- Kernel - mailweb.openeuler.org

[PATCH v2 OLK-6.6] KABI: Reserve kABI for future migration feautre
by Zhenyu Ye 31 Oct '24

31 Oct '24

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA ---------------------------------------------------------------------- Reserve kABI for future migration feautre Signed-off-by: eillon <yezhenyu2(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 2 ++ include/linux/kvm_host.h | 1 + 2 files changed, 3 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098ec9..98e07bcd33ed 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -628,6 +628,8 @@ struct kvm_vcpu_arch { #ifdef CONFIG_HISI_VIRTCCA_HOST struct virtcca_cvm_tec tec; #endif + KABI_RESERVE(1) + KABI_RESERVE(2) }; /* diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 000ae1ba0635..da40eaa90986 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -841,6 +841,7 @@ struct kvm { struct notifier_block pm_notifier; #endif char stats_id[KVM_STATS_NAME_SIZE]; + KABI_RESERVE(1) }; #define kvm_err(fmt, ...) \ -- 2.39.3

2 1

[PATCH openEuler-1.0-LTS] ext4: fix warning: unused variable ‘sbi’ in ext4_dax_writepages()
by Baokun Li 31 Oct '24

31 Oct '24

hulk inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/I9SYGK CVE: NA -------------------------------- Remove ext4_dax_writepages() unused variable 'sbi' to silence the following warning: fs/ext4/inode.c: In function ‘ext4_dax_writepages’: fs/ext4/inode.c:2995:23: warning: unused variable ‘sbi’ [-Wunused-variable] 2995 | struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb); Fixes: 7b208222f684 ("ext4: avoid deadlock in fs reclaim with page writeback") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/inode.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 6578d33b62d6..1b1ebb3862ce 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -2992,7 +2992,6 @@ static int ext4_dax_writepages(struct address_space *mapping, int ret; long nr_to_write = wbc->nr_to_write; struct inode *inode = mapping->host; - struct ext4_sb_info *sbi = EXT4_SB(mapping->host->i_sb); int alloc_ctx; if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: uvc: Prevent buffer overflow in setup handler
by Wenyu Huang 31 Oct '24

31 Oct '24

From: Szymon Heidrich <szymon.heidrich(a)gmail.com> stable inclusion from stable-v4.19.270 commit bc8380fe5768c564f921f7b4eaba932e330b9e4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRED CVE: CVE-2022-48948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4c92670b16727365699fe4b19ed32013bab2c107 upstream. Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes. Fixes: cdda479f15cd ("USB gadget: video class function driver") Cc: stable <stable(a)kernel.org> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Reviewed-by: Daniel Scally <dan.scally(a)ideasonboard.com> Signed-off-by: Szymon Heidrich <szymon.heidrich(a)gmail.com> Link: https://lore.kernel.org/r/20221206141301.51305-1-szymon.heidrich@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/usb/gadget/function/f_uvc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c index d8ce7868fe225..847434e5d7ae6 100644 --- a/drivers/usb/gadget/function/f_uvc.c +++ b/drivers/usb/gadget/function/f_uvc.c @@ -219,8 +219,9 @@ uvc_function_ep0_complete(struct usb_ep *ep, struct usb_request *req) memset(&v4l2_event, 0, sizeof(v4l2_event)); v4l2_event.type = UVC_EVENT_DATA; - uvc_event->data.length = req->actual; - memcpy(&uvc_event->data.data, req->buf, req->actual); + uvc_event->data.length = min_t(unsigned int, req->actual, + sizeof(uvc_event->data.data)); + memcpy(&uvc_event->data.data, req->buf, uvc_event->data.length); v4l2_event_queue(&uvc->vdev, &v4l2_event); } } -- 2.34.1

2 1

[PATCH OLK-6.6] KABI: Reserve kABI for future migration feautre
by Zhenyu Ye 31 Oct '24

31 Oct '24

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA Reserve kABI for future migration feautre Signed-off-by: eillon <yezhenyu2(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 2 ++ include/linux/kvm_host.h | 1 + 2 files changed, 3 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index ac8115098ec9..98e07bcd33ed 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -628,6 +628,8 @@ struct kvm_vcpu_arch { #ifdef CONFIG_HISI_VIRTCCA_HOST struct virtcca_cvm_tec tec; #endif + KABI_RESERVE(1) + KABI_RESERVE(2) }; /* diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 000ae1ba0635..da40eaa90986 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -841,6 +841,7 @@ struct kvm { struct notifier_block pm_notifier; #endif char stats_id[KVM_STATS_NAME_SIZE]; + KABI_RESERVE(1) }; #define kvm_err(fmt, ...) \ -- 2.39.3

2 1

[PATCH OLK-6.6] parport: Proper fix for array out-of-bounds access
by Yipeng Zou 31 Oct '24

31 Oct '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.58 commit 66029078fee00646e2e9dbb8f41ff7819f8e7569 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB0ENI CVE: CVE-2024-50074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9 upstream. The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly. Fixes: ab11dac93d2d ("dev/parport: fix the array out-of-bounds risk") Cc: stable(a)vger.kernel.org Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Link: https://lore.kernel.org/r/20240920103318.19271-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/parport/procfs.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c index c334ef6e3b3f..3b7d7e23602a 100644 --- a/drivers/parport/procfs.c +++ b/drivers/parport/procfs.c @@ -58,12 +58,12 @@ static int do_active_device(struct ctl_table *table, int write, for (dev = port->devices; dev ; dev = dev->next) { if(dev == port->cad) { - len += snprintf(buffer, sizeof(buffer), "%s\n", dev->name); + len += scnprintf(buffer, sizeof(buffer), "%s\n", dev->name); } } if(!len) { - len += snprintf(buffer, sizeof(buffer), "%s\n", "none"); + len += scnprintf(buffer, sizeof(buffer), "%s\n", "none"); } if (len > *lenp) @@ -94,19 +94,19 @@ static int do_autoprobe(struct ctl_table *table, int write, } if ((str = info->class_name) != NULL) - len += snprintf (buffer + len, sizeof(buffer) - len, "CLASS:%s;\n", str); + len += scnprintf (buffer + len, sizeof(buffer) - len, "CLASS:%s;\n", str); if ((str = info->model) != NULL) - len += snprintf (buffer + len, sizeof(buffer) - len, "MODEL:%s;\n", str); + len += scnprintf (buffer + len, sizeof(buffer) - len, "MODEL:%s;\n", str); if ((str = info->mfr) != NULL) - len += snprintf (buffer + len, sizeof(buffer) - len, "MANUFACTURER:%s;\n", str); + len += scnprintf (buffer + len, sizeof(buffer) - len, "MANUFACTURER:%s;\n", str); if ((str = info->description) != NULL) - len += snprintf (buffer + len, sizeof(buffer) - len, "DESCRIPTION:%s;\n", str); + len += scnprintf (buffer + len, sizeof(buffer) - len, "DESCRIPTION:%s;\n", str); if ((str = info->cmdset) != NULL) - len += snprintf (buffer + len, sizeof(buffer) - len, "COMMAND SET:%s;\n", str); + len += scnprintf (buffer + len, sizeof(buffer) - len, "COMMAND SET:%s;\n", str); if (len > *lenp) len = *lenp; @@ -135,7 +135,7 @@ static int do_hardware_base_addr(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += snprintf (buffer, sizeof(buffer), "%lu\t%lu\n", port->base, port->base_hi); + len += scnprintf (buffer, sizeof(buffer), "%lu\t%lu\n", port->base, port->base_hi); if (len > *lenp) len = *lenp; @@ -162,7 +162,7 @@ static int do_hardware_irq(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += snprintf (buffer, sizeof(buffer), "%d\n", port->irq); + len += scnprintf (buffer, sizeof(buffer), "%d\n", port->irq); if (len > *lenp) len = *lenp; @@ -189,7 +189,7 @@ static int do_hardware_dma(struct ctl_table *table, int write, if (write) /* permissions prevent this anyway */ return -EACCES; - len += snprintf (buffer, sizeof(buffer), "%d\n", port->dma); + len += scnprintf (buffer, sizeof(buffer), "%d\n", port->dma); if (len > *lenp) len = *lenp; @@ -220,7 +220,7 @@ static int do_hardware_modes(struct ctl_table *table, int write, #define printmode(x) \ do { \ if (port->modes & PARPORT_MODE_##x) \ - len += snprintf(buffer + len, sizeof(buffer) - len, "%s%s", f++ ? "," : "", #x); \ + len += scnprintf(buffer + len, sizeof(buffer) - len, "%s%s", f++ ? "," : "", #x); \ } while (0) int f = 0; printmode(PCSPP); -- 2.34.1

