREE_INSERT_STATUS_INSERT; @@ -1100,33 +1100,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, btree_iter_cmp)); } -static struct bkey *__bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search, - struct bset_tree *start) +static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search, + struct bset_tree *start) { struct bkey *ret = NULL; - iter->size = ARRAY_SIZE(iter->data); - iter->used = 0; + iter->iter.size = ARRAY_SIZE(iter->stack_data); + iter->iter.used = 0; #ifdef CONFIG_BCACHE_DEBUG - iter->b = b; + iter->iter.b = b; #endif for (; start <= bset_tree_last(b); start++) { ret = bch_bset_search(b, start, search); - bch_btree_iter_push(iter, ret, bset_bkey_last(start->data)); + bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data)); } return ret; } -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, struct bkey *search) { - return __bch_btree_iter_init(b, iter, search, b->set); + return __bch_btree_iter_stack_init(b, iter, search, b->set); } static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter, @@ -1293,10 +1293,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, struct bset_sort_state *state) { size_t order = b->page_order, keys = 0; - struct btree_iter iter; + struct btree_iter_stack iter; int oldsize = bch_count_data(b); - __bch_btree_iter_init(b, &iter, NULL, &b->set[start]); + __bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]); if (start) { unsigned int i; @@ -1307,7 +1307,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, order = get_order(__set_bytes(b->set->data, keys)); } - __btree_sort(b, &iter, start, order, false, state); + __btree_sort(b, &iter.iter, start, order, false, state); EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize); } @@ -1323,11 +1323,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new, struct bset_sort_state *state) { uint64_t start_time = local_clock(); - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(b, &iter, NULL); + bch_btree_iter_stack_init(b, &iter, NULL); - btree_mergesort(b, new->set->data, &iter, false, true); + btree_mergesort(b, new->set->data, &iter.iter, false, true); bch_time_stats_update(&state->time, start_time); diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h index d795c84246b0..011f6062c4c0 100644 --- a/drivers/md/bcache/bset.h +++ b/drivers/md/bcache/bset.h @@ -321,7 +321,14 @@ struct btree_iter { #endif struct btree_iter_set { struct bkey *k, *end; - } data[MAX_BSETS]; + } data[]; +}; + +/* Fixed-size btree_iter that can be allocated on the stack */ + +struct btree_iter_stack { + struct btree_iter iter; + struct btree_iter_set stack_data[MAX_BSETS]; }; typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k); @@ -333,9 +340,9 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter, void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, struct bkey *end); -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search); +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search); struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t, const struct bkey *search); @@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b, return search ? __bch_bset_search(b, t, search) : t->data->start; } -#define for_each_key_filter(b, k, iter, filter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next_filter((iter), (b), filter));) +#define for_each_key_filter(b, k, stack_iter, filter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \ + filter));) -#define for_each_key(b, k, iter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next(iter));) +#define for_each_key(b, k, stack_iter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next(&((stack_iter)->iter)));) /* Sorting */ diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c index 98daa9d200f7..da24a3ca69e5 100644 --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1274,7 +1274,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc) uint8_t stale = 0; unsigned int keys = 0, good_keys = 0; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct bset_tree *t; gc->nodes++; @@ -1533,7 +1533,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op, static unsigned int btree_gc_count_keys(struct btree *b) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; unsigned int ret = 0; for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) @@ -1574,17 +1574,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op, int ret = 0; bool should_rewrite; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct gc_merge_info r[GC_MERGE_NODES]; struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1; - bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done); + bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done); for (i = r; i < r + ARRAY_SIZE(r); i++) i->b = ERR_PTR(-EINTR); while (1) { - k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad); + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad); if (k) { r->b = bch_btree_node_get(b->c, op, k, b->level - 1, true, b); @@ -1874,7 +1875,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) { int ret = 0; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid) bch_initial_mark_key(b->c, b->level, k); @@ -1882,10 +1883,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) bch_initial_mark_key(b->c, b->level + 1, &b->key); if (b->level) { - bch_btree_iter_init(&b->keys, &iter, NULL); + bch_btree_iter_stack_init(&b->keys, &iter, NULL); do { - k = bch_btree_iter_next_filter(&iter, &b->keys, + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad); if (k) { btree_node_prefetch(b, k); @@ -1913,7 +1914,7 @@ static int bch_btree_check_thread(void *arg) struct btree_check_info *info = arg; struct btree_check_state *check_state = info->state; struct cache_set *c = check_state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; @@ -1922,8 +1923,8 @@ static int bch_btree_check_thread(void *arg) ret = 0; /* root node keys are checked before thread created */ - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -1941,7 +1942,7 @@ static int bch_btree_check_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -2005,7 +2006,7 @@ int bch_btree_check(struct cache_set *c) int ret = 0; int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct btree_check_state check_state; /* check and mark root node keys */ @@ -2501,11 +2502,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op, if (b->level) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad))) { ret = bcache_btree(map_nodes_recurse, k, b, op, from, fn, flags); @@ -2534,11 +2535,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op, { int ret = MAP_CONTINUE; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) { + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad))) { ret = !b->level ? fn(op, b, k) : bcache_btree(map_keys_recurse, k, diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index b5601f200c09..c778862f4f33 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1928,8 +1928,9 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) INIT_LIST_HEAD(&c->btree_cache_freed); INIT_LIST_HEAD(&c->data_buckets); - iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) * - sizeof(struct btree_iter_set); + iter_size = sizeof(struct btree_iter) + + ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) * + sizeof(struct btree_iter_set); c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL); if (!c->devices) diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c index 8467e37411a7..84b8e9e90ee6 100644 --- a/drivers/md/bcache/sysfs.c +++ b/drivers/md/bcache/sysfs.c @@ -660,7 +660,7 @@ static unsigned int bch_root_usage(struct cache_set *c) unsigned int bytes = 0; struct bkey *k; struct btree *b; - struct btree_iter iter; + struct btree_iter_stack iter; goto lock_root; diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 83dcdd85abc0..9502cc9b0c80 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -899,15 +899,15 @@ static int bch_dirty_init_thread(void *arg) struct dirty_init_thrd_info *info = arg; struct bch_dirty_init_state *state = info->state; struct cache_set *c = state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; k = p = NULL; cur_idx = prev_idx = 0; - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -921,7 +921,7 @@ static int bch_dirty_init_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -969,7 +969,7 @@ void bch_sectors_dirty_init(struct bcache_device *d) { int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct sectors_dirty_init op; struct cache_set *c = d->c; struct bch_dirty_init_state state; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete
by Yuan Can 26 Sep '24

26 Sep '24

From: Wesley Cheng <quic_wcheng(a)quicinc.com> stable inclusion from stable-v5.10.221 commit e500b1c4e29ad0bd1c1332a1eaea2913627a92dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9TXIA CVE: CVE-2024-36894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 24729b307eefcd7c476065cd7351c1a018082c19 ] FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application issues an AIO cancel call, while the UDC is handling a soft disconnect. For a DWC3 based implementation, the callstack looks like the following: DWC3 Gadget FFS Application dwc3_gadget_soft_disconnect() ... --> dwc3_stop_active_transfers() --> dwc3_gadget_giveback(-ESHUTDOWN) --> ffs_epfile_async_io_complete() ffs_aio_cancel() --> usb_ep_free_request() --> usb_ep_dequeue() There is currently no locking implemented between the AIO completion handler and AIO cancel, so the issue occurs if the completion routine is running in parallel to an AIO cancel call coming from the FFS application. As the completion call frees the USB request (io_data->req) the FFS application is also referencing it for the usb_ep_dequeue() call. This can lead to accessing a stale/hanging pointer. commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") relocated the usb_ep_free_request() into ffs_epfile_async_io_complete(). However, in order to properly implement locking to mitigate this issue, the spinlock can't be added to ffs_epfile_async_io_complete(), as usb_ep_dequeue() (if successfully dequeuing a USB request) will call the function driver's completion handler in the same context. Hence, leading into a deadlock. Fix this issue by moving the usb_ep_free_request() back to ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req to NULL after freeing it within the ffs->eps_lock. This resolves the race condition above, as the ffs_aio_cancel() routine will not continue attempting to dequeue a request that has already been freed, or the ffs_user_copy_work() not freeing the USB request until the AIO cancel is done referencing it. This fix depends on commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") Cc: stable <stable(a)kernel.org> # b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") Signed-off-by: Wesley Cheng <quic_wcheng(a)quicinc.com> Link: https://lore.kernel.org/r/20240409014059.6740-1-quic_wcheng@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/usb/gadget/function/f_fs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index bb0d92837f67..f98a6010fa50 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -822,6 +822,7 @@ static void ffs_user_copy_worker(struct work_struct *work) int ret = io_data->req->status ? io_data->req->status : io_data->req->actual; bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; + unsigned long flags; if (io_data->read && ret > 0) { kthread_use_mm(io_data->mm); @@ -834,7 +835,10 @@ static void ffs_user_copy_worker(struct work_struct *work) if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd) eventfd_signal(io_data->ffs->ffs_eventfd, 1); + spin_lock_irqsave(&io_data->ffs->eps_lock, flags); usb_ep_free_request(io_data->ep, io_data->req); + io_data->req = NULL; + spin_unlock_irqrestore(&io_data->ffs->eps_lock, flags); if (io_data->read) kfree(io_data->to_free); -- 2.17.1

2 1

[PATCH OLK-6.6] misc: fastrpc: Fix double free of 'buf' in error path
by Xiaomeng Zhang 26 Sep '24

26 Sep '24

From: Sukrut Bellary <sukrut.bellary(a)linux.com> stable inclusion from stable-v6.10.10 commit bfc1704d909dc9911a558b1a5833d3d61a43a1f2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IATRLJ CVE: CVE-2024-46741 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e8c276d4dc0e19ee48385f74426aebc855b49aaf upstream. smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf' In fastrpc_req_mmap() error path, the fastrpc buffer is freed in fastrpc_req_munmap_impl() if unmap is successful. But in the end, there is an unconditional call to fastrpc_buf_free(). So the above case triggers the double free of fastrpc buf. Fixes: 72fa6f7820c4 ("misc: fastrpc: Rework fastrpc_req_munmap") Reviewed-by: Shuah Khan <skhan(a)linuxfoundation.org> Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Signed-off-by: Sukrut Bellary <sukrut.bellary(a)linux.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240902141409.70371-2-srinivas.kandagatla@linaro… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/misc/fastrpc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index bbcbc921f3ab..8be1504baf53 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1912,7 +1912,8 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) &args[0]); if (err) { dev_err(dev, "mmap error (len 0x%08llx)\n", buf->size); - goto err_invoke; + fastrpc_buf_free(buf); + return err; } /* update the buffer to be able to deallocate the memory on the DSP */ @@ -1950,8 +1951,6 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp) err_assign: fastrpc_req_munmap_impl(fl, buf); -err_invoke: - fastrpc_buf_free(buf); return err; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bcache: fix variable length array abuse in btree_iter
by Yuan Can 26 Sep '24