2 1

[PATCH OLK-6.6] r8169: add tally counter fields added with RTL8125
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v6.6.55 commit 1c723d785adb711496bc64c24240f952f4faaabf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9Q CVE: CVE-2024-49973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it. Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Cc: stable(a)vger.kernel.org Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/realtek/r8169_main.c [Missing previous patch 8df9439389a4, fix this conflict] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index 8a732edac15a..8987eb143758 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -567,6 +567,33 @@ struct rtl8169_counters { __le32 rx_multicast; __le16 tx_aborted; __le16 tx_underun; + /* new since RTL8125 */ + __le64 tx_octets; + __le64 rx_octets; + __le64 rx_multicast64; + __le64 tx_unicast64; + __le64 tx_broadcast64; + __le64 tx_multicast64; + __le32 tx_pause_on; + __le32 tx_pause_off; + __le32 tx_pause_all; + __le32 tx_deferred; + __le32 tx_late_collision; + __le32 tx_all_collision; + __le32 tx_aborted32; + __le32 align_errors32; + __le32 rx_frame_too_long; + __le32 rx_runt; + __le32 rx_pause_on; + __le32 rx_pause_off; + __le32 rx_pause_all; + __le32 rx_unknown_opcode; + __le32 rx_mac_error; + __le32 tx_underrun32; + __le32 rx_mac_missed; + __le32 rx_tcam_dropped; + __le32 tdu; + __le32 rdu; }; struct rtl8169_tc_offsets { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] r8169: add tally counter fields added with RTL8125
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v5.10.227 commit 991e8b0bab669b7d06927c3e442b3352532e8581 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9Q CVE: CVE-2024-49973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it. Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Cc: stable(a)vger.kernel.org Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/realtek/r8169_main.c [Missing previous patch 8df9439389a4, fix this conflict] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index c4e96293323c..5706e2d235f0 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -569,6 +569,33 @@ struct rtl8169_counters { __le32 rx_multicast; __le16 tx_aborted; __le16 tx_underun; + /* new since RTL8125 */ + __le64 tx_octets; + __le64 rx_octets; + __le64 rx_multicast64; + __le64 tx_unicast64; + __le64 tx_broadcast64; + __le64 tx_multicast64; + __le32 tx_pause_on; + __le32 tx_pause_off; + __le32 tx_pause_all; + __le32 tx_deferred; + __le32 tx_late_collision; + __le32 tx_all_collision; + __le32 tx_aborted32; + __le32 align_errors32; + __le32 rx_frame_too_long; + __le32 rx_runt; + __le32 rx_pause_on; + __le32 rx_pause_off; + __le32 rx_pause_all; + __le32 rx_unknown_opcode; + __le32 rx_mac_error; + __le32 tx_underrun32; + __le32 rx_mac_missed; + __le32 rx_tcam_dropped; + __le32 tdu; + __le32 rdu; }; struct rtl8169_tc_offsets { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net/xen-netback: prevent UAF in xenvif_flush_hash()
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Jeongjun Park <aha310510(a)gmail.com> stable inclusion from stable-v5.10.227 commit a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB6 CVE: CVE-2024-49936 Reference: https://git.kernel.org/stable/c/a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c -------------------------------- [ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ] During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe. Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Link: https://patch.msgid.link/20240822181109.2577354-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/xen-netback/hash.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c index ff96f22648ef..45ddce35f6d2 100644 --- a/drivers/net/xen-netback/hash.c +++ b/drivers/net/xen-netback/hash.c @@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data, static void xenvif_flush_hash(struct xenvif *vif) { - struct xenvif_hash_cache_entry *entry; + struct xenvif_hash_cache_entry *entry, *n; unsigned long flags; if (xenvif_hash_cache_size == 0) @@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif) spin_lock_irqsave(&vif->hash.cache.lock, flags); - list_for_each_entry_rcu(entry, &vif->hash.cache.list, link, - lockdep_is_held(&vif->hash.cache.lock)) { + list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) { list_del_rcu(&entry->link); vif->hash.cache.count--; kfree_rcu(entry, rcu); -- 2.34.1

2 1

[openeuler:OLK-6.6 7137/15906] arch/loongarch/kvm/exit.c:764:63: error: 'struct sched_info' has no member named 'run_delay'
by kernel test robot 31 Oct '24

31 Oct '24

Hi Bibo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ab348dfdf1ec26d67e53449056f417e399807edc commit: faa35b0fcdefb1e5f2d05b0eeac12be32e69e566 [7137/15906] LoongArch: KVM: Add steal time support in kvm side config: loongarch-randconfig-001-20241031 (https://download.01.org/0day-ci/archive/20241031/202410311034.Boz3bHHh-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241031/202410311034.Boz3bHHh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410311034.Boz3bHHh-lkp@intel.com/ All errors (new ones prefixed by >>): arch/loongarch/kvm/exit.c: In function 'kvm_save_notify': >> arch/loongarch/kvm/exit.c:764:63: error: 'struct sched_info' has no member named 'run_delay' 764 | vcpu->arch.st.last_steal = current->sched_info.run_delay; | ^ -- arch/loongarch/kvm/vcpu.c: In function 'kvm_update_stolen_time': >> arch/loongarch/kvm/vcpu.c:68:37: error: 'struct sched_info' has no member named 'run_delay' 68 | steal += current->sched_info.run_delay - | ^ arch/loongarch/kvm/vcpu.c:70:55: error: 'struct sched_info' has no member named 'run_delay' 70 | vcpu->arch.st.last_steal = current->sched_info.run_delay; | ^ vim +764 arch/loongarch/kvm/exit.c 754 755 static int kvm_save_notify(struct kvm_vcpu *vcpu) 756 { 757 unsigned long id, data; 758 759 id = vcpu->arch.gprs[LOONGARCH_GPR_A1]; 760 data = vcpu->arch.gprs[LOONGARCH_GPR_A2]; 761 switch (id) { 762 case KVM_FEATURE_STEAL_TIME: 763 vcpu->arch.st.guest_addr = data; > 764 vcpu->arch.st.last_steal = current->sched_info.run_delay; 765 kvm_make_request(KVM_REQ_RECORD_STEAL, vcpu); 766 break; 767 default: 768 break; 769 }; 770 771 return 0; 772 }; 773 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net/xen-netback: prevent UAF in xenvif_flush_hash()
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.12-rc1 commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB6 CVE: CVE-2024-49936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe. Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Link: https://patch.msgid.link/20240822181109.2577354-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/xen-netback/hash.c [ A previous commit f3265971ded9 is not merged, but it is ok to merge this patch. Because this patch will remove the modification of the previous patch. ] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/xen-netback/hash.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c index 10d580c3dea3..bb7545ab9cd1 100644 --- a/drivers/net/xen-netback/hash.c +++ b/drivers/net/xen-netback/hash.c @@ -94,7 +94,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data, static void xenvif_flush_hash(struct xenvif *vif) { - struct xenvif_hash_cache_entry *entry; + struct xenvif_hash_cache_entry *entry, *n; unsigned long flags; if (xenvif_hash_cache_size == 0) @@ -102,7 +102,7 @@ static void xenvif_flush_hash(struct xenvif *vif) spin_lock_irqsave(&vif->hash.cache.lock, flags); - list_for_each_entry_rcu(entry, &vif->hash.cache.list, link) { + list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) { list_del_rcu(&entry->link); vif->hash.cache.count--; kfree_rcu(entry, rcu); -- 2.34.1

2 1

[PATCH OLK-6.6] net/xen-netback: prevent UAF in xenvif_flush_hash()
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Jeongjun Park <aha310510(a)gmail.com> stable inclusion from stable-v6.6.55 commit 143edf098b80669d05245b2f2367dd156a83a2c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB6 CVE: CVE-2024-49936 Reference: https://git.kernel.org/stable/c/143edf098b80669d05245b2f2367dd156a83a2c5 -------------------------------- [ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ] During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe. Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Link: https://patch.msgid.link/20240822181109.2577354-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/xen-netback/hash.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c index ff96f22648ef..45ddce35f6d2 100644 --- a/drivers/net/xen-netback/hash.c +++ b/drivers/net/xen-netback/hash.c @@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data, static void xenvif_flush_hash(struct xenvif *vif) { - struct xenvif_hash_cache_entry *entry; + struct xenvif_hash_cache_entry *entry, *n; unsigned long flags; if (xenvif_hash_cache_size == 0) @@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif) spin_lock_irqsave(&vif->hash.cache.lock, flags); - list_for_each_entry_rcu(entry, &vif->hash.cache.list, link, - lockdep_is_held(&vif->hash.cache.lock)) { + list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) { list_del_rcu(&entry->link); vif->hash.cache.count--; kfree_rcu(entry, rcu); -- 2.34.1