26 Sep '24

From: Matthew Mirvish <matthew(a)mm12.xyz> stable inclusion from stable-v5.10.221 commit 2c3d7b03b658dc8bfa6112b194b67b92a87e081b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAB04K CVE: CVE-2024-39482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31 upstream. btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array. Cc: stable(a)vger.kernel.org Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039368 Signed-off-by: Matthew Mirvish <matthew(a)mm12.xyz> Signed-off-by: Coly Li <colyli(a)suse.de> Link: https://lore.kernel.org/r/20240509011117.2697-3-colyli@suse.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/md/bcache/bset.c | 44 +++++++++++++++++------------------ drivers/md/bcache/bset.h | 28 ++++++++++++++-------- drivers/md/bcache/btree.c | 40 ++++++++++++++++--------------- drivers/md/bcache/super.c | 5 ++-- drivers/md/bcache/sysfs.c | 2 +- drivers/md/bcache/writeback.c | 10 ++++---- 6 files changed, 70 insertions(+), 59 deletions(-) diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c index 94d38e8a59b3..cb544207427b 100644 --- a/drivers/md/bcache/bset.c +++ b/drivers/md/bcache/bset.c @@ -54,7 +54,7 @@ void bch_dump_bucket(struct btree_keys *b) int __bch_count_data(struct btree_keys *b) { unsigned int ret = 0; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k; if (b->ops->is_extents) @@ -67,7 +67,7 @@ void __bch_check_keys(struct btree_keys *b, const char *fmt, ...) { va_list args; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; const char *err; for_each_key(b, k, &iter) { @@ -879,7 +879,7 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, unsigned int status = BTREE_INSERT_STATUS_NO_INSERT; struct bset *i = bset_tree_last(b)->data; struct bkey *m, *prev = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey preceding_key_on_stack = ZERO_KEY; struct bkey *preceding_key_p = &preceding_key_on_stack; @@ -895,9 +895,9 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k, else preceding_key(k, &preceding_key_p); - m = bch_btree_iter_init(b, &iter, preceding_key_p); + m = bch_btree_iter_stack_init(b, &iter, preceding_key_p); - if (b->ops->insert_fixup(b, k, &iter, replace_key)) + if (b->ops->insert_fixup(b, k, &iter.iter, replace_key)) return status; status = BTREE_INSERT_STATUS_INSERT; @@ -1100,33 +1100,33 @@ void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, btree_iter_cmp)); } -static struct bkey *__bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search, - struct bset_tree *start) +static struct bkey *__bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search, + struct bset_tree *start) { struct bkey *ret = NULL; - iter->size = ARRAY_SIZE(iter->data); - iter->used = 0; + iter->iter.size = ARRAY_SIZE(iter->stack_data); + iter->iter.used = 0; #ifdef CONFIG_BCACHE_DEBUG - iter->b = b; + iter->iter.b = b; #endif for (; start <= bset_tree_last(b); start++) { ret = bch_bset_search(b, start, search); - bch_btree_iter_push(iter, ret, bset_bkey_last(start->data)); + bch_btree_iter_push(&iter->iter, ret, bset_bkey_last(start->data)); } return ret; } -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, struct bkey *search) { - return __bch_btree_iter_init(b, iter, search, b->set); + return __bch_btree_iter_stack_init(b, iter, search, b->set); } static inline struct bkey *__bch_btree_iter_next(struct btree_iter *iter, @@ -1293,10 +1293,10 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, struct bset_sort_state *state) { size_t order = b->page_order, keys = 0; - struct btree_iter iter; + struct btree_iter_stack iter; int oldsize = bch_count_data(b); - __bch_btree_iter_init(b, &iter, NULL, &b->set[start]); + __bch_btree_iter_stack_init(b, &iter, NULL, &b->set[start]); if (start) { unsigned int i; @@ -1307,7 +1307,7 @@ void bch_btree_sort_partial(struct btree_keys *b, unsigned int start, order = get_order(__set_bytes(b->set->data, keys)); } - __btree_sort(b, &iter, start, order, false, state); + __btree_sort(b, &iter.iter, start, order, false, state); EBUG_ON(oldsize >= 0 && bch_count_data(b) != oldsize); } @@ -1323,11 +1323,11 @@ void bch_btree_sort_into(struct btree_keys *b, struct btree_keys *new, struct bset_sort_state *state) { uint64_t start_time = local_clock(); - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(b, &iter, NULL); + bch_btree_iter_stack_init(b, &iter, NULL); - btree_mergesort(b, new->set->data, &iter, false, true); + btree_mergesort(b, new->set->data, &iter.iter, false, true); bch_time_stats_update(&state->time, start_time); diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h index d795c84246b0..011f6062c4c0 100644 --- a/drivers/md/bcache/bset.h +++ b/drivers/md/bcache/bset.h @@ -321,7 +321,14 @@ struct btree_iter { #endif struct btree_iter_set { struct bkey *k, *end; - } data[MAX_BSETS]; + } data[]; +}; + +/* Fixed-size btree_iter that can be allocated on the stack */ + +struct btree_iter_stack { + struct btree_iter iter; + struct btree_iter_set stack_data[MAX_BSETS]; }; typedef bool (*ptr_filter_fn)(struct btree_keys *b, const struct bkey *k); @@ -333,9 +340,9 @@ struct bkey *bch_btree_iter_next_filter(struct btree_iter *iter, void bch_btree_iter_push(struct btree_iter *iter, struct bkey *k, struct bkey *end); -struct bkey *bch_btree_iter_init(struct btree_keys *b, - struct btree_iter *iter, - struct bkey *search); +struct bkey *bch_btree_iter_stack_init(struct btree_keys *b, + struct btree_iter_stack *iter, + struct bkey *search); struct bkey *__bch_bset_search(struct btree_keys *b, struct bset_tree *t, const struct bkey *search); @@ -350,13 +357,14 @@ static inline struct bkey *bch_bset_search(struct btree_keys *b, return search ? __bch_bset_search(b, t, search) : t->data->start; } -#define for_each_key_filter(b, k, iter, filter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next_filter((iter), (b), filter));) +#define for_each_key_filter(b, k, stack_iter, filter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next_filter(&((stack_iter)->iter), (b), \ + filter));) -#define for_each_key(b, k, iter) \ - for (bch_btree_iter_init((b), (iter), NULL); \ - ((k) = bch_btree_iter_next(iter));) +#define for_each_key(b, k, stack_iter) \ + for (bch_btree_iter_stack_init((b), (stack_iter), NULL); \ + ((k) = bch_btree_iter_next(&((stack_iter)->iter)));) /* Sorting */ diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c index 98daa9d200f7..da24a3ca69e5 100644 --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1274,7 +1274,7 @@ static bool btree_gc_mark_node(struct btree *b, struct gc_stat *gc) uint8_t stale = 0; unsigned int keys = 0, good_keys = 0; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct bset_tree *t; gc->nodes++; @@ -1533,7 +1533,7 @@ static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op, static unsigned int btree_gc_count_keys(struct btree *b) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; unsigned int ret = 0; for_each_key_filter(&b->keys, k, &iter, bch_ptr_bad) @@ -1574,17 +1574,18 @@ static int btree_gc_recurse(struct btree *b, struct btree_op *op, int ret = 0; bool should_rewrite; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; struct gc_merge_info r[GC_MERGE_NODES]; struct gc_merge_info *i, *last = r + ARRAY_SIZE(r) - 1; - bch_btree_iter_init(&b->keys, &iter, &b->c->gc_done); + bch_btree_iter_stack_init(&b->keys, &iter, &b->c->gc_done); for (i = r; i < r + ARRAY_SIZE(r); i++) i->b = ERR_PTR(-EINTR); while (1) { - k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad); + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad); if (k) { r->b = bch_btree_node_get(b->c, op, k, b->level - 1, true, b); @@ -1874,7 +1875,7 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) { int ret = 0; struct bkey *k, *p = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; for_each_key_filter(&b->keys, k, &iter, bch_ptr_invalid) bch_initial_mark_key(b->c, b->level, k); @@ -1882,10 +1883,10 @@ static int bch_btree_check_recurse(struct btree *b, struct btree_op *op) bch_initial_mark_key(b->c, b->level + 1, &b->key); if (b->level) { - bch_btree_iter_init(&b->keys, &iter, NULL); + bch_btree_iter_stack_init(&b->keys, &iter, NULL); do { - k = bch_btree_iter_next_filter(&iter, &b->keys, + k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad); if (k) { btree_node_prefetch(b, k); @@ -1913,7 +1914,7 @@ static int bch_btree_check_thread(void *arg) struct btree_check_info *info = arg; struct btree_check_state *check_state = info->state; struct cache_set *c = check_state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; @@ -1922,8 +1923,8 @@ static int bch_btree_check_thread(void *arg) ret = 0; /* root node keys are checked before thread created */ - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -1941,7 +1942,7 @@ static int bch_btree_check_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -2005,7 +2006,7 @@ int bch_btree_check(struct cache_set *c) int ret = 0; int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct btree_check_state check_state; /* check and mark root node keys */ @@ -2501,11 +2502,11 @@ static int bch_btree_map_nodes_recurse(struct btree *b, struct btree_op *op, if (b->level) { struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, bch_ptr_bad))) { ret = bcache_btree(map_nodes_recurse, k, b, op, from, fn, flags); @@ -2534,11 +2535,12 @@ int bch_btree_map_keys_recurse(struct btree *b, struct btree_op *op, { int ret = MAP_CONTINUE; struct bkey *k; - struct btree_iter iter; + struct btree_iter_stack iter; - bch_btree_iter_init(&b->keys, &iter, from); + bch_btree_iter_stack_init(&b->keys, &iter, from); - while ((k = bch_btree_iter_next_filter(&iter, &b->keys, bch_ptr_bad))) { + while ((k = bch_btree_iter_next_filter(&iter.iter, &b->keys, + bch_ptr_bad))) { ret = !b->level ? fn(op, b, k) : bcache_btree(map_keys_recurse, k, diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index b5601f200c09..c778862f4f33 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1928,8 +1928,9 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) INIT_LIST_HEAD(&c->btree_cache_freed); INIT_LIST_HEAD(&c->data_buckets); - iter_size = ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size + 1) * - sizeof(struct btree_iter_set); + iter_size = sizeof(struct btree_iter) + + ((meta_bucket_pages(sb) * PAGE_SECTORS) / sb->block_size) * + sizeof(struct btree_iter_set); c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL); if (!c->devices) diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c index 8467e37411a7..84b8e9e90ee6 100644 --- a/drivers/md/bcache/sysfs.c +++ b/drivers/md/bcache/sysfs.c @@ -660,7 +660,7 @@ static unsigned int bch_root_usage(struct cache_set *c) unsigned int bytes = 0; struct bkey *k; struct btree *b; - struct btree_iter iter; + struct btree_iter_stack iter; goto lock_root; diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c index 83dcdd85abc0..9502cc9b0c80 100644 --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -899,15 +899,15 @@ static int bch_dirty_init_thread(void *arg) struct dirty_init_thrd_info *info = arg; struct bch_dirty_init_state *state = info->state; struct cache_set *c = state->c; - struct btree_iter iter; + struct btree_iter_stack iter; struct bkey *k, *p; int cur_idx, prev_idx, skip_nr; k = p = NULL; cur_idx = prev_idx = 0; - bch_btree_iter_init(&c->root->keys, &iter, NULL); - k = bch_btree_iter_next_filter(&iter, &c->root->keys, bch_ptr_bad); + bch_btree_iter_stack_init(&c->root->keys, &iter, NULL); + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); BUG_ON(!k); p = k; @@ -921,7 +921,7 @@ static int bch_dirty_init_thread(void *arg) skip_nr = cur_idx - prev_idx; while (skip_nr) { - k = bch_btree_iter_next_filter(&iter, + k = bch_btree_iter_next_filter(&iter.iter, &c->root->keys, bch_ptr_bad); if (k) @@ -969,7 +969,7 @@ void bch_sectors_dirty_init(struct bcache_device *d) { int i; struct bkey *k = NULL; - struct btree_iter iter; + struct btree_iter_stack iter; struct sectors_dirty_init op; struct cache_set *c = d->c; struct bch_dirty_init_state state; -- 2.17.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 26 Sep '24

26 Sep '24

Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10] bpf: verifier: prevent userspace memory access
by Pu Lehui 26 Sep '24

26 Sep '24

From: Puranjay Mohan <puranjay12(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 66e13b615a0ce76b785d780ecc9776ba71983629 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATK7C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To thwart invalid memory accesses, the JITs add an exception table entry for all such accesses. But in case the src_reg + offset is a userspace address, the BPF program might read that memory if the user has mapped it. Make the verifier add guard instructions around such memory accesses and skip the load if the address falls into the userspace region. The JITs need to implement bpf_arch_uaddress_limit() to define where the userspace addresses end for that architecture or TASK_SIZE is taken as default. The implementation is as follows: REG_AX = SRC_REG if(offset) REG_AX += offset; REG_AX >>= 32; if (REG_AX <= (uaddress_limit >> 32)) DST_REG = 0; else DST_REG = *(size *)(SRC_REG + offset); Comparing just the upper 32 bits of the load address with the upper 32 bits of uaddress_limit implies that the values are being aligned down to a 4GB boundary before comparison. The above means that all loads with address <= uaddress_limit + 4GB are skipped. This is acceptable because there is a large hole (much larger than 4GB) between userspace and kernel space memory, therefore a correctly functioning BPF program should not access this 4GB memory above the userspace. Let's analyze what this patch does to the following fentry program dereferencing an untrusted pointer: SEC("fentry/tcp_v4_connect") int BPF_PROG(fentry_tcp_v4_connect, struct sock *sk) { *(volatile long *)sk; return 0; } BPF Program before | BPF Program after ------------------ | ----------------- 0: (79) r1 = *(u64 *)(r1 +0) 0: (79) r1 = *(u64 *)(r1 +0) ----------------------------------------------------------------------- 1: (79) r1 = *(u64 *)(r1 +0) --\ 1: (bf) r11 = r1 ----------------------------\ \ 2: (77) r11 >>= 32 2: (b7) r0 = 0 \ \ 3: (b5) if r11 <= 0x8000 goto pc+2 3: (95) exit \ \-> 4: (79) r1 = *(u64 *)(r1 +0) \ 5: (05) goto pc+1 \ 6: (b7) r1 = 0 \-------------------------------------- 7: (b7) r0 = 0 8: (95) exit As you can see from above, in the best case (off=0), 5 extra instructions are emitted. Now, we analyze the same program after it has gone through the JITs of ARM64 and RISC-V architectures. We follow the single load instruction that has the untrusted pointer and see what instrumentation has been added around it. x86-64 JIT ========== JIT's Instrumentation (upstream) --------------------- 0: nopl 0x0(%rax,%rax,1) 5: xchg %ax,%ax 7: push %rbp 8: mov %rsp,%rbp b: mov 0x0(%rdi),%rdi --------------------------------- f: movabs $0x800000000000,%r11 19: cmp %r11,%rdi 1c: jb 0x000000000000002a 1e: mov %rdi,%r11 21: add $0x0,%r11 28: jae 0x000000000000002e 2a: xor %edi,%edi 2c: jmp 0x0000000000000032 2e: mov 0x0(%rdi),%rdi --------------------------------- 32: xor %eax,%eax 34: leave 35: ret The x86-64 JIT already emits some instructions to protect against user memory access. This patch doesn't make any changes for the x86-64 JIT. ARM64 JIT ========= No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: add x9, x30, #0x0 0: add x9, x30, #0x0 4: nop 4: nop 8: paciasp 8: paciasp c: stp x29, x30, [sp, #-16]! c: stp x29, x30, [sp, #-16]! 10: mov x29, sp 10: mov x29, sp 14: stp x19, x20, [sp, #-16]! 14: stp x19, x20, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 24: mov x25, sp 24: mov x25, sp 28: mov x26, #0x0 28: mov x26, #0x0 2c: sub x27, x25, #0x0 2c: sub x27, x25, #0x0 30: sub sp, sp, #0x0 30: sub sp, sp, #0x0 34: ldr x0, [x0] 34: ldr x0, [x0] -------------------------------------------------------------------------------- 38: ldr x0, [x0] ----------\ 38: add x9, x0, #0x0 -----------------------------------\\ 3c: lsr x9, x9, #32 3c: mov x7, #0x0 \\ 40: cmp x9, #0x10, lsl #12 40: mov sp, sp \\ 44: b.ls 0x0000000000000050 44: ldp x27, x28, [sp], #16 \\--> 48: ldr x0, [x0] 48: ldp x25, x26, [sp], #16 \ 4c: b 0x0000000000000054 4c: ldp x21, x22, [sp], #16 \ 50: mov x0, #0x0 50: ldp x19, x20, [sp], #16 \--------------------------------------- 54: ldp x29, x30, [sp], #16 54: mov x7, #0x0 58: add x0, x7, #0x0 58: mov sp, sp 5c: autiasp 5c: ldp x27, x28, [sp], #16 60: ret 60: ldp x25, x26, [sp], #16 64: nop 64: ldp x21, x22, [sp], #16 68: ldr x10, 0x0000000000000070 68: ldp x19, x20, [sp], #16 6c: br x10 6c: ldp x29, x30, [sp], #16 70: add x0, x7, #0x0 74: autiasp 78: ret 7c: nop 80: ldr x10, 0x0000000000000088 84: br x10 There are 6 extra instructions added in ARM64 in the best case. This will become 7 in the worst case (off != 0). RISC-V JIT (RISCV_ISA_C Disabled) ========== No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: nop 0: nop 4: nop 4: nop 8: li a6, 33 8: li a6, 33 c: addi sp, sp, -16 c: addi sp, sp, -16 10: sd s0, 8(sp) 10: sd s0, 8(sp) 14: addi s0, sp, 16 14: addi s0, sp, 16 18: ld a0, 0(a0) 18: ld a0, 0(a0) --------------------------------------------------------------- 1c: ld a0, 0(a0) --\ 1c: mv t0, a0 --------------------------\ \ 20: srli t0, t0, 32 20: li a5, 0 \ \ 24: lui t1, 4096 24: ld s0, 8(sp) \ \ 28: sext.w t1, t1 28: addi sp, sp, 16 \ \ 2c: bgeu t1, t0, 12 2c: sext.w a0, a5 \ \--> 30: ld a0, 0(a0) 30: ret \ 34: j 8 \ 38: li a0, 0 \------------------------------ 3c: li a5, 0 40: ld s0, 8(sp) 44: addi sp, sp, 16 48: sext.w a0, a5 4c: ret There are 7 extra instructions added in RISC-V. Fixes: 800834285361 ("bpf, arm64: Add BPF exception tables") Reported-by: Breno Leitao <leitao(a)debian.org> Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Ilya Leoshkevich <iii(a)linux.ibm.com> Signed-off-by: Puranjay Mohan <puranjay12(a)gmail.com> Link: https://lore.kernel.org/r/20240424100210.11982-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/x86/net/bpf_jit_comp.c kernel/bpf/core.c kernel/bpf/verifier.c include/linux/filter.h [The conflicts were due to not support BPF_PROBE_MEMSX and refactoring about do_misc_fixups] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/x86/net/bpf_jit_comp.c | 6 ++++++ include/linux/filter.h | 1 + kernel/bpf/core.c | 9 +++++++++ kernel/bpf/verifier.c | 29 +++++++++++++++++++++++++++++ 4 files changed, 45 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 8e3c3d8916dd..6c8b9151eda8 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2156,3 +2156,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp : orig_prog); return prog; } + +/* x86-64 JIT emits its own code to filter user addresses so return 0 here */ +u64 bpf_arch_uaddress_limit(void) +{ + return 0; +} diff --git a/include/linux/filter.h b/include/linux/filter.h index ee12183ffad9..8ee00f20614f 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -908,6 +908,7 @@ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog); void bpf_jit_compile(struct bpf_prog *prog); bool bpf_jit_needs_zext(void); +u64 bpf_arch_uaddress_limit(void); bool bpf_helper_changes_pkt_data(void *func); static inline bool bpf_dump_raw_ok(const struct cred *cred) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 681070bf910b..7db8a815e835 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2321,6 +2321,15 @@ bool __weak bpf_helper_changes_pkt_data(void *func) return false; } +u64 __weak bpf_arch_uaddress_limit(void) +{ +#if defined(CONFIG_64BIT) && defined(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) + return TASK_SIZE; +#else + return 0; +#endif +} + /* Return TRUE if the JIT backend wants verifier to enable sub-register usage * analysis code and wants explicit zero extension inserted by verifier. * Otherwise, return FALSE. diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 18ab413ef2ba..a2a77348fa60 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11464,6 +11464,35 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) continue; } + /* Make it impossible to de-reference a userspace address */ + if (BPF_CLASS(insn->code) == BPF_LDX && + BPF_MODE(insn->code) == BPF_PROBE_MEM) { + struct bpf_insn *patch = &insn_buf[0]; + u64 uaddress_limit = bpf_arch_uaddress_limit(); + + if (!uaddress_limit) + continue; + + *patch++ = BPF_MOV64_REG(BPF_REG_AX, insn->src_reg); + if (insn->off) + *patch++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_AX, insn->off); + *patch++ = BPF_ALU64_IMM(BPF_RSH, BPF_REG_AX, 32); + *patch++ = BPF_JMP_IMM(BPF_JLE, BPF_REG_AX, uaddress_limit >> 32, 2); + *patch++ = *insn; + *patch++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); + *patch++ = BPF_MOV64_IMM(insn->dst_reg, 0); + + cnt = patch - insn_buf; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + if (BPF_CLASS(insn->code) == BPF_LD && (BPF_MODE(insn->code) == BPF_ABS || BPF_MODE(insn->code) == BPF_IND)) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: verifier: prevent userspace memory access
by Pu Lehui 26 Sep '24

26 Sep '24

From: Puranjay Mohan <puranjay12(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 66e13b615a0ce76b785d780ecc9776ba71983629 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATK7C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To thwart invalid memory accesses, the JITs add an exception table entry for all such accesses. But in case the src_reg + offset is a userspace address, the BPF program might read that memory if the user has mapped it. Make the verifier add guard instructions around such memory accesses and skip the load if the address falls into the userspace region. The JITs need to implement bpf_arch_uaddress_limit() to define where the userspace addresses end for that architecture or TASK_SIZE is taken as default. The implementation is as follows: REG_AX = SRC_REG if(offset) REG_AX += offset; REG_AX >>= 32; if (REG_AX <= (uaddress_limit >> 32)) DST_REG = 0; else DST_REG = *(size *)(SRC_REG + offset); Comparing just the upper 32 bits of the load address with the upper 32 bits of uaddress_limit implies that the values are being aligned down to a 4GB boundary before comparison. The above means that all loads with address <= uaddress_limit + 4GB are skipped. This is acceptable because there is a large hole (much larger than 4GB) between userspace and kernel space memory, therefore a correctly functioning BPF program should not access this 4GB memory above the userspace. Let's analyze what this patch does to the following fentry program dereferencing an untrusted pointer: SEC("fentry/tcp_v4_connect") int BPF_PROG(fentry_tcp_v4_connect, struct sock *sk) { *(volatile long *)sk; return 0; } BPF Program before | BPF Program after ------------------ | ----------------- 0: (79) r1 = *(u64 *)(r1 +0) 0: (79) r1 = *(u64 *)(r1 +0) ----------------------------------------------------------------------- 1: (79) r1 = *(u64 *)(r1 +0) --\ 1: (bf) r11 = r1 ----------------------------\ \ 2: (77) r11 >>= 32 2: (b7) r0 = 0 \ \ 3: (b5) if r11 <= 0x8000 goto pc+2 3: (95) exit \ \-> 4: (79) r1 = *(u64 *)(r1 +0) \ 5: (05) goto pc+1 \ 6: (b7) r1 = 0 \-------------------------------------- 7: (b7) r0 = 0 8: (95) exit As you can see from above, in the best case (off=0), 5 extra instructions are emitted. Now, we analyze the same program after it has gone through the JITs of ARM64 and RISC-V architectures. We follow the single load instruction that has the untrusted pointer and see what instrumentation has been added around it. x86-64 JIT ========== JIT's Instrumentation (upstream) --------------------- 0: nopl 0x0(%rax,%rax,1) 5: xchg %ax,%ax 7: push %rbp 8: mov %rsp,%rbp b: mov 0x0(%rdi),%rdi --------------------------------- f: movabs $0x800000000000,%r11 19: cmp %r11,%rdi 1c: jb 0x000000000000002a 1e: mov %rdi,%r11 21: add $0x0,%r11 28: jae 0x000000000000002e 2a: xor %edi,%edi 2c: jmp 0x0000000000000032 2e: mov 0x0(%rdi),%rdi --------------------------------- 32: xor %eax,%eax 34: leave 35: ret The x86-64 JIT already emits some instructions to protect against user memory access. This patch doesn't make any changes for the x86-64 JIT. ARM64 JIT ========= No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: add x9, x30, #0x0 0: add x9, x30, #0x0 4: nop 4: nop 8: paciasp 8: paciasp c: stp x29, x30, [sp, #-16]! c: stp x29, x30, [sp, #-16]! 10: mov x29, sp 10: mov x29, sp 14: stp x19, x20, [sp, #-16]! 14: stp x19, x20, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 24: mov x25, sp 24: mov x25, sp 28: mov x26, #0x0 28: mov x26, #0x0 2c: sub x27, x25, #0x0 2c: sub x27, x25, #0x0 30: sub sp, sp, #0x0 30: sub sp, sp, #0x0 34: ldr x0, [x0] 34: ldr x0, [x0] -------------------------------------------------------------------------------- 38: ldr x0, [x0] ----------\ 38: add x9, x0, #0x0 -----------------------------------\\ 3c: lsr x9, x9, #32 3c: mov x7, #0x0 \\ 40: cmp x9, #0x10, lsl #12 40: mov sp, sp \\ 44: b.ls 0x0000000000000050 44: ldp x27, x28, [sp], #16 \\--> 48: ldr x0, [x0] 48: ldp x25, x26, [sp], #16 \ 4c: b 0x0000000000000054 4c: ldp x21, x22, [sp], #16 \ 50: mov x0, #0x0 50: ldp x19, x20, [sp], #16 \--------------------------------------- 54: ldp x29, x30, [sp], #16 54: mov x7, #0x0 58: add x0, x7, #0x0 58: mov sp, sp 5c: autiasp 5c: ldp x27, x28, [sp], #16 60: ret 60: ldp x25, x26, [sp], #16 64: nop 64: ldp x21, x22, [sp], #16 68: ldr x10, 0x0000000000000070 68: ldp x19, x20, [sp], #16 6c: br x10 6c: ldp x29, x30, [sp], #16 70: add x0, x7, #0x0 74: autiasp 78: ret 7c: nop 80: ldr x10, 0x0000000000000088 84: br x10 There are 6 extra instructions added in ARM64 in the best case. This will become 7 in the worst case (off != 0). RISC-V JIT (RISCV_ISA_C Disabled) ========== No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: nop 0: nop 4: nop 4: nop 8: li a6, 33 8: li a6, 33 c: addi sp, sp, -16 c: addi sp, sp, -16 10: sd s0, 8(sp) 10: sd s0, 8(sp) 14: addi s0, sp, 16 14: addi s0, sp, 16 18: ld a0, 0(a0) 18: ld a0, 0(a0) --------------------------------------------------------------- 1c: ld a0, 0(a0) --\ 1c: mv t0, a0 --------------------------\ \ 20: srli t0, t0, 32 20: li a5, 0 \ \ 24: lui t1, 4096 24: ld s0, 8(sp) \ \ 28: sext.w t1, t1 28: addi sp, sp, 16 \ \ 2c: bgeu t1, t0, 12 2c: sext.w a0, a5 \ \--> 30: ld a0, 0(a0) 30: ret \ 34: j 8 \ 38: li a0, 0 \------------------------------ 3c: li a5, 0 40: ld s0, 8(sp) 44: addi sp, sp, 16 48: sext.w a0, a5 4c: ret There are 7 extra instructions added in RISC-V. Fixes: 800834285361 ("bpf, arm64: Add BPF exception tables") Reported-by: Breno Leitao <leitao(a)debian.org> Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Ilya Leoshkevich <iii(a)linux.ibm.com> Signed-off-by: Puranjay Mohan <puranjay12(a)gmail.com> Link: https://lore.kernel.org/r/20240424100210.11982-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/x86/net/bpf_jit_comp.c kernel/bpf/core.c kernel/bpf/verifier.c include/linux/filter.h [The conflicts were due to not support BPF_PROBE_MEMSX and refactoring about do_misc_fixups] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/x86/net/bpf_jit_comp.c | 6 ++++++ include/linux/filter.h | 1 + kernel/bpf/core.c | 9 +++++++++ kernel/bpf/verifier.c | 29 +++++++++++++++++++++++++++++ 4 files changed, 45 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 8e3c3d8916dd..6c8b9151eda8 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2156,3 +2156,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) tmp : orig_prog); return prog; } + +/* x86-64 JIT emits its own code to filter user addresses so return 0 here */ +u64 bpf_arch_uaddress_limit(void) +{ + return 0; +} diff --git a/include/linux/filter.h b/include/linux/filter.h index ee12183ffad9..8ee00f20614f 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -908,6 +908,7 @@ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog); void bpf_jit_compile(struct bpf_prog *prog); bool bpf_jit_needs_zext(void); +u64 bpf_arch_uaddress_limit(void); bool bpf_helper_changes_pkt_data(void *func); static inline bool bpf_dump_raw_ok(const struct cred *cred) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 681070bf910b..7db8a815e835 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2321,6 +2321,15 @@ bool __weak bpf_helper_changes_pkt_data(void *func) return false; } +u64 __weak bpf_arch_uaddress_limit(void) +{ +#if defined(CONFIG_64BIT) && defined(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) + return TASK_SIZE; +#else + return 0; +#endif +} + /* Return TRUE if the JIT backend wants verifier to enable sub-register usage * analysis code and wants explicit zero extension inserted by verifier. * Otherwise, return FALSE. diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 18ab413ef2ba..a2a77348fa60 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11464,6 +11464,35 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) continue; } + /* Make it impossible to de-reference a userspace address */ + if (BPF_CLASS(insn->code) == BPF_LDX && + BPF_MODE(insn->code) == BPF_PROBE_MEM) { + struct bpf_insn *patch = &insn_buf[0]; + u64 uaddress_limit = bpf_arch_uaddress_limit(); + + if (!uaddress_limit) + continue; + + *patch++ = BPF_MOV64_REG(BPF_REG_AX, insn->src_reg); + if (insn->off) + *patch++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_AX, insn->off); + *patch++ = BPF_ALU64_IMM(BPF_RSH, BPF_REG_AX, 32); + *patch++ = BPF_JMP_IMM(BPF_JLE, BPF_REG_AX, uaddress_limit >> 32, 2); + *patch++ = *insn; + *patch++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); + *patch++ = BPF_MOV64_IMM(insn->dst_reg, 0); + + cnt = patch - insn_buf; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + if (BPF_CLASS(insn->code) == BPF_LD && (BPF_MODE(insn->code) == BPF_ABS || BPF_MODE(insn->code) == BPF_IND)) { -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: verifier: prevent userspace memory access
by Pu Lehui 26 Sep '24