2 1

[PATCH OLK-5.10] net/xen-netback: prevent UAF in xenvif_flush_hash()
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Jeongjun Park <aha310510(a)gmail.com> stable inclusion from stable-v5.10.227 commit a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB6 CVE: CVE-2024-49936 Reference: https://git.kernel.org/stable/c/a7f0073fcd12ed7de185ef2c0af9d0fa1ddef22c -------------------------------- [ Upstream commit 0fa5e94a1811d68fbffa0725efe6d4ca62c03d12 ] During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Therefore, to solve this, you need to change it to list_for_each_entry_safe. Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Link: https://patch.msgid.link/20240822181109.2577354-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/xen-netback/hash.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/net/xen-netback/hash.c b/drivers/net/xen-netback/hash.c index ff96f22648ef..45ddce35f6d2 100644 --- a/drivers/net/xen-netback/hash.c +++ b/drivers/net/xen-netback/hash.c @@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data, static void xenvif_flush_hash(struct xenvif *vif) { - struct xenvif_hash_cache_entry *entry; + struct xenvif_hash_cache_entry *entry, *n; unsigned long flags; if (xenvif_hash_cache_size == 0) @@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif) spin_lock_irqsave(&vif->hash.cache.lock, flags); - list_for_each_entry_rcu(entry, &vif->hash.cache.list, link, - lockdep_is_held(&vif->hash.cache.lock)) { + list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) { list_del_rcu(&entry->link); vif->hash.cache.count--; kfree_rcu(entry, rcu); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] r8169: add tally counter fields added with RTL8125
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v5.10.227 commit 991e8b0bab669b7d06927c3e442b3352532e8581 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9Q CVE: CVE-2024-49973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it. Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Cc: stable(a)vger.kernel.org Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/realtek/r8169_main.c [Missing previous patch 8df9439389a4, fix this conflict] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index c4e96293323c..5706e2d235f0 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -569,6 +569,33 @@ struct rtl8169_counters { __le32 rx_multicast; __le16 tx_aborted; __le16 tx_underun; + /* new since RTL8125 */ + __le64 tx_octets; + __le64 rx_octets; + __le64 rx_multicast64; + __le64 tx_unicast64; + __le64 tx_broadcast64; + __le64 tx_multicast64; + __le32 tx_pause_on; + __le32 tx_pause_off; + __le32 tx_pause_all; + __le32 tx_deferred; + __le32 tx_late_collision; + __le32 tx_all_collision; + __le32 tx_aborted32; + __le32 align_errors32; + __le32 rx_frame_too_long; + __le32 rx_runt; + __le32 rx_pause_on; + __le32 rx_pause_off; + __le32 rx_pause_all; + __le32 rx_unknown_opcode; + __le32 rx_mac_error; + __le32 tx_underrun32; + __le32 rx_mac_missed; + __le32 rx_tcam_dropped; + __le32 tdu; + __le32 rdu; }; struct rtl8169_tc_offsets { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] r8169: add tally counter fields added with RTL8125
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v5.10.227 commit 991e8b0bab669b7d06927c3e442b3352532e8581 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9Q CVE: CVE-2024-49973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it. Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Cc: stable(a)vger.kernel.org Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/realtek/r8169_main.c [Missing previous patch 8df9439389a4, fix this conflict] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index c4e96293323c..5706e2d235f0 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -569,6 +569,33 @@ struct rtl8169_counters { __le32 rx_multicast; __le16 tx_aborted; __le16 tx_underun; + /* new since RTL8125 */ + __le64 tx_octets; + __le64 rx_octets; + __le64 rx_multicast64; + __le64 tx_unicast64; + __le64 tx_broadcast64; + __le64 tx_multicast64; + __le32 tx_pause_on; + __le32 tx_pause_off; + __le32 tx_pause_all; + __le32 tx_deferred; + __le32 tx_late_collision; + __le32 tx_all_collision; + __le32 tx_aborted32; + __le32 align_errors32; + __le32 rx_frame_too_long; + __le32 rx_runt; + __le32 rx_pause_on; + __le32 rx_pause_off; + __le32 rx_pause_all; + __le32 rx_unknown_opcode; + __le32 rx_mac_error; + __le32 tx_underrun32; + __le32 rx_mac_missed; + __le32 rx_tcam_dropped; + __le32 tdu; + __le32 rdu; }; struct rtl8169_tc_offsets { -- 2.34.1

2 1

[PATCH OLK-6.6] r8169: add tally counter fields added with RTL8125
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v6.6.55 commit 1c723d785adb711496bc64c24240f952f4faaabf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9Q CVE: CVE-2024-49973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it. Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Cc: stable(a)vger.kernel.org Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/realtek/r8169_main.c [Missing previous patch 8df9439389a4, fix this conflict] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index 8a732edac15a..8987eb143758 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -567,6 +567,33 @@ struct rtl8169_counters { __le32 rx_multicast; __le16 tx_aborted; __le16 tx_underun; + /* new since RTL8125 */ + __le64 tx_octets; + __le64 rx_octets; + __le64 rx_multicast64; + __le64 tx_unicast64; + __le64 tx_broadcast64; + __le64 tx_multicast64; + __le32 tx_pause_on; + __le32 tx_pause_off; + __le32 tx_pause_all; + __le32 tx_deferred; + __le32 tx_late_collision; + __le32 tx_all_collision; + __le32 tx_aborted32; + __le32 align_errors32; + __le32 rx_frame_too_long; + __le32 rx_runt; + __le32 rx_pause_on; + __le32 rx_pause_off; + __le32 rx_pause_all; + __le32 rx_unknown_opcode; + __le32 rx_mac_error; + __le32 tx_underrun32; + __le32 rx_mac_missed; + __le32 rx_tcam_dropped; + __le32 tdu; + __le32 rdu; }; struct rtl8169_tc_offsets { -- 2.34.1

2 1

[PATCH OLK-5.10] r8169: add tally counter fields added with RTL8125
by Luo Gengkun 31 Oct '24

31 Oct '24

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v5.10.227 commit 991e8b0bab669b7d06927c3e442b3352532e8581 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9Q CVE: CVE-2024-49973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a ] RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it. Fixes: f1bce4ad2f1c ("r8169: add support for RTL8125") Cc: stable(a)vger.kernel.org Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/741d26a9-2b2b-485d-91d9-ecb302e345b5@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/realtek/r8169_main.c [Missing previous patch 8df9439389a4, fix this conflict] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c index f9994ff36579..9121235114de 100644 --- a/drivers/net/ethernet/realtek/r8169_main.c +++ b/drivers/net/ethernet/realtek/r8169_main.c @@ -570,6 +570,33 @@ struct rtl8169_counters { __le32 rx_multicast; __le16 tx_aborted; __le16 tx_underun; + /* new since RTL8125 */ + __le64 tx_octets; + __le64 rx_octets; + __le64 rx_multicast64; + __le64 tx_unicast64; + __le64 tx_broadcast64; + __le64 tx_multicast64; + __le32 tx_pause_on; + __le32 tx_pause_off; + __le32 tx_pause_all; + __le32 tx_deferred; + __le32 tx_late_collision; + __le32 tx_all_collision; + __le32 tx_aborted32; + __le32 align_errors32; + __le32 rx_frame_too_long; + __le32 rx_runt; + __le32 rx_pause_on; + __le32 rx_pause_off; + __le32 rx_pause_all; + __le32 rx_unknown_opcode; + __le32 rx_mac_error; + __le32 tx_underrun32; + __le32 rx_mac_missed; + __le32 rx_tcam_dropped; + __le32 tdu; + __le32 rdu; }; struct rtl8169_tc_offsets { -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Fix system hang while resume with TBT monitor
by Li Huafei 31 Oct '24

31 Oct '24

From: Tom Chung <chiahsuan.chung(a)amd.com> stable inclusion from stable-v6.6.55 commit 68d603f467a75618eeae5bfe8af32cda47097010 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRBE CVE: CVE-2024-50003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 52d4e3fb3d340447dcdac0e14ff21a764f326907 upstream. [Why] Connected with a Thunderbolt monitor and do the suspend and the system may hang while resume. The TBT monitor HPD will be triggered during the resume procedure and call the drm_client_modeset_probe() while struct drm_connector connector->dev->master is NULL. It will mess up the pipe topology after resume. [How] Skip the TBT monitor HPD during the resume procedure because we currently will probe the connectors after resume by default. Reviewed-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 453f86a26945207a16b8f66aaed5962dc2b95b85) Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index fa8d39a5a963..6b8f945cf8ad 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -714,6 +714,12 @@ static void dmub_hpd_callback(struct amdgpu_device *adev, return; } + /* Skip DMUB HPD IRQ in suspend/resume. We will probe them later. */ + if (notify->type == DMUB_NOTIFICATION_HPD && adev->in_suspend) { + DRM_INFO("Skip DMUB HPD IRQ callback in suspend/resume\n"); + return; + } + link_index = notify->link_index; link = adev->dm.dc->links[link_index]; dev = adev->dm.ddev; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION d3ae2925a8986f17b9b1a4b026403edaf8286665
by kernel test robot 31 Oct '24

31 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: d3ae2925a8986f17b9b1a4b026403edaf8286665 !12683 nilfs2: fix state management in error path of log writing function Unverified Error/Warning (likely false positive, kindly check if interested): arch/arm64/kernel/mpam/mpam_resctrl.c:757:5: warning: no previous prototype for 'cpus_ctrl_write' [-Wmissing-prototypes] arch/arm64/kernel/mpam/mpam_resctrl.c:845:5: warning: no previous prototype for 'cpus_mon_write' [-Wmissing-prototypes] arch/arm64/kernel/mpam/mpam_resctrl.c:989:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241029 | |-- arch-arm64-kernel-mpam-mpam_resctrl.c:warning:function-rdt_last_cmd_printf-might-be-a-candidate-for-gnu_printf-format-attribute | |-- arch-arm64-kernel-mpam-mpam_resctrl.c:warning:no-previous-prototype-for-cpus_ctrl_write | `-- arch-arm64-kernel-mpam-mpam_resctrl.c:warning:no-previous-prototype-for-cpus_mon_write |-- arm64-randconfig-001-20241031 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-002-20241031 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-uaccess.h:warning:bind-may-be-used-uninitialized | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-003-20241031 | |-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-004-20241031 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-allyesconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241031 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-002-20241031 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-003-20241031 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-004-20241031 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-005-20241031 | |-- arch-x86-kernel-cpu-mce-therm_throt.o:warning:objtool:missing-symbol-for-section-.irqentry.text | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-002-20241031 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-004-20241031 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-randconfig-005-20241031 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-randconfig-006-20241031 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 930m configs tested: 23 configs skipped: 111 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241031 gcc-14.1.0 arm64 randconfig-002-20241031 gcc-14.1.0 arm64 randconfig-003-20241031 gcc-14.1.0 arm64 randconfig-004-20241031 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241031 clang-19 x86_64 buildonly-randconfig-002-20241031 clang-19 x86_64 buildonly-randconfig-003-20241031 clang-19 x86_64 buildonly-randconfig-004-20241031 gcc-12 x86_64 buildonly-randconfig-005-20241031 gcc-12 x86_64 buildonly-randconfig-006-20241031 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241031 gcc-12 x86_64 randconfig-002-20241031 gcc-12 x86_64 randconfig-003-20241031 clang-19 x86_64 randconfig-004-20241031 clang-19 x86_64 randconfig-005-20241031 clang-19 x86_64 randconfig-006-20241031 clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19706/30000] arch/x86/events/zhaoxin/uncore.c:1722:28: warning: 'cluster_id' is used uninitialized
by kernel test robot 31 Oct '24

31 Oct '24

Hi leoliu-oc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4233328af33d2f8cbb5c5ab5f8e60ba36d4d60d3 commit: 2bb7fd043b4123c569fbbde1f18e98d7565a4997 [19706/30000] x86/perf: Update PMU support for more Zhaoxin CPU config: x86_64-randconfig-015-20241031 (https://download.01.org/0day-ci/archive/20241031/202410310930.1QiUdusW-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241031/202410310930.1QiUdusW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410310930.1QiUdusW-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/events/zhaoxin/uncore.c: In function 'uncore_change_context.constprop': >> arch/x86/events/zhaoxin/uncore.c:1722:28: warning: 'cluster_id' is used uninitialized [-Wuninitialized] 1722 | int i, package_id, cluster_id, subnode_id; | ^~~~~~~~~~ >> arch/x86/events/zhaoxin/uncore.c:1722:40: warning: 'subnode_id' is used uninitialized [-Wuninitialized] 1722 | int i, package_id, cluster_id, subnode_id; | ^~~~~~~~~~ vim +/cluster_id +1722 arch/x86/events/zhaoxin/uncore.c 1716 1717 static void uncore_change_type_ctx(struct zhaoxin_uncore_type *type, int old_cpu, 1718 int new_cpu) 1719 { 1720 struct zhaoxin_uncore_pmu *pmu = type->pmus; 1721 struct zhaoxin_uncore_box *box; > 1722 int i, package_id, cluster_id, subnode_id; 1723 1724 package_id = zx_topology_package_id(old_cpu < 0 ? new_cpu : old_cpu); 1725 if (boot_cpu_data.x86_model == ZHAOXIN_FAM7_YONGFENG) { 1726 cluster_id = zx_topology_cluster_id(old_cpu < 0 ? new_cpu : old_cpu); 1727 subnode_id = zx_topology_subnode_id(old_cpu < 0 ? new_cpu : old_cpu); 1728 } 1729 1730 for (i = 0; i < type->num_boxes; i++, pmu++) { 1731 if (boot_cpu_data.x86_model == ZHAOXIN_FAM7_YONGFENG) { 1732 if (!strcmp(type->name, "llc")) { 1733 box = pmu->boxes[cluster_id]; 1734 if (!box) 1735 continue; 1736 } else { 1737 box = pmu->boxes[subnode_id]; 1738 if (!box) 1739 continue; 1740 } 1741 } else { 1742 box = pmu->boxes[package_id]; 1743 if (!box) 1744 continue; 1745 } 1746 1747 if (old_cpu < 0) { 1748 WARN_ON_ONCE(box->cpu != -1); 1749 box->cpu = new_cpu; 1750 continue; 1751 } 1752 WARN_ON_ONCE(box->cpu != old_cpu); 1753 box->cpu = -1; 1754 if (new_cpu < 0) 1755 continue; 1756 1757 uncore_pmu_cancel_hrtimer(box); 1758 perf_pmu_migrate_context(&pmu->pmu, old_cpu, new_cpu); 1759 box->cpu = new_cpu; 1760 } 1761 } 1762 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION ab348dfdf1ec26d67e53449056f417e399807edc
by kernel test robot 31 Oct '24