26 Sep '24

From: Puranjay Mohan <puranjay12(a)gmail.com> mainline inclusion from mainline-v6.9-rc7 commit 66e13b615a0ce76b785d780ecc9776ba71983629 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IATK7C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To thwart invalid memory accesses, the JITs add an exception table entry for all such accesses. But in case the src_reg + offset is a userspace address, the BPF program might read that memory if the user has mapped it. Make the verifier add guard instructions around such memory accesses and skip the load if the address falls into the userspace region. The JITs need to implement bpf_arch_uaddress_limit() to define where the userspace addresses end for that architecture or TASK_SIZE is taken as default. The implementation is as follows: REG_AX = SRC_REG if(offset) REG_AX += offset; REG_AX >>= 32; if (REG_AX <= (uaddress_limit >> 32)) DST_REG = 0; else DST_REG = *(size *)(SRC_REG + offset); Comparing just the upper 32 bits of the load address with the upper 32 bits of uaddress_limit implies that the values are being aligned down to a 4GB boundary before comparison. The above means that all loads with address <= uaddress_limit + 4GB are skipped. This is acceptable because there is a large hole (much larger than 4GB) between userspace and kernel space memory, therefore a correctly functioning BPF program should not access this 4GB memory above the userspace. Let's analyze what this patch does to the following fentry program dereferencing an untrusted pointer: SEC("fentry/tcp_v4_connect") int BPF_PROG(fentry_tcp_v4_connect, struct sock *sk) { *(volatile long *)sk; return 0; } BPF Program before | BPF Program after ------------------ | ----------------- 0: (79) r1 = *(u64 *)(r1 +0) 0: (79) r1 = *(u64 *)(r1 +0) ----------------------------------------------------------------------- 1: (79) r1 = *(u64 *)(r1 +0) --\ 1: (bf) r11 = r1 ----------------------------\ \ 2: (77) r11 >>= 32 2: (b7) r0 = 0 \ \ 3: (b5) if r11 <= 0x8000 goto pc+2 3: (95) exit \ \-> 4: (79) r1 = *(u64 *)(r1 +0) \ 5: (05) goto pc+1 \ 6: (b7) r1 = 0 \-------------------------------------- 7: (b7) r0 = 0 8: (95) exit As you can see from above, in the best case (off=0), 5 extra instructions are emitted. Now, we analyze the same program after it has gone through the JITs of ARM64 and RISC-V architectures. We follow the single load instruction that has the untrusted pointer and see what instrumentation has been added around it. x86-64 JIT ========== JIT's Instrumentation (upstream) --------------------- 0: nopl 0x0(%rax,%rax,1) 5: xchg %ax,%ax 7: push %rbp 8: mov %rsp,%rbp b: mov 0x0(%rdi),%rdi --------------------------------- f: movabs $0x800000000000,%r11 19: cmp %r11,%rdi 1c: jb 0x000000000000002a 1e: mov %rdi,%r11 21: add $0x0,%r11 28: jae 0x000000000000002e 2a: xor %edi,%edi 2c: jmp 0x0000000000000032 2e: mov 0x0(%rdi),%rdi --------------------------------- 32: xor %eax,%eax 34: leave 35: ret The x86-64 JIT already emits some instructions to protect against user memory access. This patch doesn't make any changes for the x86-64 JIT. ARM64 JIT ========= No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: add x9, x30, #0x0 0: add x9, x30, #0x0 4: nop 4: nop 8: paciasp 8: paciasp c: stp x29, x30, [sp, #-16]! c: stp x29, x30, [sp, #-16]! 10: mov x29, sp 10: mov x29, sp 14: stp x19, x20, [sp, #-16]! 14: stp x19, x20, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 18: stp x21, x22, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 1c: stp x25, x26, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 20: stp x27, x28, [sp, #-16]! 24: mov x25, sp 24: mov x25, sp 28: mov x26, #0x0 28: mov x26, #0x0 2c: sub x27, x25, #0x0 2c: sub x27, x25, #0x0 30: sub sp, sp, #0x0 30: sub sp, sp, #0x0 34: ldr x0, [x0] 34: ldr x0, [x0] -------------------------------------------------------------------------------- 38: ldr x0, [x0] ----------\ 38: add x9, x0, #0x0 -----------------------------------\\ 3c: lsr x9, x9, #32 3c: mov x7, #0x0 \\ 40: cmp x9, #0x10, lsl #12 40: mov sp, sp \\ 44: b.ls 0x0000000000000050 44: ldp x27, x28, [sp], #16 \\--> 48: ldr x0, [x0] 48: ldp x25, x26, [sp], #16 \ 4c: b 0x0000000000000054 4c: ldp x21, x22, [sp], #16 \ 50: mov x0, #0x0 50: ldp x19, x20, [sp], #16 \--------------------------------------- 54: ldp x29, x30, [sp], #16 54: mov x7, #0x0 58: add x0, x7, #0x0 58: mov sp, sp 5c: autiasp 5c: ldp x27, x28, [sp], #16 60: ret 60: ldp x25, x26, [sp], #16 64: nop 64: ldp x21, x22, [sp], #16 68: ldr x10, 0x0000000000000070 68: ldp x19, x20, [sp], #16 6c: br x10 6c: ldp x29, x30, [sp], #16 70: add x0, x7, #0x0 74: autiasp 78: ret 7c: nop 80: ldr x10, 0x0000000000000088 84: br x10 There are 6 extra instructions added in ARM64 in the best case. This will become 7 in the worst case (off != 0). RISC-V JIT (RISCV_ISA_C Disabled) ========== No Intrumentation Verifier's Instrumentation (upstream) (This patch) ----------------- -------------------------- 0: nop 0: nop 4: nop 4: nop 8: li a6, 33 8: li a6, 33 c: addi sp, sp, -16 c: addi sp, sp, -16 10: sd s0, 8(sp) 10: sd s0, 8(sp) 14: addi s0, sp, 16 14: addi s0, sp, 16 18: ld a0, 0(a0) 18: ld a0, 0(a0) --------------------------------------------------------------- 1c: ld a0, 0(a0) --\ 1c: mv t0, a0 --------------------------\ \ 20: srli t0, t0, 32 20: li a5, 0 \ \ 24: lui t1, 4096 24: ld s0, 8(sp) \ \ 28: sext.w t1, t1 28: addi sp, sp, 16 \ \ 2c: bgeu t1, t0, 12 2c: sext.w a0, a5 \ \--> 30: ld a0, 0(a0) 30: ret \ 34: j 8 \ 38: li a0, 0 \------------------------------ 3c: li a5, 0 40: ld s0, 8(sp) 44: addi sp, sp, 16 48: sext.w a0, a5 4c: ret There are 7 extra instructions added in RISC-V. Fixes: 800834285361 ("bpf, arm64: Add BPF exception tables") Reported-by: Breno Leitao <leitao(a)debian.org> Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Ilya Leoshkevich <iii(a)linux.ibm.com> Signed-off-by: Puranjay Mohan <puranjay12(a)gmail.com> Link: https://lore.kernel.org/r/20240424100210.11982-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/x86/net/bpf_jit_comp.c kernel/bpf/core.c kernel/bpf/verifier.c include/linux/filter.h [The conflicts were due to refactoring about do_misc_fixups] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/x86/net/bpf_jit_comp.c | 6 ++++++ include/linux/filter.h | 1 + kernel/bpf/core.c | 9 +++++++++ kernel/bpf/verifier.c | 30 ++++++++++++++++++++++++++++++ 4 files changed, 46 insertions(+) diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index 878a4c6dd756..989b409f0cee 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -2968,3 +2968,9 @@ void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke, BUG_ON(ret < 0); } } + +/* x86-64 JIT emits its own code to filter user addresses so return 0 here */ +u64 bpf_arch_uaddress_limit(void) +{ + return 0; +} diff --git a/include/linux/filter.h b/include/linux/filter.h index 20b777ef5531..29f6a10b3acf 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -916,6 +916,7 @@ bool bpf_jit_needs_zext(void); bool bpf_jit_supports_subprog_tailcalls(void); bool bpf_jit_supports_kfunc_call(void); bool bpf_jit_supports_far_kfunc_call(void); +u64 bpf_arch_uaddress_limit(void); bool bpf_helper_changes_pkt_data(void *func); static inline bool bpf_dump_raw_ok(const struct cred *cred) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index d568244f5ae8..caea5f14ac99 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2906,6 +2906,15 @@ bool __weak bpf_jit_supports_far_kfunc_call(void) return false; } +u64 __weak bpf_arch_uaddress_limit(void) +{ +#if defined(CONFIG_64BIT) && defined(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) + return TASK_SIZE; +#else + return 0; +#endif +} + /* To execute LD_ABS/LD_IND instructions __bpf_prog_run() may call * skb_copy_bits(), so provide a weak definition of it for NET-less config. */ diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6a94f341587a..cbaa7dbf5f20 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -18942,6 +18942,36 @@ static int do_misc_fixups(struct bpf_verifier_env *env) continue; } + /* Make it impossible to de-reference a userspace address */ + if (BPF_CLASS(insn->code) == BPF_LDX && + (BPF_MODE(insn->code) == BPF_PROBE_MEM || + BPF_MODE(insn->code) == BPF_PROBE_MEMSX)) { + struct bpf_insn *patch = &insn_buf[0]; + u64 uaddress_limit = bpf_arch_uaddress_limit(); + + if (!uaddress_limit) + continue; + + *patch++ = BPF_MOV64_REG(BPF_REG_AX, insn->src_reg); + if (insn->off) + *patch++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_AX, insn->off); + *patch++ = BPF_ALU64_IMM(BPF_RSH, BPF_REG_AX, 32); + *patch++ = BPF_JMP_IMM(BPF_JLE, BPF_REG_AX, uaddress_limit >> 32, 2); + *patch++ = *insn; + *patch++ = BPF_JMP_IMM(BPF_JA, 0, 0, 1); + *patch++ = BPF_MOV64_IMM(insn->dst_reg, 0); + + cnt = patch - insn_buf; + new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); + if (!new_prog) + return -ENOMEM; + + delta += cnt - 1; + env->prog = prog = new_prog; + insn = new_prog->insnsi + i + delta; + continue; + } + /* Implement LD_ABS and LD_IND with a rewrite, if supported by the program type. */ if (BPF_CLASS(insn->code) == BPF_LD && (BPF_MODE(insn->code) == BPF_ABS || -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] fix CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH OLK-5.10 0/2] CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2024-46771
by Zhang Changzhong 26 Sep '24

26 Sep '24

Kuniyuki Iwashima (2): can: bcm: Remove proc entry when dev is unregistered. can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). net/can/bcm.c | 6 ++++++ 1 file changed, 6 insertions(+) -- 2.9.5

2 3

[PATCH OLK-6.6] userfaultfd: fix checks for huge PMDs
by Liu Shixin 26 Sep '24

26 Sep '24

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.51 commit 3c6b4bcf37845c9359aed926324bed66bdd2448d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWOX CVE: CVE-2024-46787 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 71c186efc1b2cf1aeabfeff3b9bd5ac4c5ac14d8 upstream. Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2. The pmd_trans_huge() code in mfill_atomic() is wrong in three different ways depending on kernel version: 1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit the right two race windows) - I've tested this in a kernel build with some extra mdelay() calls. See the commit message for a description of the race scenario. On older kernels (before 6.5), I think the same bug can even theoretically lead to accessing transhuge page contents as a page table if you hit the right 5 narrow race windows (I haven't tested this case). 2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for detecting PMDs that don't point to page tables. On older kernels (before 6.5), you'd just have to win a single fairly wide race to hit this. I've tested this on 6.1 stable by racing migration (with a mdelay() patched into try_to_migrate()) against UFFDIO_ZEROPAGE - on my x86 VM, that causes a kernel oops in ptlock_ptr(). 3. On newer kernels (>=6.5), for shmem mappings, khugepaged is allowed to yank page tables out from under us (though I haven't tested that), so I think the BUG_ON() checks in mfill_atomic() are just wrong. I decided to write two separate fixes for these (one fix for bugs 1+2, one fix for bug 3), so that the first fix can be backported to kernels affected by bugs 1+2. This patch (of 2): This fixes two issues. I discovered that the following race can occur: mfill_atomic other thread ============ ============ <zap PMD> pmdp_get_lockless() [reads none pmd] <bail if trans_huge> <if none:> <pagefault creates transhuge zeropage> __pte_alloc [no-op] <zap PMD> <bail if pmd_trans_huge(*dst_pmd)> BUG_ON(pmd_none(*dst_pmd)) I have experimentally verified this in a kernel with extra mdelay() calls; the BUG_ON(pmd_none(*dst_pmd)) triggers. On kernels newer than commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail"), this can't lead to anything worse than a BUG_ON(), since the page table access helpers are actually designed to deal with page tables concurrently disappearing; but on older kernels (<=6.4), I think we could probably theoretically race past the two BUG_ON() checks and end up treating a hugepage as a page table. The second issue is that, as Qi Zheng pointed out, there are other types of huge PMDs that pmd_trans_huge() can't catch: devmap PMDs and swap PMDs (in particular, migration PMDs). On <=6.4, this is worse than the first issue: If mfill_atomic() runs on a PMD that contains a migration entry (which just requires winning a single, fairly wide race), it will pass the PMD to pte_offset_map_lock(), which assumes that the PMD points to a page table. Breakage follows: First, the kernel tries to take the PTE lock (which will crash or maybe worse if there is no "struct page" for the address bits in the migration entry PMD - I think at least on X86 there usually is no corresponding "struct page" thanks to the PTE inversion mitigation, amd64 looks different). If that didn't crash, the kernel would next try to write a PTE into what it wrongly thinks is a page table. As part of fixing these issues, get rid of the check for pmd_trans_huge() before __pte_alloc() - that's redundant, we're going to have to check for that after the __pte_alloc() anyway. Backport note: pmdp_get_lockless() is pmd_read_atomic() in older kernels. Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-0-5efa61078a41@goog… Link: https://lkml.kernel.org/r/20240813-uffd-thp-flip-fix-v2-1-5efa61078a41@goog… Fixes: c1a4de99fada ("userfaultfd: mcopy_atomic|mfill_zeropage: UFFDIO_COPY|UFFDIO_ZEROPAGE preparation") Signed-off-by: Jann Horn <jannh(a)google.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: Hugh Dickins <hughd(a)google.com> Cc: Jann Horn <jannh(a)google.com> Cc: Pavel Emelyanov <xemul(a)virtuozzo.com> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 8c22dd4e5e15..b7562e6847b2 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -704,21 +704,23 @@ static __always_inline ssize_t mfill_atomic(struct mm_struct *dst_mm, } dst_pmdval = pmdp_get_lockless(dst_pmd); - /* - * If the dst_pmd is mapped as THP don't - * override it and just be strict. - */ - if (unlikely(pmd_trans_huge(dst_pmdval))) { - err = -EEXIST; - break; - } if (unlikely(pmd_none(dst_pmdval)) && unlikely(__pte_alloc(dst_mm, dst_pmd))) { err = -ENOMEM; break; } - /* If an huge pmd materialized from under us fail */ - if (unlikely(pmd_trans_huge(*dst_pmd))) { + dst_pmdval = pmdp_get_lockless(dst_pmd); + /* + * If the dst_pmd is THP don't override it and just be strict. + * (This includes the case where the PMD used to be THP and + * changed back to none after __pte_alloc().) + */ + if (unlikely(!pmd_present(dst_pmdval) || pmd_trans_huge(dst_pmdval) || + pmd_devmap(dst_pmdval))) { + err = -EEXIST; + break; + } + if (unlikely(pmd_bad(dst_pmdval))) { err = -EFAULT; break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index da1ee2e1ba99..2779704e128a 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -152,7 +152,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-6.6] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-5.10] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
by Zhang Kunbo 26 Sep '24