31 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: ab348dfdf1ec26d67e53449056f417e399807edc !12345 [OLK-6.6] drivers: update Yunsilicon driver to version rel_2406_rc16 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410310653.bdy4fiTq-lkp@intel.com drivers/infiniband/hw/xsc/main.c:1139:5: warning: no previous prototype for function 'xsc_ib_reboot_event_handler' [-Wmissing-prototypes] drivers/infiniband/hw/xsc/mr.c:380:4: warning: no previous prototype for function 'xsc_get_mr_page_mode' [-Wmissing-prototypes] drivers/infiniband/hw/xsc/private_dev.c:977:15: warning: variable 'char_dev' set but not used [-Wunused-but-set-variable] drivers/infiniband/hw/xsc/qp.c:1896:25: warning: variable 'xsc_state' is uninitialized when used here [-Wuninitialized] drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:19: error: invalid application of 'sizeof' to an incomplete type 'struct ieee_ets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:105:5: error: incomplete definition of type 'struct ieee_ets' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:19: error: invalid application of 'sizeof' to an incomplete type 'struct ieee_pfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:118:5: error: incomplete definition of type 'struct ieee_pfc' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:22: error: use of undeclared identifier 'DCB_CAP_DCBX_HOST' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:42: error: use of undeclared identifier 'DCB_CAP_DCBX_VER_CEE' drivers/net/ethernet/huawei/hinic/hinic_dcb.c:475:14: error: use of undeclared identifier 'DCB_ATTR_VALUE_UNDEFINED' drivers/net/ethernet/huawei/hinic/hinic_main.c:2291:21: error: no member named 'dcbnl_ops' in 'struct net_device' drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:19: error: field has incomplete type 'struct ieee_ets' drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:19: error: field has incomplete type 'struct ieee_pfc' drivers/net/ethernet/yunsilicon/xsc/net/main.c:2610:5: warning: no previous prototype for function 'xsc_set_vf_link_state' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/net/main.c:2642:5: warning: no previous prototype for function 'set_feature_vlan_offload' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/net/main.c:3343:5: warning: no previous prototype for function 'xsc_net_reboot_event_handler' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:24:27: warning: unused variable 'fpga_type_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:25:27: warning: unused variable 'hps_ddr_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:26:27: warning: unused variable 'onchip_ft_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:27:27: warning: unused variable 'rdma_icrc_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:28:27: warning: unused variable 'ma_xbar_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:29:27: warning: unused variable 'anlt_fec_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:30:27: warning: unused variable 'pp_tbl_dma_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_eth_ethtool.c:31:27: warning: unused variable 'pct_exp_name' [-Wunused-const-variable] drivers/net/ethernet/yunsilicon/xsc/net/xsc_hw_comm.c:104:5: warning: no previous prototype for function 'xsc_hw_kernel_call' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/net/xsc_hw_comm.c:47:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] drivers/net/ethernet/yunsilicon/xsc/pci/main.c:856:5: warning: no previous prototype for function 'xsc_pci_reboot_event_handler' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/mr.c:106:5: warning: no previous prototype for function 'xsc_set_mtt_via_cmdq' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/mr.c:153:5: warning: no previous prototype for function 'xsc_dereg_mr_via_cmdq' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/mr.c:170:5: warning: no previous prototype for function 'xsc_reg_mr_via_cmdq' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/mr.c:71:5: warning: no previous prototype for function 'xsc_set_mpt_via_cmdq' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/vport.c:207:63: warning: variable 'i' is uninitialized when used here [-Wuninitialized] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:155:5: warning: no previous prototype for function 'xsc_cmd_add_lag_member' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:188:5: warning: no previous prototype for function 'xsc_cmd_remove_lag_member' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:220:5: warning: no previous prototype for function 'xsc_cmd_update_lag_member_status' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:249:5: warning: no previous prototype for function 'xsc_cmd_update_lag_hash_type' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:29:6: warning: no previous prototype for function 'xsc_board_lag_set' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:320:6: warning: no previous prototype for function 'xsc_create_lag' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:351:6: warning: no previous prototype for function 'xsc_add_lag_member' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:379:6: warning: no previous prototype for function 'xsc_remove_lag_member' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:38:6: warning: no previous prototype for function 'xsc_board_lag_reset' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:414:6: warning: no previous prototype for function 'xsc_update_lag_member_status' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:434:6: warning: no previous prototype for function 'xsc_update_lag_hash_type' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:444:6: warning: no previous prototype for function 'xsc_destroy_lag' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:605:6: warning: no previous prototype for function 'pack_lag_create' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:638:6: warning: no previous prototype for function 'pack_lag_add_member' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:683:6: warning: no previous prototype for function 'pack_lag_remove_member' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:738:6: warning: no previous prototype for function 'pack_lag_update_member_status' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:766:6: warning: no previous prototype for function 'pack_lag_update_hash_type' [-Wmissing-prototypes] drivers/net/ethernet/yunsilicon/xsc/pci/xsc_lag.c:796:6: warning: no previous prototype for function 'pack_lag_destroy' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_dev_ttt_levels | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-infiniband-hw-xsc-main.c:warning:no-previous-prototype-for-function-xsc_ib_reboot_event_handler | |-- drivers-infiniband-hw-xsc-mr.c:warning:no-previous-prototype-for-function-xsc_get_mr_page_mode | |-- drivers-infiniband-hw-xsc-private_dev.c:warning:variable-char_dev-set-but-not-used | |-- drivers-infiniband-hw-xsc-qp.c:warning:variable-xsc_state-is-uninitialized-when-used-here | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-set_feature_vlan_offload | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_net_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_set_vf_link_state | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-anlt_fec_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-fpga_type_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-hps_ddr_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-ma_xbar_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-onchip_ft_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pct_exp_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pp_tbl_dma_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-rdma_icrc_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:no-previous-prototype-for-function-xsc_hw_kernel_call | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_pci_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_dereg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_reg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mpt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mtt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-vport.c:warning:variable-i-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_add_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_create | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_destroy | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_remove_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_reset | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_set | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_create_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_destroy_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_hash_type | `-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_member_status |-- arm64-randconfig-003-20241031 | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | `-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- loongarch-allmodconfig | |-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-(first-use-in-this-function) | `-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-here-(not-in-a-function) |-- loongarch-allnoconfig | |-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-here-(not-in-a-function) | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-001-20241031 | |-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-(first-use-in-this-function) | |-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-here-(not-in-a-function) | `-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int |-- loongarch-randconfig-002-20241031 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- x86_64-allnoconfig | |-- Warning:drivers-net-ethernet-nebula-matrix-Kconfig-references-a-file-that-doesn-t-exist:file:Documentation-networking-device_drivers-ethernet-nebula-matrix-m18110.rst | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_include-nbl_include.h:linux-pci.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-infiniband-hw-xsc-main.c:warning:no-previous-prototype-for-function-xsc_ib_reboot_event_handler | |-- drivers-infiniband-hw-xsc-mr.c:warning:no-previous-prototype-for-function-xsc_get_mr_page_mode | |-- drivers-infiniband-hw-xsc-private_dev.c:warning:variable-char_dev-set-but-not-used | |-- drivers-infiniband-hw-xsc-qp.c:warning:variable-xsc_state-is-uninitialized-when-used-here | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-set_feature_vlan_offload | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_net_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_set_vf_link_state | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-anlt_fec_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-fpga_type_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-hps_ddr_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-ma_xbar_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-onchip_ft_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pct_exp_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pp_tbl_dma_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-rdma_icrc_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:no-previous-prototype-for-function-xsc_hw_kernel_call | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_pci_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_dereg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_reg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mpt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mtt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-vport.c:warning:variable-i-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_add_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_create | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_destroy | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_remove_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_reset | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_set | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_create_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_destroy_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_hash_type | `-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_member_status |-- x86_64-buildonly-randconfig-001-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-buildonly-randconfig-002-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-buildonly-randconfig-006-20241031 | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- include-linux-psp-hygon.h:error:conflicting-types-for-vpsp_try_do_cmd | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | `-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier |-- x86_64-kexec | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | `-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- x86_64-randconfig-001-20241031 | `-- arch-x86-kernel-zhaoxin_kh40000.c:error:implicit-declaration-of-function-iommu_get_dma_domain |-- x86_64-randconfig-002-20241031 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-randconfig-003-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-004-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-005-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-006-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-011-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-012-20241031 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-randconfig-013-20241031 | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-randconfig-071-20241030 | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:incomplete-definition-of-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:incomplete-definition-of-type-struct-ieee_pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-an-incomplete-type-struct-ieee_pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_ATTR_VALUE_UNDEFINED | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_CAP_DCBX_HOST | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:use-of-undeclared-identifier-DCB_CAP_DCBX_VER_CEE | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:no-member-named-dcbnl_ops-in-struct-net_device | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-has-incomplete-type-struct-ieee_ets | `-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-has-incomplete-type-struct-ieee_pfc |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- x86_64-rhel-8.3-kselftests |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory elapsed time: 913m configs tested: 30 configs skipped: 107 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241031 clang-20 arm64 randconfig-002-20241031 clang-20 arm64 randconfig-003-20241031 clang-15 arm64 randconfig-004-20241031 clang-17 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20241031 gcc-14.1.0 loongarch randconfig-002-20241031 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241031 clang-19 x86_64 buildonly-randconfig-002-20241031 clang-19 x86_64 buildonly-randconfig-003-20241031 clang-19 x86_64 buildonly-randconfig-004-20241031 gcc-12 x86_64 buildonly-randconfig-005-20241031 gcc-12 x86_64 buildonly-randconfig-006-20241031 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241031 gcc-12 x86_64 randconfig-002-20241031 gcc-12 x86_64 randconfig-003-20241031 clang-19 x86_64 randconfig-004-20241031 clang-19 x86_64 randconfig-005-20241031 clang-19 x86_64 randconfig-006-20241031 clang-19 x86_64 randconfig-011-20241031 clang-19 x86_64 randconfig-012-20241031 gcc-12 x86_64 randconfig-013-20241031 clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 4233328af33d2f8cbb5c5ab5f8e60ba36d4d60d3
by kernel test robot 31 Oct '24

31 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4233328af33d2f8cbb5c5ab5f8e60ba36d4d60d3 !12678 CVE-2024-47673 Error/Warning (recently discovered and may have been fixed): drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=] drivers/ub/urma/ubcore/ubcore_main.c:61:5: warning: no previous prototype for 'ubcore_open' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_umem.c:227:21: warning: no previous prototype for 'ubcore_umem_get' [-Wmissing-prototypes] drivers/ub/urma/ubcore/ubcore_umem.c:245:6: warning: no previous prototype for 'ubcore_umem_release' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:102:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:49:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:66:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PCI_IOV-when-selected-by-CRYPTO_DEV_HISI_MIGRATION | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- arm64-randconfig-001-20241031 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- arm64-randconfig-003-20241029 | |-- drivers-ptp-ptp_hisi.c:warning:hisi_ptp_acpi_match-defined-but-not-used | |-- drivers-ub-urma-ubcore-ubcore_main.c:warning:no-previous-prototype-for-ubcore_open | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_release | |-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_close | |-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_open | |-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_release_file | `-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-dev_name-will-never-be-NULL |-- arm64-randconfig-004-20241031 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- x86_64-allyesconfig | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-006-20241031 | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-randconfig-002-20241031 | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-randconfig-003-20241031 | |-- security-integrity-ima-ima.h:warning:declaration-of-struct-ima_digest-will-not-be-visible-outside-of-this-function | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-call-expected-have |-- x86_64-randconfig-004-20241031 | |-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_irq_ack-falls-through-to-next-function-evergreen_resume() | |-- drivers-gpu-drm-radeon-si.o:warning:objtool:si_irq_process-falls-through-to-next-function-si_resume() | `-- drivers-gpu-drm-radeon-si.o:warning:objtool:si_irq_suspend-falls-through-to-next-function-si_pcie_gart_disable() `-- x86_64-randconfig-012-20241031 |-- security-integrity-ima-ima.h:warning:struct-ima_digest-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement elapsed time: 914m configs tested: 32 configs skipped: 126 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241031 clang-20 arm64 randconfig-002-20241031 clang-20 arm64 randconfig-003-20241031 clang-15 arm64 randconfig-004-20241031 clang-17 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241031 clang-19 x86_64 buildonly-randconfig-002-20241031 clang-19 x86_64 buildonly-randconfig-003-20241031 clang-19 x86_64 buildonly-randconfig-004-20241031 gcc-12 x86_64 buildonly-randconfig-005-20241031 gcc-12 x86_64 buildonly-randconfig-006-20241031 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241031 gcc-12 x86_64 randconfig-002-20241031 gcc-12 x86_64 randconfig-003-20241031 clang-19 x86_64 randconfig-004-20241031 clang-19 x86_64 randconfig-005-20241031 clang-19 x86_64 randconfig-006-20241031 clang-19 x86_64 randconfig-011-20241031 clang-19 x86_64 randconfig-012-20241031 gcc-12 x86_64 randconfig-013-20241031 clang-19 x86_64 randconfig-014-20241031 gcc-12 x86_64 randconfig-015-20241031 gcc-12 x86_64 randconfig-016-20241031 clang-19 x86_64 randconfig-071-20241031 gcc-12 x86_64 randconfig-072-20241031 clang-19 x86_64 randconfig-073-20241031 clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 15901/15906] drivers/infiniband/hw/xsc/main.c:1139:5: warning: no previous prototype for function 'xsc_ib_reboot_event_handler'
by kernel test robot 31 Oct '24