26 Sep '24

From: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> mainline inclusion from mainline-v6.11-rc7 commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARY1L CVE: CVE-2024-46738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Fixes: bc63dedb7d46 ("VMCI: resource object implementation.") Cc: stable(a)vger.kernel.org Reported-by: George Kennedy <george.kennedy(a)oracle.com> Signed-off-by: David Fernandez Gonzalez <david.fernandez.gonzalez(a)oracle.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c index 692daa9eff34..19c9d2cdd277 100644 --- a/drivers/misc/vmw_vmci/vmci_resource.c +++ b/drivers/misc/vmw_vmci/vmci_resource.c @@ -144,7 +144,8 @@ void vmci_resource_remove(struct vmci_resource *resource) spin_lock(&vmci_resource_table.lock); hlist_for_each_entry(r, &vmci_resource_table.entries[idx], node) { - if (vmci_handle_is_equal(r->handle, resource->handle)) { + if (vmci_handle_is_equal(r->handle, resource->handle) && + resource->type == r->type) { hlist_del_init_rcu(&r->node); break; } -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Ensure index calculation will not overflow
by Tong Tiangen 26 Sep '24

26 Sep '24

mainline inclusion from mainline-v6.1-rc1 commit 91954c6c904b515baafaee6a1f35c94409a3bb68 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV8L CVE: CVE-2024-46726 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [WHY & HOW] Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess array size. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Reviewed-by: Harry Wentland <harry.wentland(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c [Conflicts from: 1) commit 552b7cb0eed1 move drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c to drivers/gpu/drm/amd/display/dc/dml/calcs/dcn_calcs.c; 2) commit 91954c6c904b move dcn_bw_update_from_pplib() to dcn_bw_update_from_pplib_fclks() and the code logic is the same.] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c index 51397b565ddf..2186603d915c 100644 --- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c +++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c @@ -1498,10 +1498,9 @@ void dcn_bw_update_from_pplib(struct dc *dc) ASSERT(fclks.num_levels); vmin0p65_idx = 0; - vmid0p72_idx = fclks.num_levels - - (fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1)); - vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1); - vmax0p9_idx = fclks.num_levels - 1; + vmid0p72_idx = fclks.num_levels > 2 ? fclks.num_levels - 3 : 0; + vnom0p8_idx = fclks.num_levels > 1 ? fclks.num_levels - 2 : 0; + vmax0p9_idx = fclks.num_levels > 0 ? fclks.num_levels - 1 : 0; dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: bfa: Ensure the copied buf is NUL terminated
by Yuan Can 26 Sep '24

26 Sep '24

From: Bui Quang Minh <minhquangbui99(a)gmail.com> stable inclusion from stable-v5.10.219 commit 00b425ff0891283207d7bad607a2412225274d7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SFW CVE: CVE-2024-38560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ] Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user. Fixes: 9f30b674759b ("bfa: replace 2 kzalloc/copy_from_user by memdup_user") Signed-off-by: Bui Quang Minh <minhquangbui99(a)gmail.com> Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/scsi/bfa/bfad_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c index fd1b378a263a..d3c7d4423c51 100644 --- a/drivers/scsi/bfa/bfad_debugfs.c +++ b/drivers/scsi/bfa/bfad_debugfs.c @@ -250,7 +250,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, unsigned long flags; void *kern_buf; - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); @@ -317,7 +317,7 @@ bfad_debugfs_write_regwr(struct file *file, const char __user *buf, unsigned long flags; void *kern_buf; - kern_buf = memdup_user(buf, nbytes); + kern_buf = memdup_user_nul(buf, nbytes); if (IS_ERR(kern_buf)) return PTR_ERR(kern_buf); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] enic: Validate length of nl attributes in enic_set_vf_port
by Yuan Can 26 Sep '24

26 Sep '24

From: Roded Zats <rzats(a)paloaltonetworks.com> stable inclusion from stable-v5.10.219 commit 3c0d36972edbe56fcf98899622d9b90ac9965227 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D2T CVE: CVE-2024-38659 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8021b94b0412c37bcc79027c2e382086b6ce449 ] enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands read access in the memcpys of the data of these attributes in enic_set_vf_port. Fixes: f8bd909183ac ("net: Add ndo_{set|get}_vf_port support for enic dynamic vnics") Signed-off-by: Roded Zats <rzats(a)paloaltonetworks.com> Link: https://lore.kernel.org/r/20240522073044.33519-1-rzats@paloaltonetworks.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/net/ethernet/cisco/enic/enic_main.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c index 548d8095c0a7..b695f3f23328 100644 --- a/drivers/net/ethernet/cisco/enic/enic_main.c +++ b/drivers/net/ethernet/cisco/enic/enic_main.c @@ -1117,18 +1117,30 @@ static int enic_set_vf_port(struct net_device *netdev, int vf, pp->request = nla_get_u8(port[IFLA_PORT_REQUEST]); if (port[IFLA_PORT_PROFILE]) { + if (nla_len(port[IFLA_PORT_PROFILE]) != PORT_PROFILE_MAX) { + memcpy(pp, &prev_pp, sizeof(*pp)); + return -EINVAL; + } pp->set |= ENIC_SET_NAME; memcpy(pp->name, nla_data(port[IFLA_PORT_PROFILE]), PORT_PROFILE_MAX); } if (port[IFLA_PORT_INSTANCE_UUID]) { + if (nla_len(port[IFLA_PORT_INSTANCE_UUID]) != PORT_UUID_MAX) { + memcpy(pp, &prev_pp, sizeof(*pp)); + return -EINVAL; + } pp->set |= ENIC_SET_INSTANCE; memcpy(pp->instance_uuid, nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX); } if (port[IFLA_PORT_HOST_UUID]) { + if (nla_len(port[IFLA_PORT_HOST_UUID]) != PORT_UUID_MAX) { + memcpy(pp, &prev_pp, sizeof(*pp)); + return -EINVAL; + } pp->set |= ENIC_SET_HOST; memcpy(pp->host_uuid, nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
by Yuan Can 26 Sep '24

26 Sep '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.10.221 commit 259549b2ccf795b7f91f7b5aba47286addcfa389 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGENV CVE: CVE-2024-41095 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 66edf3fb331b6c55439b10f9862987b0916b3726 upstream. In nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240625081828.2620794-1-make… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/gpu/drm/nouveau/dispnv04/tvnv17.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c index f6ecc774193f..1da9d1e89f91 100644 --- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c +++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c @@ -208,6 +208,8 @@ static int nv17_tv_get_ld_modes(struct drm_encoder *encoder, struct drm_display_mode *mode; mode = drm_mode_duplicate(encoder->dev, tv_mode); + if (!mode) + continue; mode->clock = tv_norm->tv_enc_mode.vrefresh * mode->htotal / 1000 * -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: usb-audio: Stop parsing channels bits when all channels are found.
by Yuan Can 26 Sep '24

26 Sep '24

From: Johan Carlsson <johan.carlsson(a)teenage.engineering> stable inclusion from stable-v5.10.214 commit 5cd466673b34bac369334f66cbe14bb77b7d7827 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q91N CVE: CVE-2024-27436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7 ] If a usb audio device sets more bits than the amount of channels it could write outside of the map array. Signed-off-by: Johan Carlsson <johan.carlsson(a)teenage.engineering> Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support") Message-ID: <20240313081509.9801-1-johan.carlsson(a)teenage.engineering> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/usb/stream.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sound/usb/stream.c b/sound/usb/stream.c index c4f4585f9b85..f51e901a9689 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -301,9 +301,12 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits, c = 0; if (bits) { - for (; bits && *maps; maps++, bits >>= 1) + for (; bits && *maps; maps++, bits >>= 1) { if (bits & 1) chmap->map[c++] = *maps; + if (c == chmap->channels) + break; + } } else { /* If we're missing wChannelConfig, then guess something to make sure the channel map is not skipped entirely */ -- 2.17.1

2 1

[PATCH] fix: fix version showed in ethtool
by s00851154 26 Sep '24

26 Sep '24

Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

1 0

[PATCH openEuler-22.03-LTS-SP1 v2] drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
by Wang Hai 26 Sep '24

26 Sep '24

From: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> mainline inclusion from mainline-v6.11-rc5 commit bfa1a6283be390947d3649c482e5167186a37016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZV CVE: CVE-2024-44982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM object and causes a splat during DRM file closure: msm_obj->pin_count WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Call trace: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 irq event stamp: 129818 hardirqs last enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124 hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c softirqs last enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8 softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20 Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Reviewed-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Patchwork: https://patchwork.freedesktop.org/patch/600714/ Link: https://lore.kernel.org/r/20240625-dpu-mode-config-width-v5-1-501d984d634f@… Signed-off-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Conflicts: drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c [Conflict due to commit 9e4dde28e9cd ("drm/msm: Avoid dirtyfb stalls on video mode displays (v2)") didn't merge.] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- v1->v2: fix build failed drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c index 8aa9f2335f57..e9a9522f3904 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c @@ -891,6 +891,8 @@ static int dpu_plane_prepare_fb(struct drm_plane *plane, new_state->fb, &layout); if (ret) { DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret); + if (pstate->aspace) + msm_framebuffer_cleanup(new_state->fb, pstate->aspace); return ret; } -- 2.17.1

2 1

[PATCH OLK-5.10 v2] drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
by Wang Hai 26 Sep '24

26 Sep '24

From: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> mainline inclusion from mainline-v6.11-rc5 commit bfa1a6283be390947d3649c482e5167186a37016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZV CVE: CVE-2024-44982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM object and causes a splat during DRM file closure: msm_obj->pin_count WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc [...] Call trace: update_lru_locked+0xc4/0xcc put_pages+0xac/0x100 msm_gem_free_object+0x138/0x180 drm_gem_object_free+0x1c/0x30 drm_gem_object_handle_put_unlocked+0x108/0x10c drm_gem_object_release_handle+0x58/0x70 idr_for_each+0x68/0xec drm_gem_release+0x28/0x40 drm_file_free+0x174/0x234 drm_release+0xb0/0x160 __fput+0xc0/0x2c8 __fput_sync+0x50/0x5c __arm64_sys_close+0x38/0x7c invoke_syscall+0x48/0x118 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x4c/0x120 el0t_64_sync_handler+0x100/0x12c el0t_64_sync+0x190/0x194 irq event stamp: 129818 hardirqs last enabled at (129817): [<ffffa5f6d953fcc0>] console_unlock+0x118/0x124 hardirqs last disabled at (129818): [<ffffa5f6da7dcf04>] el1_dbg+0x24/0x8c softirqs last enabled at (129808): [<ffffa5f6d94afc18>] handle_softirqs+0x4c8/0x4e8 softirqs last disabled at (129785): [<ffffa5f6d94105e4>] __do_softirq+0x14/0x20 Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Reviewed-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Patchwork: https://patchwork.freedesktop.org/patch/600714/ Link: https://lore.kernel.org/r/20240625-dpu-mode-config-width-v5-1-501d984d634f@… Signed-off-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Conflicts: drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c [Conflict due to commit 9e4dde28e9cd ("drm/msm: Avoid dirtyfb stalls on video mode displays (v2)") didn't merge.] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- v1->v2: fix build failed drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c index 8aa9f2335f57..e9a9522f3904 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c @@ -891,6 +891,8 @@ static int dpu_plane_prepare_fb(struct drm_plane *plane, new_state->fb, &layout); if (ret) { DPU_ERROR_PLANE(pdpu, "failed to get format layout, %d\n", ret); + if (pstate->aspace) + msm_framebuffer_cleanup(new_state->fb, pstate->aspace); return ret; } -- 2.17.1

2 1

[openeuler:OLK-6.6 2385/14122] kernel/cgroup/cgroup.c:3968:29: error: 'cgroup_psi_stat_show' undeclared here (not in a function); did you mean 'cgroup_stat_show'?
by kernel test robot 26 Sep '24

26 Sep '24

Hi Lu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: 4a69b56540f40550585b9f93c35e415ac90bdecc [2385/14122] sched/psi: Introduce pressure.stat in psi config: loongarch-randconfig-r061-20240926 (https://download.01.org/0day-ci/archive/20240926/202409260923.Yh7ALQqg-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240926/202409260923.Yh7ALQqg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409260923.Yh7ALQqg-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/cgroup/cgroup.c:3968:29: error: 'cgroup_psi_stat_show' undeclared here (not in a function); did you mean 'cgroup_stat_show'? 3968 | .seq_show = cgroup_psi_stat_show, | ^~~~~~~~~~~~~~~~~~~~ | cgroup_stat_show vim +3968 kernel/cgroup/cgroup.c 3929 3930 struct cftype cgroup_v1_psi_files[] = { 3931 { 3932 .name = "io.pressure", 3933 .flags = CFTYPE_NO_PREFIX, 3934 .seq_show = cgroup_io_pressure_show, 3935 .write = cgroup_io_pressure_write, 3936 .poll = cgroup_pressure_poll, 3937 .release = cgroup_pressure_release, 3938 }, 3939 { 3940 .name = "memory.pressure", 3941 .flags = CFTYPE_NO_PREFIX, 3942 .seq_show = cgroup_memory_pressure_show, 3943 .write = cgroup_memory_pressure_write, 3944 .poll = cgroup_pressure_poll, 3945 .release = cgroup_pressure_release, 3946 }, 3947 { 3948 .name = "cpu.pressure", 3949 .flags = CFTYPE_NO_PREFIX, 3950 .seq_show = cgroup_cpu_pressure_show, 3951 .write = cgroup_cpu_pressure_write, 3952 .poll = cgroup_pressure_poll, 3953 .release = cgroup_pressure_release, 3954 }, 3955 #ifdef CONFIG_IRQ_TIME_ACCOUNTING 3956 { 3957 .name = "irq.pressure", 3958 .flags = CFTYPE_NO_PREFIX, 3959 .seq_show = cgroup_irq_pressure_show, 3960 .write = cgroup_irq_pressure_write, 3961 .poll = cgroup_pressure_poll, 3962 .release = cgroup_pressure_release, 3963 }, 3964 #endif 3965 { 3966 .name = "pressure.stat", 3967 .flags = CFTYPE_NO_PREFIX, > 3968 .seq_show = cgroup_psi_stat_show, 3969 }, 3970 { } /* terminate */ 3971 }; 3972 #endif 3973 #else /* CONFIG_PSI */ 3974 bool cgroup_psi_enabled(void) 3975 { 3976 return false; 3977 } 3978 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-46781
by Zeng Heng 26 Sep '24