31 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ab348dfdf1ec26d67e53449056f417e399807edc commit: bcfb3e65a5707ca4caf593a33276f26b993ad71e [15901/15906] drivers: update Yunsilicon driver to version 2406_rc16 config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241031/202410310653.bdy4fiTq-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241031/202410310653.bdy4fiTq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410310653.bdy4fiTq-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/infiniband/hw/xsc/main.c:13: In file included from include/linux/pci.h:1669: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/main.c:52:6: warning: variable 'max_sq_sg' set but not used [-Wunused-but-set-variable] 52 | int max_sq_sg; | ^ drivers/infiniband/hw/xsc/main.c:196:6: warning: no previous prototype for function 'xsc_calc_link_info' [-Wmissing-prototypes] 196 | void xsc_calc_link_info(struct xsc_core_device *xdev, | ^ drivers/infiniband/hw/xsc/main.c:196:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 196 | void xsc_calc_link_info(struct xsc_core_device *xdev, | ^ | static drivers/infiniband/hw/xsc/main.c:340:5: warning: no previous prototype for function 'xsc_ib_add_gid' [-Wmissing-prototypes] 340 | int xsc_ib_add_gid(const struct ib_gid_attr *attr, void **context) | ^ drivers/infiniband/hw/xsc/main.c:340:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 340 | int xsc_ib_add_gid(const struct ib_gid_attr *attr, void **context) | ^ | static drivers/infiniband/hw/xsc/main.c:624:6: warning: no previous prototype for function 'xsc_get_guid' [-Wmissing-prototypes] 624 | void xsc_get_guid(const u8 *dev_addr, u8 *guid) | ^ drivers/infiniband/hw/xsc/main.c:624:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 624 | void xsc_get_guid(const u8 *dev_addr, u8 *guid) | ^ | static drivers/infiniband/hw/xsc/main.c:653:6: warning: no previous prototype for function 'xsc_core_event' [-Wmissing-prototypes] 653 | void xsc_core_event(struct xsc_core_device *xdev, enum xsc_dev_event event, | ^ drivers/infiniband/hw/xsc/main.c:653:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 653 | void xsc_core_event(struct xsc_core_device *xdev, enum xsc_dev_event event, | ^ | static >> drivers/infiniband/hw/xsc/main.c:1139:5: warning: no previous prototype for function 'xsc_ib_reboot_event_handler' [-Wmissing-prototypes] 1139 | int xsc_ib_reboot_event_handler(struct notifier_block *nb, unsigned long action, void *data) | ^ drivers/infiniband/hw/xsc/main.c:1139:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1139 | int xsc_ib_reboot_event_handler(struct notifier_block *nb, unsigned long action, void *data) | ^ | static 11 warnings generated. -- In file included from drivers/infiniband/hw/xsc/qp.c:8: In file included from include/rdma/ib_umem.h:11: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/qp.c:284:26: warning: variable 'context' set but not used [-Wunused-but-set-variable] 284 | struct xsc_ib_ucontext *context; | ^ drivers/infiniband/hw/xsc/qp.c:362:26: warning: variable 'context' set but not used [-Wunused-but-set-variable] 362 | struct xsc_ib_ucontext *context; | ^ drivers/infiniband/hw/xsc/qp.c:1274:5: warning: no previous prototype for function 'xsc_icrc_hdr' [-Wmissing-prototypes] 1274 | u32 xsc_icrc_hdr(struct xsc_ib_dev *dev, void *pkt, u32 size, u32 *icrc) | ^ drivers/infiniband/hw/xsc/qp.c:1274:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1274 | u32 xsc_icrc_hdr(struct xsc_ib_dev *dev, void *pkt, u32 size, u32 *icrc) | ^ | static drivers/infiniband/hw/xsc/qp.c:1364:5: warning: no previous prototype for function 'build_qp1_send_v2' [-Wmissing-prototypes] 1364 | int build_qp1_send_v2(struct xsc_ib_dev *dev, | ^ drivers/infiniband/hw/xsc/qp.c:1364:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1364 | int build_qp1_send_v2(struct xsc_ib_dev *dev, | ^ | static >> drivers/infiniband/hw/xsc/qp.c:1896:25: warning: variable 'xsc_state' is uninitialized when used here [-Wuninitialized] 1896 | qp_attr->sq_draining = xsc_state == XSC_QP_STATE_SQ_DRAINING; | ^~~~~~~~~ drivers/infiniband/hw/xsc/qp.c:1877:15: note: initialize the variable 'xsc_state' to silence this warning 1877 | int xsc_state; | ^ | = 0 drivers/infiniband/hw/xsc/qp.c:1845:32: warning: unused function 'to_ib_qp_state' [-Wunused-function] 1845 | static inline enum ib_qp_state to_ib_qp_state(enum xsc_qp_state xsc_state) | ^~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/qp.c:1860:33: warning: unused function 'to_ib_mig_state' [-Wunused-function] 1860 | static inline enum ib_mig_state to_ib_mig_state(int xsc_mig_state) | ^~~~~~~~~~~~~~~ 12 warnings generated. -- In file included from drivers/infiniband/hw/xsc/mr.c:11: In file included from include/rdma/ib_umem.h:11: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/mr.c:75:6: warning: no previous prototype for function 'xsc_fill_pas' [-Wmissing-prototypes] 75 | void xsc_fill_pas(int npages, u64 *pas, __be64 *req_pas) | ^ drivers/infiniband/hw/xsc/mr.c:75:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 75 | void xsc_fill_pas(int npages, u64 *pas, __be64 *req_pas) | ^ | static >> drivers/infiniband/hw/xsc/mr.c:380:4: warning: no previous prototype for function 'xsc_get_mr_page_mode' [-Wmissing-prototypes] 380 | u8 xsc_get_mr_page_mode(struct xsc_core_device *xdev, u32 page_shift) | ^ drivers/infiniband/hw/xsc/mr.c:380:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 380 | u8 xsc_get_mr_page_mode(struct xsc_core_device *xdev, u32 page_shift) | ^ | static 7 warnings generated. -- In file included from drivers/infiniband/hw/xsc/private_dev.c:9: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/infiniband/hw/xsc/private_dev.c:432:5: warning: no previous prototype for function 'xsc_priv_dev_exec_ioctl' [-Wmissing-prototypes] 432 | int xsc_priv_dev_exec_ioctl(struct xsc_core_device *xdev, void *in, int in_size, void *out, | ^ drivers/infiniband/hw/xsc/private_dev.c:432:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 432 | int xsc_priv_dev_exec_ioctl(struct xsc_core_device *xdev, void *in, int in_size, void *out, | ^ | static >> drivers/infiniband/hw/xsc/private_dev.c:977:15: warning: variable 'char_dev' set but not used [-Wunused-but-set-variable] 977 | struct cdev *char_dev; | ^ 7 warnings generated. -- | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1526:5: warning: no previous prototype for function 'xsc_eth_open_channels' [-Wmissing-prototypes] 1526 | int xsc_eth_open_channels(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1526:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1526 | int xsc_eth_open_channels(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1638:6: warning: no previous prototype for function 'xsc_eth_activate_channel' [-Wmissing-prototypes] 1638 | void xsc_eth_activate_channel(struct xsc_channel *c) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1638:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1638 | void xsc_eth_activate_channel(struct xsc_channel *c) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1644:6: warning: no previous prototype for function 'xsc_eth_deactivate_channel' [-Wmissing-prototypes] 1644 | void xsc_eth_deactivate_channel(struct xsc_channel *c) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1644:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1644 | void xsc_eth_deactivate_channel(struct xsc_channel *c) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1690:6: warning: no previous prototype for function 'xsc_eth_activate_priv_channels' [-Wmissing-prototypes] 1690 | void xsc_eth_activate_priv_channels(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1690:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1690 | void xsc_eth_activate_priv_channels(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1705:6: warning: no previous prototype for function 'xsc_eth_deactivate_priv_channels' [-Wmissing-prototypes] 1705 | void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1705:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1705 | void xsc_eth_deactivate_priv_channels(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1864:5: warning: no previous prototype for function 'xsc_eth_change_link_status' [-Wmissing-prototypes] 1864 | int xsc_eth_change_link_status(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1864:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1864 | int xsc_eth_change_link_status(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1927:6: warning: no previous prototype for function 'xsc_eth_event_handler' [-Wmissing-prototypes] 1927 | void xsc_eth_event_handler(void *arg) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1927:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1927 | void xsc_eth_event_handler(void *arg) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1935:5: warning: no previous prototype for function 'xsc_eth_enable_nic_hca' [-Wmissing-prototypes] 1935 | int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1935:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1935 | int xsc_eth_enable_nic_hca(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:1999:5: warning: no previous prototype for function 'xsc_eth_disable_nic_hca' [-Wmissing-prototypes] 1999 | int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:1999:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1999 | int xsc_eth_disable_nic_hca(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2029:6: warning: no previous prototype for function 'xsc_eth_rss_params_change' [-Wmissing-prototypes] 2029 | void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2029:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2029 | void xsc_eth_rss_params_change(struct xsc_adapter *adapter, u32 change, void *modify) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2357:6: warning: no previous prototype for function 'xsc_build_default_indir_rqt' [-Wmissing-prototypes] 2357 | void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2357:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2357 | void xsc_build_default_indir_rqt(u32 *indirection_rqt, int len, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2455:5: warning: no previous prototype for function 'xsc_eth_nic_mtu_changed' [-Wmissing-prototypes] 2455 | int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2455:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2455 | int xsc_eth_nic_mtu_changed(struct xsc_adapter *priv) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2525:5: warning: no previous prototype for function 'xsc_set_vf_mac' [-Wmissing-prototypes] 2525 | int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2525:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2525 | int xsc_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2593:5: warning: no previous prototype for function 'xsc_get_vf_config' [-Wmissing-prototypes] 2593 | int xsc_get_vf_config(struct net_device *dev, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2593:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2593 | int xsc_get_vf_config(struct net_device *dev, | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2610:5: warning: no previous prototype for function 'xsc_set_vf_link_state' [-Wmissing-prototypes] 2610 | int xsc_set_vf_link_state(struct net_device *dev, int vf, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2610:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2610 | int xsc_set_vf_link_state(struct net_device *dev, int vf, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2620:5: warning: no previous prototype for function 'set_feature_rxcsum' [-Wmissing-prototypes] 2620 | int set_feature_rxcsum(struct net_device *netdev, bool enable) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2620:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2620 | int set_feature_rxcsum(struct net_device *netdev, bool enable) | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:2642:5: warning: no previous prototype for function 'set_feature_vlan_offload' [-Wmissing-prototypes] 2642 | int set_feature_vlan_offload(struct net_device *netdev, bool enable) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2642:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2642 | int set_feature_vlan_offload(struct net_device *netdev, bool enable) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2694:5: warning: no previous prototype for function 'xsc_eth_set_features' [-Wmissing-prototypes] 2694 | int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2694:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2694 | int xsc_eth_set_features(struct net_device *netdev, netdev_features_t features) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2757:5: warning: no previous prototype for function 'xsc_select_queue' [-Wmissing-prototypes] 2757 | u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2757:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2757 | u16 xsc_select_queue(struct net_device *dev, struct sk_buff *skb, | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2766:10: warning: variable 'txq_ix' is uninitialized when used here [-Wuninitialized] 2766 | return txq_ix; | ^~~~~~ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2760:12: note: initialize the variable 'txq_ix' to silence this warning 2760 | int txq_ix, up = 0; | ^ | = 0 drivers/net/ethernet/yunsilicon/xsc/net/main.c:2966:24: warning: no previous prototype for function 'xsc_tirc_get_default_config' [-Wmissing-prototypes] 2966 | struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2966:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2966 | struct xsc_tirc_config xsc_tirc_get_default_config(enum xsc_traffic_types tt) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2971:6: warning: no previous prototype for function 'xsc_build_rss_params' [-Wmissing-prototypes] 2971 | void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2971:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2971 | void xsc_build_rss_params(struct xsc_rss_params *rss_params, u16 num_channels) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:2989:6: warning: no previous prototype for function 'xsc_eth_build_nic_params' [-Wmissing-prototypes] 2989 | void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:2989:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2989 | void xsc_eth_build_nic_params(struct xsc_adapter *adapter, u32 ch_num, u32 tc_num) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:3017:6: warning: no previous prototype for function 'xsc_eth_build_nic_netdev' [-Wmissing-prototypes] 3017 | void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:3017:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3017 | void xsc_eth_build_nic_netdev(struct xsc_adapter *adapter) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:3085:5: warning: no previous prototype for function 'xsc_eth_create_xdev_resources' [-Wmissing-prototypes] 3085 | int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:3085:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3085 | int xsc_eth_create_xdev_resources(struct xsc_core_device *xdev) | ^ | static drivers/net/ethernet/yunsilicon/xsc/net/main.c:3106:5: warning: no previous prototype for function 'xsc_eth_init_nic_rx' [-Wmissing-prototypes] 3106 | int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:3106:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3106 | int xsc_eth_init_nic_rx(struct xsc_adapter *adapter) | ^ | static >> drivers/net/ethernet/yunsilicon/xsc/net/main.c:3343:5: warning: no previous prototype for function 'xsc_net_reboot_event_handler' [-Wmissing-prototypes] 3343 | int xsc_net_reboot_event_handler(struct notifier_block *nb, unsigned long action, void *data) | ^ drivers/net/ethernet/yunsilicon/xsc/net/main.c:3343:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3343 | int xsc_net_reboot_event_handler(struct notifier_block *nb, unsigned long action, void *data) | ^ | static 54 warnings generated. .. vim +/xsc_ib_reboot_event_handler +1139 drivers/infiniband/hw/xsc/main.c 1138 > 1139 int xsc_ib_reboot_event_handler(struct notifier_block *nb, unsigned long action, void *data) 1140 { 1141 pr_info("xsc ib driver recv %lu event\n", action); 1142 1143 if (exist_incomplete_qp_flush()) { 1144 xsc_set_exit_flag(); 1145 return NOTIFY_OK; 1146 } 1147 1148 xsc_remove_rdma_driver(); 1149 1150 return NOTIFY_OK; 1151 } 1152 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-50059
by Yongqiang Liu 30 Oct '24