26 Sep '24

Ryusuke Konishi (2): nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput nilfs2: fix missing cleanup on rollforward recovery error fs/nilfs2/inode.c | 8 ++++++++ fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- fs/nilfs2/segment.c | 2 ++ fs/nilfs2/the_nilfs.h | 2 ++ 4 files changed, 45 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-46781
by Zeng Heng 26 Sep '24

26 Sep '24

Ryusuke Konishi (2): nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput nilfs2: fix missing cleanup on rollforward recovery error fs/nilfs2/inode.c | 8 ++++++++ fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- fs/nilfs2/segment.c | 2 ++ fs/nilfs2/the_nilfs.h | 2 ++ 4 files changed, 45 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-46781
by Zeng Heng 26 Sep '24

26 Sep '24

Ryusuke Konishi (2): nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput nilfs2: fix missing cleanup on rollforward recovery error fs/nilfs2/inode.c | 8 ++++++++ fs/nilfs2/recovery.c | 35 +++++++++++++++++++++++++++++++++-- fs/nilfs2/segment.c | 2 ++ fs/nilfs2/the_nilfs.h | 2 ++ 4 files changed, 45 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] perf/x86/intel: Limit the period on Haswell
by Li Huafei 26 Sep '24

26 Sep '24

From: Kan Liang <kan.liang(a)linux.intel.com> stable inclusion from stable-v6.6.51 commit 0eaf812aa1506704f3b78be87036860e5d0fe81d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IR511 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 25dfc9e357af8aed1ca79b318a73f2c59c1f0b2b upstream. Running the ltp test cve-2015-3290 concurrently reports the following warnings. perfevents: irq loop stuck! WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174 intel_pmu_handle_irq+0x285/0x370 Call Trace: <NMI> ? __warn+0xa4/0x220 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? report_bug+0x3e/0xa0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? irq_work_claim+0x1e/0x40 ? intel_pmu_handle_irq+0x285/0x370 perf_event_nmi_handler+0x3d/0x60 nmi_handle+0x104/0x330 Thanks to Thomas Gleixner's analysis, the issue is caused by the low initial period (1) of the frequency estimation algorithm, which triggers the defects of the HW, specifically erratum HSW11 and HSW143. (For the details, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/) The HSW11 requires a period larger than 100 for the INST_RETIRED.ALL event, but the initial period in the freq mode is 1. The erratum is the same as the BDM11, which has been supported in the kernel. A minimum period of 128 is enforced as well on HSW. HSW143 is regarding that the fixed counter 1 may overcount 32 with the Hyper-Threading is enabled. However, based on the test, the hardware has more issues than it tells. Besides the fixed counter 1, the message 'interrupt took too long' can be observed on any counter which was armed with a period < 32 and two events expired in the same NMI. A minimum period of 32 is enforced for the rest of the events. The recommended workaround code of the HSW143 is not implemented. Because it only addresses the issue for the fixed counter. It brings extra overhead through extra MSR writing. No related overcounting issue has been reported so far. Fixes: 3a632cb229bf ("perf/x86/intel: Add simple Haswell PMU support") Reported-by: Li Huafei <lihuafei1(a)huawei.com> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240819183004.3132920-1-kan.liang@linux.intel.… Closes: https://lore.kernel.org/lkml/20240729223328.327835-1-lihuafei1@huawei.com/ Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/events/intel/core.c [ Context conflict due to the backported commit b0560bfd4b70 ("perf/x86/intel: Clean up the hybrid CPU type handling code"). ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- arch/x86/events/intel/core.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 8b8e9189fd41..e2c1c51d8a01 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -4520,6 +4520,25 @@ static enum hybrid_cpu_type adl_get_hybrid_cpu_type(void) return HYBRID_INTEL_CORE; } +static inline bool erratum_hsw11(struct perf_event *event) +{ + return (event->hw.config & INTEL_ARCH_EVENT_MASK) == + X86_CONFIG(.event=0xc0, .umask=0x01); +} + +/* + * The HSW11 requires a period larger than 100 which is the same as the BDM11. + * A minimum period of 128 is enforced as well for the INST_RETIRED.ALL. + * + * The message 'interrupt took too long' can be observed on any counter which + * was armed with a period < 32 and two events expired in the same NMI. + * A minimum period of 32 is enforced for the rest of the events. + */ +static void hsw_limit_period(struct perf_event *event, s64 *left) +{ + *left = max(*left, erratum_hsw11(event) ? 128 : 32); +} + /* * Broadwell: * @@ -4537,8 +4556,7 @@ static enum hybrid_cpu_type adl_get_hybrid_cpu_type(void) */ static void bdw_limit_period(struct perf_event *event, s64 *left) { - if ((event->hw.config & INTEL_ARCH_EVENT_MASK) == - X86_CONFIG(.event=0xc0, .umask=0x01)) { + if (erratum_hsw11(event)) { if (*left < 128) *left = 128; *left &= ~0x3fULL; @@ -6598,6 +6616,7 @@ __init int intel_pmu_init(void) x86_pmu.hw_config = hsw_hw_config; x86_pmu.get_event_constraints = hsw_get_event_constraints; + x86_pmu.limit_period = hsw_limit_period; x86_pmu.lbr_double_abort = true; extra_attr = boot_cpu_has(X86_FEATURE_RTM) ? hsw_format_attr : nhm_format_attr; -- 2.25.1

2 1

[PATCH OLK-5.10] perf/x86/intel: Limit the period on Haswell
by Li Huafei 26 Sep '24

26 Sep '24

From: Kan Liang <kan.liang(a)linux.intel.com> mainline inclusion from mainline-v6.11-rc7 commit 25dfc9e357af8aed1ca79b318a73f2c59c1f0b2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR511 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running the ltp test cve-2015-3290 concurrently reports the following warnings. perfevents: irq loop stuck! WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174 intel_pmu_handle_irq+0x285/0x370 Call Trace: <NMI> ? __warn+0xa4/0x220 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? __report_bug+0x123/0x130 ? intel_pmu_handle_irq+0x285/0x370 ? report_bug+0x3e/0xa0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1a/0x20 ? irq_work_claim+0x1e/0x40 ? intel_pmu_handle_irq+0x285/0x370 perf_event_nmi_handler+0x3d/0x60 nmi_handle+0x104/0x330 Thanks to Thomas Gleixner's analysis, the issue is caused by the low initial period (1) of the frequency estimation algorithm, which triggers the defects of the HW, specifically erratum HSW11 and HSW143. (For the details, please refer https://lore.kernel.org/lkml/87plq9l5d2.ffs@tglx/) The HSW11 requires a period larger than 100 for the INST_RETIRED.ALL event, but the initial period in the freq mode is 1. The erratum is the same as the BDM11, which has been supported in the kernel. A minimum period of 128 is enforced as well on HSW. HSW143 is regarding that the fixed counter 1 may overcount 32 with the Hyper-Threading is enabled. However, based on the test, the hardware has more issues than it tells. Besides the fixed counter 1, the message 'interrupt took too long' can be observed on any counter which was armed with a period < 32 and two events expired in the same NMI. A minimum period of 32 is enforced for the rest of the events. The recommended workaround code of the HSW143 is not implemented. Because it only addresses the issue for the fixed counter. It brings extra overhead through extra MSR writing. No related overcounting issue has been reported so far. Fixes: 3a632cb229bf ("perf/x86/intel: Add simple Haswell PMU support") Reported-by: Li Huafei <lihuafei1(a)huawei.com> Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20240819183004.3132920-1-kan.liang@linux.intel.… Closes: https://lore.kernel.org/lkml/20240729223328.327835-1-lihuafei1@huawei.com/ Conflicts: arch/x86/events/intel/core.c [ Adapted x86_pmu::limit_period signature due to commit 28f0f3c44b5c (“perf/x86: Change x86_pmu::limit_period signature”) not backported. ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- arch/x86/events/intel/core.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 4372ed2d1637..1786e8d85b6b 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -4414,6 +4414,25 @@ static u8 adl_get_hybrid_cpu_type(void) return hybrid_big; } +static inline bool erratum_hsw11(struct perf_event *event) +{ + return (event->hw.config & INTEL_ARCH_EVENT_MASK) == + X86_CONFIG(.event=0xc0, .umask=0x01); +} + +/* + * The HSW11 requires a period larger than 100 which is the same as the BDM11. + * A minimum period of 128 is enforced as well for the INST_RETIRED.ALL. + * + * The message 'interrupt took too long' can be observed on any counter which + * was armed with a period < 32 and two events expired in the same NMI. + * A minimum period of 32 is enforced for the rest of the events. + */ +static u64 hsw_limit_period(struct perf_event *event, u64 left) +{ + return max(left, erratum_hsw11(event) ? 128ULL : 32ULL); +} + /* * Broadwell: * @@ -4431,8 +4450,7 @@ static u8 adl_get_hybrid_cpu_type(void) */ static u64 bdw_limit_period(struct perf_event *event, u64 left) { - if ((event->hw.config & INTEL_ARCH_EVENT_MASK) == - X86_CONFIG(.event=0xc0, .umask=0x01)) { + if (erratum_hsw11(event)) { if (left < 128) left = 128; left &= ~0x3fULL; @@ -6406,6 +6424,7 @@ __init int intel_pmu_init(void) x86_pmu.hw_config = hsw_hw_config; x86_pmu.get_event_constraints = hsw_get_event_constraints; + x86_pmu.limit_period = hsw_limit_period; x86_pmu.lbr_double_abort = true; extra_attr = boot_cpu_has(X86_FEATURE_RTM) ? hsw_format_attr : nhm_format_attr; -- 2.25.1

2 1

[PATCH OLK-6.6] mmc: mmc_test: Fix NULL dereference on allocation failure
by Cai Xinchen 26 Sep '24

26 Sep '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.48 commit cac2815f49d343b2f0acc4973d2c14918ac3ab0c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOJH CVE: CVE-2024-45028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e627af32ed60713941cbfc8075d44cad07f6dd ] If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. Also change the error code to -ENOMEM instead of returning success. Fixes: 2661081f5ab9 ("mmc_test: highmem tests") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/8c90be28-67b4-4b0d-a105-034dc72a0b31@stanley.moun… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/mmc/core/mmc_test.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c index 0f6a563103fd..d780880ddd14 100644 --- a/drivers/mmc/core/mmc_test.c +++ b/drivers/mmc/core/mmc_test.c @@ -3104,13 +3104,13 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, test->buffer = kzalloc(BUFFER_SIZE, GFP_KERNEL); #ifdef CONFIG_HIGHMEM test->highmem = alloc_pages(GFP_KERNEL | __GFP_HIGHMEM, BUFFER_ORDER); + if (!test->highmem) { + count = -ENOMEM; + goto free_test_buffer; + } #endif -#ifdef CONFIG_HIGHMEM - if (test->buffer && test->highmem) { -#else if (test->buffer) { -#endif mutex_lock(&mmc_test_lock); mmc_test_run(test, testcase); mutex_unlock(&mmc_test_lock); @@ -3118,6 +3118,7 @@ static ssize_t mtf_test_write(struct file *file, const char __user *buf, #ifdef CONFIG_HIGHMEM __free_pages(test->highmem, BUFFER_ORDER); +free_test_buffer: #endif kfree(test->buffer); kfree(test); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION ecca3ab84cbf3cf5ec32574bcec8a068e79d14df
by kernel test robot 26 Sep '24

26 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: ecca3ab84cbf3cf5ec32574bcec8a068e79d14df !11786 LTS patch backport Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409251901.etAiBSp6-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409252213.wl2sqtkC-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409252335.Yggdg4Gw-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202409260104.P8TNlohM-lkp@intel.com drivers/perf/arm_smmuv3_pmu.c:459:9: warning: no previous prototype for 'smmu_pmu_event_show' [-Wmissing-prototypes] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/media/i2c/adv7511-v4l2.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20240925 | |-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20240925 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-003-20240925 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- arm64-randconfig-004-20240925 | |-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- drivers-perf-arm_smmuv3_pmu.c:warning:no-previous-prototype-for-smmu_pmu_event_show | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- x86_64-buildonly-randconfig-001-20240923 | `-- drivers-media-i2c-adv7511-v4l2.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20240926 | `-- fs-gfs2-bmap.c:warning:lblock-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-002-20240923 | |-- block-.tmp_genhd.o:warning:objtool:__device_add_disk:unreachable-instruction | `-- kernel-time-.tmp_posix-cpu-timers.o:warning:objtool:set_process_cpu_timer:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20240926 | `-- arch-x86-power-.tmp_cpu.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-006-20240923 | `-- net-can-j1939-.tmp_address-claim.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20240926 | |-- fs-sysfs-dir.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-sysfs-group.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-sysfs-symlink.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-011-20240926 `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration elapsed time: 734m configs tested: 26 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240925 gcc-14.1.0 arm64 randconfig-002-20240925 gcc-14.1.0 arm64 randconfig-003-20240925 gcc-14.1.0 arm64 randconfig-004-20240925 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240926 gcc-12 x86_64 buildonly-randconfig-002-20240926 gcc-12 x86_64 buildonly-randconfig-003-20240926 gcc-12 x86_64 buildonly-randconfig-004-20240926 clang-18 x86_64 buildonly-randconfig-005-20240926 gcc-12 x86_64 buildonly-randconfig-006-20240926 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240926 clang-18 x86_64 randconfig-002-20240926 clang-18 x86_64 randconfig-003-20240926 clang-18 x86_64 randconfig-004-20240926 gcc-12 x86_64 randconfig-005-20240926 clang-18 x86_64 randconfig-006-20240926 clang-18 x86_64 randconfig-011-20240926 clang-18 x86_64 randconfig-012-20240926 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7550/14112] main.c:undefined reference to `perf_trace_buf_alloc'
by kernel test robot 26 Sep '24