30 Oct '24

Kaixin Wang (1): ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + 1 file changed, 1 insertion(+) -- 2.25.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-50059
by Yongqiang Liu 30 Oct '24

30 Oct '24

Kaixin Wang (1): ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + 1 file changed, 1 insertion(+) -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] net: phy: fix null-ptr-deref while probe() failed
by Zhang Changzhong 30 Oct '24

30 Oct '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.268 commit 0744c7be4de564db03e24527b2e096b7e0e20972 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDT CVE: CVE-2022-49021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 369eb2c9f1f72adbe91e0ea8efb130f0a2ba11a6 ] I got a null-ptr-deref report as following when doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_driver_internal+0x23e/0x2d0 bus_remove_device+0x1bd/0x240 device_del+0x357/0x770 phy_device_remove+0x11/0x30 mdiobus_unregister+0xa5/0x140 release_nodes+0x6a/0xa0 devres_release_all+0xf8/0x150 device_unbind_cleanup+0x19/0xd0 //probe path: phy_device_register() device_add() phy_connect phy_attach_direct() //set device driver probe() //it's failed, driver is not bound device_bind_driver() // probe failed, it's not called //remove path: phy_device_remove() device_del() device_release_driver_internal() __device_release_driver() //dev->drv is not NULL klist_remove() <- knode_driver is not added yet, cause null-ptr-deref In phy_attach_direct(), after setting the 'dev->driver', probe() fails, device_bind_driver() is not called, so the knode_driver->n_klist is not set, then it causes null-ptr-deref in __device_release_driver() while deleting device. Fix this by setting dev->driver to NULL in the error path in phy_attach_direct(). Fixes: e13934563db0 ("[PATCH] PHY Layer fixup") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/phy_device.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 2de2cbe..4f36248 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1072,6 +1072,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, error_module_put: module_put(d->driver->owner); + d->driver = NULL; error_put_device: put_device(d); if (ndev_owner != bus->owner) -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net: phy: fix null-ptr-deref while probe() failed
by Zhang Changzhong 30 Oct '24

30 Oct '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v5.10.158 commit fe6bc99c27c21348f548966118867ed26a9a372c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDT CVE: CVE-2022-49021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 369eb2c9f1f72adbe91e0ea8efb130f0a2ba11a6 ] I got a null-ptr-deref report as following when doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_driver_internal+0x23e/0x2d0 bus_remove_device+0x1bd/0x240 device_del+0x357/0x770 phy_device_remove+0x11/0x30 mdiobus_unregister+0xa5/0x140 release_nodes+0x6a/0xa0 devres_release_all+0xf8/0x150 device_unbind_cleanup+0x19/0xd0 //probe path: phy_device_register() device_add() phy_connect phy_attach_direct() //set device driver probe() //it's failed, driver is not bound device_bind_driver() // probe failed, it's not called //remove path: phy_device_remove() device_del() device_release_driver_internal() __device_release_driver() //dev->drv is not NULL klist_remove() <- knode_driver is not added yet, cause null-ptr-deref In phy_attach_direct(), after setting the 'dev->driver', probe() fails, device_bind_driver() is not called, so the knode_driver->n_klist is not set, then it causes null-ptr-deref in __device_release_driver() while deleting device. Fix this by setting dev->driver to NULL in the error path in phy_attach_direct(). Fixes: e13934563db0 ("[PATCH] PHY Layer fixup") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/phy_device.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index f6e0560..4f98f7b 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1423,6 +1423,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, error_module_put: module_put(d->driver->owner); + d->driver = NULL; error_put_device: put_device(d); if (ndev_owner != bus->owner) -- 2.9.5