26 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 31022a26e12a84745f84a4e505c128e7cc8a1f33 commit: 1119ec49ac4ac643e6d7c9a5a834040aef87612e [7550/14112] mm, fs: Add BPF_READAHEAD build option for bpf readhead config: loongarch-randconfig-002-20240925 (https://download.01.org/0day-ci/archive/20240926/202409260526.DcjJ8rxS-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240926/202409260526.DcjJ8rxS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409260526.DcjJ8rxS-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from drivers/usb/host/xhci-trace.h:25, from drivers/usb/host/xhci-trace.c:12: In function 'xhci_decode_trb', inlined from 'trace_raw_output_xhci_log_trb' at drivers/usb/host/./xhci-trace.h:110:1: >> drivers/usb/host/xhci.h:2306:17: warning: null destination pointer [-Wformat-truncation=] 2306 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2307 | "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2308 | field1, field0, | ~~~~~~~~~~~~~~~ 2309 | xhci_trb_comp_code_string(GET_COMP_CODE(field2)), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2310 | EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2311 | /* Macro decrements 1, maybe it shouldn't?!? */ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2312 | TRB_TO_EP_INDEX(field3) + 1, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2313 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2314 | field3 & EVENT_DATA ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2315 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2486:17: warning: null destination pointer [-Wformat-truncation=] 2486 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2487 | "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2488 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2489 | field2, field1, field0 & 0xffffffe0, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2490 | TRB_TO_PACKET_TYPE(field0), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2491 | TRB_TO_ROOTHUB_PORT(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2492 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2477:17: warning: null destination pointer [-Wformat-truncation=] 2477 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2478 | "%s: ctx %08x%08x slot %d speed %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2479 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2480 | field1, field0, | ~~~~~~~~~~~~~~~ 2481 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ 2482 | TRB_TO_DEV_SPEED(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2483 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2470:17: warning: null destination pointer [-Wformat-truncation=] 2470 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2471 | "%s: belt %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~ 2472 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2473 | TRB_TO_BELT(field3), | ~~~~~~~~~~~~~~~~~~~~ 2474 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2461:17: warning: null destination pointer [-Wformat-truncation=] 2461 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2462 | "%s: event %08x%08x vf intr %d vf id %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2463 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2464 | field1, field0, | ~~~~~~~~~~~~~~~ 2465 | TRB_TO_VF_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2466 | TRB_TO_VF_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~ 2467 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2454:17: warning: null destination pointer [-Wformat-truncation=] 2454 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2455 | "%s: slot %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~ 2456 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2457 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ 2458 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2443:17: warning: null destination pointer [-Wformat-truncation=] 2443 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2444 | "%s: deq %08x%08x stream %d slot %d ep %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2445 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2446 | field1, field0, | ~~~~~~~~~~~~~~~ 2447 | TRB_TO_STREAM_ID(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2448 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ -- | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2359 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2337:17: warning: null destination pointer [-Wformat-truncation=] 2337 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2338 | "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2339 | field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2340 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2341 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2342 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2343 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2344 | field3 & TRB_CHAIN ? 'C' : 'c', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2345 | field3 & TRB_NO_SNOOP ? 'S' : 's', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2346 | field3 & TRB_ISP ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2347 | field3 & TRB_ENT ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2348 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2319:17: warning: null destination pointer [-Wformat-truncation=] 2319 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2320 | "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2321 | field0 & 0xff, | ~~~~~~~~~~~~~~ 2322 | (field0 & 0xff00) >> 8, | ~~~~~~~~~~~~~~~~~~~~~~~ 2323 | (field0 & 0xff000000) >> 24, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2324 | (field0 & 0xff0000) >> 16, | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 2325 | (field1 & 0xff00) >> 8, | ~~~~~~~~~~~~~~~~~~~~~~~ 2326 | field1 & 0xff, | ~~~~~~~~~~~~~~ 2327 | (field1 & 0xff000000) >> 16 | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2328 | (field1 & 0xff0000) >> 16, | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 2329 | TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2330 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2331 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2332 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2333 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2334 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2365:17: warning: null destination pointer [-Wformat-truncation=] 2365 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2366 | "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2367 | field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2368 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2369 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2370 | field3 & TRB_BEI ? 'B' : 'b', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2371 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2372 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2373 | field3 & TRB_CHAIN ? 'C' : 'c', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2374 | field3 & TRB_NO_SNOOP ? 'S' : 's', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2375 | field3 & TRB_ISP ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2376 | field3 & TRB_ENT ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2377 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2495:17: warning: null destination pointer [-Wformat-truncation=] 2495 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2496 | "type '%s' -> raw %08x %08x %08x %08x", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2497 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2498 | field0, field1, field2, field3); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/trace/define_trace.h:102, from drivers/usb/host/xhci-trace.h:622: drivers/usb/host/./xhci-trace.h: In function 'trace_raw_output_xhci_log_trb': >> drivers/usb/host/./xhci-trace.h:127:19: warning: '%s' directive argument is null [-Wformat-overflow=] 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~~~~~~~ include/trace/trace_events.h:203:34: note: in definition of macro 'DECLARE_EVENT_CLASS' 203 | trace_event_printf(iter, print); \ | ^~~~~ drivers/usb/host/./xhci-trace.h:127:9: note: in expansion of macro 'TP_printk' 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~~~~~~~~ In file included from include/trace/trace_events.h:237: drivers/usb/host/./xhci-trace.h:127:24: note: format string is defined here 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~ In function 'xhci_decode_ep_context', inlined from 'trace_raw_output_xhci_log_ep_ctx' at drivers/usb/host/./xhci-trace.h:312:1: >> drivers/usb/host/xhci.h:2801:15: warning: argument 1 null where non-null expected [-Wnonnull] 2801 | ret = sprintf(str, "State %s mult %d max P. Streams %d %s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2802 | xhci_ep_state_string(ep_state), mult, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2803 | max_pstr, lsa ? "LSA " : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/kernel.h:32, from include/linux/cpumask.h:10, from include/linux/smp.h:13, from include/linux/tracepoint.h:15, from drivers/usb/host/xhci-trace.h:24: include/linux/sprintf.h: In function 'trace_raw_output_xhci_log_ep_ctx': include/linux/sprintf.h:10:20: note: in a call to function 'sprintf' declared 'nonnull' 10 | __printf(2, 3) int sprintf(char *buf, const char * fmt, ...); | ^~~~~~~ In function 'xhci_decode_ep_context', inlined from 'trace_raw_output_xhci_log_ep_ctx' at drivers/usb/host/./xhci-trace.h:312:1: drivers/usb/host/xhci.h:2801:15: warning: null destination pointer [-Wformat-overflow=] 2801 | ret = sprintf(str, "State %s mult %d max P. Streams %d %s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2802 | xhci_ep_state_string(ep_state), mult, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2803 | max_pstr, lsa ? "LSA " : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/./xhci-trace.h: In function 'trace_raw_output_xhci_log_ep_ctx': drivers/usb/host/./xhci-trace.h:327:19: warning: '%s' directive argument is null [-Wformat-overflow=] 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~~~ include/trace/trace_events.h:203:34: note: in definition of macro 'DECLARE_EVENT_CLASS' 203 | trace_event_printf(iter, print); \ | ^~~~~ drivers/usb/host/./xhci-trace.h:327:9: note: in expansion of macro 'TP_printk' 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~~~~~~~~ drivers/usb/host/./xhci-trace.h:327:20: note: format string is defined here 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~ In function 'xhci_decode_slot_context', inlined from 'trace_raw_output_xhci_log_slot_ctx' at drivers/usb/host/./xhci-trace.h:357:1: drivers/usb/host/xhci.h:2546:15: warning: argument 1 null where non-null expected [-Wnonnull] 2546 | ret = sprintf(str, "RS %05x %s%s%s Ctx Entries %d MEL %d us Port# %d/%d", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2547 | info & ROUTE_STRING_MASK, | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2548 | ({ char *s; | ~~~~~~~~~~~ 2549 | switch (speed) { | ~~~~~~~~~~~~~~~~ 2550 | case SLOT_SPEED_FS: | ~~~~~~~~~~~~~~~~~~~ 2551 | s = "full-speed"; | ~~~~~~~~~~~~~~~~~ 2552 | break; | ~~~~~~ 2553 | case SLOT_SPEED_LS: | ~~~~~~~~~~~~~~~~~~~ 2554 | s = "low-speed"; | ~~~~~~~~~~~~~~~~ 2555 | break; | ~~~~~~ 2556 | case SLOT_SPEED_HS: | ~~~~~~~~~~~~~~~~~~~ 2557 | s = "high-speed"; | ~~~~~~~~~~~~~~~~~ 2558 | break; | ~~~~~~ 2559 | case SLOT_SPEED_SS: | ~~~~~~~~~~~~~~~~~~~ 2560 | s = "super-speed"; | ~~~~~~~~~~~~~~~~~~ 2561 | break; | ~~~~~~ 2562 | case SLOT_SPEED_SSP: | ~~~~~~~~~~~~~~~~~~~~ 2563 | s = "super-speed plus"; | ~~~~~~~~~~~~~~~~~~~~~~~ 2564 | break; | ~~~~~~ 2565 | default: | ~~~~~~~~ 2566 | s = "UNKNOWN speed"; | ~~~~~~~~~~~~~~~~~~~~ 2567 | } s; }), | ~~~~~~~~ 2568 | mtt ? " multi-TT" : "", | ~~~~~~~~~~~~~~~~~~~~~~~ 2569 | hub ? " Hub" : "", | ~~~~~~~~~~~~~~~~~~ 2570 | (info & LAST_CTX_MASK) >> 27, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2571 | info2 & MAX_EXIT, | ~~~~~~~~~~~~~~~~~ 2572 | DEVINFO_TO_ROOT_HUB_PORT(info2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2573 | DEVINFO_TO_MAX_PORTS(info2)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/sprintf.h: In function 'trace_raw_output_xhci_log_slot_ctx': include/linux/sprintf.h:10:20: note: in a call to function 'sprintf' declared 'nonnull' 10 | __printf(2, 3) int sprintf(char *buf, const char * fmt, ...); | ^~~~~~~ .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 81a41d2ac1de43215c014bc71d907a026042e55b
by kernel test robot 26 Sep '24

26 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 81a41d2ac1de43215c014bc71d907a026042e55b !11747 [OLK 6.6] some bugfixes for hns3 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202409252253.TKzwXzes-lkp@intel.com ERROR: modpost: "_vfio_alloc_device" [drivers/crypto/ccp/hygon/hct.ko] undefined! ERROR: modpost: "vfio_register_emulated_iommu_dev" [drivers/crypto/ccp/hygon/hct.ko] undefined! arch/arm64/kernel/cpufeature.c:2313:6: error: redefinition of 'mpam_detect_is_enabled' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- drivers-iommu-arm-arm-smmu-v3-arm-s-smmu-v3.c:warning:no-previous-prototype-for-function-virtcca_smmu_gerror_handler |-- arm64-randconfig-001-20240925 | `-- arch-arm64-kernel-cpufeature.c:error:redefinition-of-mpam_detect_is_enabled |-- loongarch-allmodconfig | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-buildonly-randconfig-001-20240925 | `-- vmlinux.o:warning:objtool:.text:unreachable-instruction |-- x86_64-buildonly-randconfig-006-20240925 | `-- include-linux-psp-hygon.h:error:conflicting-types-for-vpsp_try_do_cmd |-- x86_64-randconfig-001-20240925 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-randconfig-005-20240925 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-hct.c:error:no-member-named-numa_node-in-struct-device | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-randconfig-071-20240925 | |-- ERROR:mdev_register_driver-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:mdev_register_parent-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:mdev_unregister_driver-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:mdev_unregister_parent-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_iommufd_emulated_attach_ioas-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_iommufd_emulated_bind-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_iommufd_emulated_detach_ioas-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_iommufd_emulated_unbind-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_set_irqs_validate_and_prepare-drivers-crypto-ccp-hygon-hct.ko-undefined | `-- ERROR:vfio_unregister_group_dev-drivers-crypto-ccp-hygon-hct.ko-undefined |-- x86_64-randconfig-073-20240925 | |-- ERROR:_vfio_alloc_device-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:mdev_register_driver-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:mdev_register_parent-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:mdev_unregister_driver-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:mdev_unregister_parent-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_iommufd_emulated_bind-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_iommufd_emulated_unbind-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_register_emulated_iommu_dev-drivers-crypto-ccp-hygon-hct.ko-undefined | |-- ERROR:vfio_set_irqs_validate_and_prepare-drivers-crypto-ccp-hygon-hct.ko-undefined | `-- ERROR:vfio_unregister_group_dev-drivers-crypto-ccp-hygon-hct.ko-undefined |-- x86_64-randconfig-075-20240925 | `-- drivers-crypto-ccp-hygon-hct.c:error:no-member-named-numa_node-in-struct-device |-- x86_64-randconfig-161-20240925 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 721m configs tested: 40 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240925 gcc-14.1.0 arm64 randconfig-002-20240925 gcc-14.1.0 arm64 randconfig-003-20240925 clang-20 arm64 randconfig-004-20240925 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240925 gcc-14.1.0 loongarch randconfig-002-20240925 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240925 clang-18 x86_64 buildonly-randconfig-002-20240925 clang-18 x86_64 buildonly-randconfig-003-20240925 gcc-12 x86_64 buildonly-randconfig-004-20240925 clang-18 x86_64 buildonly-randconfig-005-20240925 clang-18 x86_64 buildonly-randconfig-006-20240925 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240925 gcc-12 x86_64 randconfig-002-20240925 clang-18 x86_64 randconfig-003-20240925 gcc-12 x86_64 randconfig-004-20240925 gcc-12 x86_64 randconfig-005-20240925 clang-18 x86_64 randconfig-006-20240925 clang-18 x86_64 randconfig-011-20240925 clang-18 x86_64 randconfig-012-20240925 clang-18 x86_64 randconfig-013-20240925 clang-18 x86_64 randconfig-014-20240925 clang-18 x86_64 randconfig-015-20240925 clang-18 x86_64 randconfig-016-20240925 clang-18 x86_64 randconfig-071-20240925 gcc-12 x86_64 randconfig-072-20240925 gcc-12 x86_64 randconfig-073-20240925 clang-18 x86_64 randconfig-074-20240925 gcc-12 x86_64 randconfig-075-20240925 clang-18 x86_64 randconfig-076-20240925 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION d831c8e9a987a5c339274aaac9f8d205dba1ef8b
by kernel test robot 26 Sep '24

26 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: d831c8e9a987a5c339274aaac9f8d205dba1ef8b !11730 media: xc2028: avoid use-after-free in load_firmware_cb() Unverified Error/Warning (likely false positive, kindly check if interested): drivers/platform/x86/intel_speed_select_if/isst_tpmi_core.c:1164 isst_if_get_turbo_freq_info() warn: potential spectre issue 'power_domain_info->perf_levels' [r] (local cap) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20240925 | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-randconfig-004-20240925 | `-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | |-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-function-mcp251xfd_tx_obj_write_sync | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_mbx_set_vf_multi_tc | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_tm.c:warning:no-previous-prototype-for-function-hclge_tm_vf_tc_dwrr_cfg | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_main.c:warning:variable-err-is-used-uninitialized-whenever-if-condition-is-false | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-direction-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:Excess-function-parameter-queue-description-in-rnpgbevf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-direction-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-queue-description-in-rnpvf_set_ring_vector | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-function-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_CTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-ctx-not-described-in-ubcore_update_uvs_eid_ret | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-dev-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:Function-parameter-or-member-req-not-described-in-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-function-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-function-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-function-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_TPG-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-function-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-function-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:comparison-of-address-of-dev-ht-UBCORE_HT_UTP-.head-equal-to-a-null-pointer-is-always-false | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-function-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_get_umap_ops | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_umap_priv_init | |-- drivers-ub-urma-uburma-uburma_mmap.c:warning:no-previous-prototype-for-function-uburma_unmap_vma_pages | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | |-- ld.lld:error:duplicate-symbol:debug | `-- ld.lld:error:duplicate-symbol:g_uld_mutex |-- x86_64-buildonly-randconfig-001-20240925 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20240925 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.o:warning:objtool:sss_tool_write_clp_reg-falls-through-to-next-function-sss_tool_write_clp_data() | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20240925 | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-004-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-buildonly-randconfig-005-20240925 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-defconfig | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-kexec | |-- arch-x86-kvm-vmx-vmx.o:warning:objtool:fix_rmode_seg:unreachable-instruction | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-001-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-002-20240925 | |-- drivers-usb-dwc2-core_intr.c:error:no-member-named-bus_suspended-in-struct-dwc2_hsotg | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-003-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-004-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-randconfig-005-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-006-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-011-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-012-20240925 | |-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register | `-- ld.lld:error:undefined-symbol:latency_fsnotify |-- x86_64-randconfig-013-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-014-20240925 | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register |-- x86_64-randconfig-161-20240925 | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_root_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:copy_highpages_table-proc_handler | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_root_table-procname | |-- arch-x86-lib-copy_highpages.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:copy_highpages_table-procname | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_clos_assoc()-warn:possible-spectre-second-half.-sst_inst | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_clos_assoc()-warn:potential-spectre-issue-isst_common.sst_inst-r | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_clos_assoc()-warn:potential-spectre-issue-sst_inst-power_domain_info-r | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_base_freq_info()-warn:potential-spectre-issue-power_domain_info-perf_levels-r-(local-cap) | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_base_freq_mask()-warn:potential-spectre-issue-power_domain_info-perf_levels-r | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_perf_level_info()-warn:potential-spectre-issue-power_domain_info-perf_levels-r-(local-cap) | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_perf_level_mask()-warn:potential-spectre-issue-power_domain_info-perf_levels-r | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_tpmi_instance_count()-warn:possible-spectre-second-half.-sst_inst | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_tpmi_instance_count()-warn:potential-spectre-issue-isst_common.sst_inst-r-(local-cap) | |-- drivers-platform-x86-intel_speed_select_if-isst_tpmi_core.c-isst_if_get_turbo_freq_info()-warn:potential-spectre-issue-power_domain_info-perf_levels-r-(local-cap) | |-- fs-cifs-file.c-cifs_write_from_iter()-error:uninitialized-symbol-pagevec-. | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register |-- x86_64-rhel-8.3-kselftests | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr0 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_post_set_cr4 | |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-kvm_read_guest_page_mmu | |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-hmat_restore_target | `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-klp_static_call_register `-- x86_64-rhel-8.3-rust |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr0 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_post_set_cr4 |-- arch-x86-kvm-x86.c:warning:no-previous-prototype-for-function-kvm_read_guest_page_mmu |-- drivers-acpi-numa-hmat.c:warning:no-previous-prototype-for-function-hmat_restore_target `-- kernel-static_call_inline.c:warning:no-previous-prototype-for-function-klp_static_call_register elapsed time: 724m configs tested: 29 configs skipped: 127 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240925 gcc-14.1.0 arm64 randconfig-002-20240925 gcc-14.1.0 arm64 randconfig-003-20240925 clang-20 arm64 randconfig-004-20240925 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240925 clang-18 x86_64 buildonly-randconfig-002-20240925 clang-18 x86_64 buildonly-randconfig-003-20240925 gcc-12 x86_64 buildonly-randconfig-004-20240925 clang-18 x86_64 buildonly-randconfig-005-20240925 clang-18 x86_64 buildonly-randconfig-006-20240925 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240925 gcc-12 x86_64 randconfig-002-20240925 clang-18 x86_64 randconfig-003-20240925 gcc-12 x86_64 randconfig-004-20240925 gcc-12 x86_64 randconfig-005-20240925 clang-18 x86_64 randconfig-006-20240925 clang-18 x86_64 randconfig-011-20240925 clang-18 x86_64 randconfig-012-20240925 clang-18 x86_64 randconfig-013-20240925 clang-18 x86_64 randconfig-014-20240925 clang-18 x86_64 randconfig-015-20240925 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 3158/23766] drivers/perf/arm_smmuv3_pmu.c:459:9: warning: no previous prototype for 'smmu_pmu_event_show'
by kernel test robot 26 Sep '24

26 Sep '24

Hi Neil, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ecca3ab84cbf3cf5ec32574bcec8a068e79d14df commit: d80280f7df4f4be25d67a6460b63b3d2e0b5170d [3158/23766] perf: add arm64 smmuv3 pmu driver config: arm64-randconfig-004-20240925 (https://download.01.org/0day-ci/archive/20240926/202409260104.P8TNlohM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240926/202409260104.P8TNlohM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409260104.P8TNlohM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/perf/arm_smmuv3_pmu.c:459:9: warning: no previous prototype for 'smmu_pmu_event_show' [-Wmissing-prototypes] 459 | ssize_t smmu_pmu_event_show(struct device *dev, | ^~~~~~~~~~~~~~~~~~~ vim +/smmu_pmu_event_show +459 drivers/perf/arm_smmuv3_pmu.c 458 > 459 ssize_t smmu_pmu_event_show(struct device *dev, 460 struct device_attribute *attr, char *page) 461 { 462 struct perf_pmu_events_attr *pmu_attr; 463 464 pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr); 465 466 return sprintf(page, "event=0x%02llx\n", pmu_attr->id); 467 } 468 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15191/23766] block/.tmp_genhd.o: warning: objtool: __device_add_disk()+0x387: unreachable instruction
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ecca3ab84cbf3cf5ec32574bcec8a068e79d14df commit: 8ce6cbc44f9ca78cac43506c84fcdd7beadee07f [15191/23766] block: fix use-after-free in disk_part_iter_next config: x86_64-buildonly-randconfig-002-20240923 (https://download.01.org/0day-ci/archive/20240925/202409252335.Yggdg4Gw-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409252335.Yggdg4Gw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409252335.Yggdg4Gw-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from block/genhd.c:10: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. block/genhd.c:532: warning: Function parameter or member 'devt' not described in 'blk_invalidate_devt' >> block/.tmp_genhd.o: warning: objtool: __device_add_disk()+0x387: unreachable instruction objdump-func vmlinux.o __device_add_disk: -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 14108/14122] arch/arm64/kernel/cpufeature.c:2313:6: error: redefinition of 'mpam_detect_is_enabled'
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 81a41d2ac1de43215c014bc71d907a026042e55b commit: ab331ac5b797eb3889777f3d8d98a86069c5720e [14108/14122] arm64/mpam: Check mpam_detect_is_enabled() before accessing MPAM registers config: arm64-randconfig-001-20240925 (https://download.01.org/0day-ci/archive/20240925/202409252253.TKzwXzes-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409252253.TKzwXzes-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409252253.TKzwXzes-lkp@intel.com/ All errors (new ones prefixed by >>): >> arch/arm64/kernel/cpufeature.c:2313:6: error: redefinition of 'mpam_detect_is_enabled' 2313 | bool mpam_detect_is_enabled(void) | ^~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/ptrace.h:11, from arch/arm64/include/asm/irqflags.h:10, from include/linux/irqflags.h:17, from include/linux/rcupdate.h:26, from include/linux/rculist.h:11, from include/linux/pid.h:5, from include/linux/sched.h:14, from include/linux/sched/task_stack.h:9, from include/linux/elfcore.h:7, from include/linux/crash_core.h:6, from include/linux/kexec.h:18, from include/linux/crash_dump.h:5, from arch/arm64/kernel/cpufeature.c:67: arch/arm64/include/asm/cpufeature.h:864:20: note: previous definition of 'mpam_detect_is_enabled' with type 'bool(void)' {aka '_Bool(void)'} 864 | static inline bool mpam_detect_is_enabled(void) | ^~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/cpufeature.c:2133:13: warning: 'enable_pseudo_nmi' defined but not used [-Wunused-variable] 2133 | static bool enable_pseudo_nmi; | ^~~~~~~~~~~~~~~~~ vim +/mpam_detect_is_enabled +2313 arch/arm64/kernel/cpufeature.c 2311 2312 static bool __read_mostly mpam_force_enabled; > 2313 bool mpam_detect_is_enabled(void) 2314 { 2315 return mpam_force_enabled; 2316 } 2317 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13475/23766] net/can/j1939/.tmp_address-claim.o: warning: objtool: missing symbol for section .text
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ecca3ab84cbf3cf5ec32574bcec8a068e79d14df commit: e0c2ee9edcacfdda0e806166eaec1310cdf9e324 [13475/23766] can: add support of SAE J1939 protocol config: x86_64-buildonly-randconfig-006-20240923 (https://download.01.org/0day-ci/archive/20240925/202409252213.wl2sqtkC-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409252213.wl2sqtkC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409252213.wl2sqtkC-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/can/j1939/.tmp_address-claim.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 25 Sep '24

25 Sep '24

Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 25 Sep '24

25 Sep '24

Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[openeuler:openEuler-1.0-LTS 9406/23766] kernel/time/.tmp_posix-cpu-timers.o: warning: objtool: set_process_cpu_timer()+0xc7: unreachable instruction
by kernel test robot 25 Sep '24

25 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ecca3ab84cbf3cf5ec32574bcec8a068e79d14df commit: 36ff49c95a04513935898fdcd4bc37646b2dc459 [9406/23766] posix-cpu-timers: Sanitize bogus WARNONS config: x86_64-buildonly-randconfig-002-20240923 (https://download.01.org/0day-ci/archive/20240925/202409251901.etAiBSp6-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240925/202409251901.etAiBSp6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409251901.etAiBSp6-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/time/.tmp_posix-cpu-timers.o: warning: objtool: set_process_cpu_timer()+0xc7: unreachable instruction objdump-func vmlinux.o set_process_cpu_timer: 0000 000000000011ca20 <set_process_cpu_timer>: 0000 11ca20: f3 0f 1e fa endbr64 0004 11ca24: 83 fe 02 cmp $0x2,%esi 0007 11ca27: 0f 83 82 00 00 00 jae 11caaf <set_process_cpu_timer+0x8f> 000d 11ca2d: 41 57 push %r15 000f 11ca2f: 41 56 push %r14 0011 11ca31: 53 push %rbx 0012 11ca32: 49 89 ce mov %rcx,%r14 0015 11ca35: 48 89 d3 mov %rdx,%rbx 0018 11ca38: 48 89 f8 mov %rdi,%rax 001b 11ca3b: 48 8b 8f a8 05 00 00 mov 0x5a8(%rdi),%rcx 0022 11ca42: 89 f2 mov %esi,%edx 0024 11ca44: 48 8d 14 52 lea (%rdx,%rdx,2),%rdx 0028 11ca48: 4c 8d bc d1 88 02 00 00 lea 0x288(%rcx,%rdx,8),%r15 0030 11ca50: 89 f7 mov %esi,%edi 0032 11ca52: 48 89 c6 mov %rax,%rsi 0035 11ca55: ba 01 00 00 00 mov $0x1,%edx 003a 11ca5a: e8 41 09 00 00 call 11d3a0 <cpu_clock_sample_group> 003f 11ca5f: 4d 85 f6 test %r14,%r14 0042 11ca62: 74 2c je 11ca90 <set_process_cpu_timer+0x70> 0044 11ca64: 49 8b 0e mov (%r14),%rcx 0047 11ca67: 48 85 c9 test %rcx,%rcx 004a 11ca6a: 74 0f je 11ca7b <set_process_cpu_timer+0x5b> 004c 11ca6c: 48 29 c1 sub %rax,%rcx 004f 11ca6f: ba 00 09 3d 00 mov $0x3d0900,%edx 0054 11ca74: 48 0f 47 d1 cmova %rcx,%rdx 0058 11ca78: 49 89 16 mov %rdx,(%r14) 005b 11ca7b: 48 8b 0b mov (%rbx),%rcx 005e 11ca7e: 48 85 c9 test %rcx,%rcx 0061 11ca81: 74 23 je 11caa6 <set_process_cpu_timer+0x86> 0063 11ca83: 48 01 c1 add %rax,%rcx 0066 11ca86: 48 89 0b mov %rcx,(%rbx) 0069 11ca89: 49 3b 0f cmp (%r15),%rcx 006c 11ca8c: 72 0a jb 11ca98 <set_process_cpu_timer+0x78> 006e 11ca8e: eb 0b jmp 11ca9b <set_process_cpu_timer+0x7b> 0070 11ca90: 48 8b 0b mov (%rbx),%rcx 0073 11ca93: 49 3b 0f cmp (%r15),%rcx 0076 11ca96: 73 03 jae 11ca9b <set_process_cpu_timer+0x7b> 0078 11ca98: 49 89 0f mov %rcx,(%r15) 007b 11ca9b: 5b pop %rbx 007c 11ca9c: 41 5e pop %r14 007e 11ca9e: 41 5f pop %r15 0080 11caa0: 2e e9 00 00 00 00 cs jmp 11caa6 <set_process_cpu_timer+0x86> 11caa2: R_X86_64_PLT32 __x86_return_thunk-0x4 0086 11caa6: 31 c9 xor %ecx,%ecx 0088 11caa8: 49 3b 0f cmp (%r15),%rcx 008b 11caab: 72 eb jb 11ca98 <set_process_cpu_timer+0x78> 008d 11caad: eb ec jmp 11ca9b <set_process_cpu_timer+0x7b> 008f 11caaf: 0f 0b ud2 0091 11cab1: 2e e9 00 00 00 00 cs jmp 11cab7 <set_process_cpu_timer+0x97> 11cab3: R_X86_64_PLT32 __x86_return_thunk-0x4 0097 11cab7: 66 0f 1f 84 00 00 00 00 00 nopw 0x0(%rax,%rax,1) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0