2 1

[PATCH OLK-5.10] hisilicon/hisi_hbmcache: Use mutex_trylock to prevent hung task
by Zhang Zekun 30 Oct '24

30 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0X12 -------------------------------------------------- Use mutex_trylock() to prevent hung task when concurrent power on/off is triggered. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/soc/hisilicon/hisi_hbmcache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/soc/hisilicon/hisi_hbmcache.c b/drivers/soc/hisilicon/hisi_hbmcache.c index e06f613c143b..2bebb5a9e2aa 100644 --- a/drivers/soc/hisilicon/hisi_hbmcache.c +++ b/drivers/soc/hisilicon/hisi_hbmcache.c @@ -24,7 +24,9 @@ static ssize_t state_store(struct device *d, struct device_attribute *attr, acpi_handle handle = adev->handle; acpi_status status = AE_OK; - mutex_lock(&cache_lock); + if (!mutex_trylock(&cache_lock)) + return -EBUSY; + switch (type) { case STATE_ONLINE: status = acpi_evaluate_object(handle, "_ON", NULL, NULL); -- 2.17.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-50059
by Yongqiang Liu 30 Oct '24

30 Oct '24

Kaixin Wang (1): ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 1 + 1 file changed, 1 insertion(+) -- 2.25.1

2 2

[PATCH OLK-6.6 0/2] Backport "ima: Avoid blocking in RCU read-side critical section"
by Gu Bowen 30 Oct '24

30 Oct '24

Revert self-developed solution and backport mainline one. GUO Zihua (1): ima: Avoid blocking in RCU read-side critical section Gu Bowen (1): Revert "ima: Avoid blocking in RCU read-side critical section" include/linux/lsm_hook_defs.h | 2 +- include/linux/security.h | 5 +++-- kernel/auditfilter.c | 5 +++-- security/apparmor/audit.c | 6 +++--- security/apparmor/include/audit.h | 2 +- security/integrity/ima/ima.h | 2 +- security/integrity/ima/ima_policy.c | 15 +++++++++------ security/security.c | 6 ++++-- security/selinux/include/audit.h | 4 +++- security/selinux/ss/services.c | 5 +++-- security/smack/smack_lsm.c | 4 +++- 11 files changed, 34 insertions(+), 22 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/4] Script execution control
by Gu Bowen 30 Oct '24

30 Oct '24

Ensure that direct file execution (e.g. ./script.sh) and indirect file execution (e.g. sh script.sh) lead to the same result to support script protection. Gu Bowen (1): IMA support bprm_creds_for_exec Kees Cook (1): exec: Check __FMODE_EXEC instead of in_execve for LSMs Linus Torvalds (1): execve: open the executable file before doing anything else Mickaël Salaün (1): exec: Add a new AT_CHECK flag to execveat(2) fs/exec.c | 87 ++++++++++++++++++------------- include/linux/binfmts.h | 7 ++- include/linux/ima.h | 1 + include/uapi/linux/fcntl.h | 31 +++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 1 + security/apparmor/lsm.c | 4 +- security/integrity/ima/ima_main.c | 11 ++++ security/security.c | 17 +++++- security/tomoyo/tomoyo.c | 3 +- 10 files changed, 123 insertions(+), 40 deletions(-) -- 2.25.1

2 5

[PATCH V3 OLK-6.6 0/2] add vdpa support for x86 and enable vdpa migration.
by Jiang Dongxu 30 Oct '24

30 Oct '24

From: jiangdongxu <jiangdongxu1(a)huawei.com> Christoph Hellwig (1): virtio_blk: remove the broken zone revalidation support jiangdongxu (1): vdpa: add support for x86 and open vdpa migration build config arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 5 +++-- drivers/block/virtio_blk.c | 26 -------------------------- 3 files changed, 4 insertions(+), 29 deletions(-) -- 2.27.0

2 3

[PATCH OLK-5.10] ppp: fix ppp_async_encode() illegal access
by Zhang Changzhong 30 Oct '24

30 Oct '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit 30d91a478d58cbae3dbaa8224d17d0d839f0d71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDK CVE: CVE-2024-50035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40dddd4b8bd08a69471efd96107a4e1c73fabefc ] syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline] ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4092 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1d121645899e7692f92a(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20241009185802.3763282-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ppp/ppp_async.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c index aada8a3..164c11d 100644 --- a/drivers/net/ppp/ppp_async.c +++ b/drivers/net/ppp/ppp_async.c @@ -552,7 +552,7 @@ ppp_async_encode(struct asyncppp *ap) * and 7 (code-reject) must be sent as though no options * had been negotiated. */ - islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7; + islcp = proto == PPP_LCP && count >= 3 && 1 <= data[2] && data[2] <= 7; if (i == 0) { if (islcp) -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] ppp: fix ppp_async_encode() illegal access
by Zhang Changzhong 30 Oct '24

30 Oct '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit 30d91a478d58cbae3dbaa8224d17d0d839f0d71b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDK CVE: CVE-2024-50035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40dddd4b8bd08a69471efd96107a4e1c73fabefc ] syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline] ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4092 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1d121645899e7692f92a(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20241009185802.3763282-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ppp/ppp_async.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c index aada8a3..164c11d 100644 --- a/drivers/net/ppp/ppp_async.c +++ b/drivers/net/ppp/ppp_async.c @@ -552,7 +552,7 @@ ppp_async_encode(struct asyncppp *ap) * and 7 (code-reject) must be sent as though no options * had been negotiated. */ - islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7; + islcp = proto == PPP_LCP && count >= 3 && 1 <= data[2] && data[2] <= 7; if (i == 0) { if (islcp) -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] ppp: fix ppp_async_encode() illegal access
by Zhang Changzhong 30 Oct '24

30 Oct '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.12-rc3 commit 40dddd4b8bd08a69471efd96107a4e1c73fabefc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDK CVE: CVE-2024-50035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline] ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4092 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1d121645899e7692f92a(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20241009185802.3763282-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ppp/ppp_async.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c index 748b03c..fa3690c 100644 --- a/drivers/net/ppp/ppp_async.c +++ b/drivers/net/ppp/ppp_async.c @@ -555,7 +555,7 @@ ppp_async_encode(struct asyncppp *ap) * and 7 (code-reject) must be sent as though no options * had been negotiated. */ - islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7; + islcp = proto == PPP_LCP && count >= 3 && 1 <= data[2] && data[2] <= 7; if (i == 0) { if (islcp) -- 2.9.5

2 1

[PATCH OLK-6.6] bpf: Fail verification for sign-extension of packet data/data_end/data_meta
by Chen Zhongjin 30 Oct '24

30 Oct '24

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 92de36080c93296ef9005690705cba260b9bd68a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJQ CVE: CVE-2024-47702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ Reported-by: syzbot+ad9ec60c8eaf69e6f99c(a)syzkaller.appspotmail.com Fixes: 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20240723153439.2429035-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Conflicts: kernel/bpf/verifier.c [patch set:("bpf, lsm: Add check for BPF LSM return value") was not merged] include/linux/bpf.h [fix struct bpf_insn_access_aux KABI breakage] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 8c4c2c39a6c1..0282c3435233 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -912,6 +912,7 @@ static_assert(__BPF_REG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT); */ struct bpf_insn_access_aux { enum bpf_reg_type reg_type; + KABI_FILL_HOLE(bool is_ldsx); union { int ctx_field_size; struct { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d1041517a984..82f2be2ddd06 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5549,11 +5549,12 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id) + struct btf **btf, u32 *btf_id, bool is_ldsx) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, + .is_ldsx = is_ldsx, }; if (env->ops->is_valid_access && @@ -6802,7 +6803,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id); + &btf_id, is_ldsx); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { diff --git a/net/core/filter.c b/net/core/filter.c index e16d746c23da..e4f1dc9f222b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8601,13 +8601,16 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type if (off + size > offsetofend(struct __sk_buff, cb[4])) return false; break; + case bpf_ctx_range(struct __sk_buff, data): + case bpf_ctx_range(struct __sk_buff, data_meta): + case bpf_ctx_range(struct __sk_buff, data_end): + if (info->is_ldsx || size != size_default) + return false; + break; case bpf_ctx_range_till(struct __sk_buff, remote_ip6[0], remote_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, local_ip6[0], local_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4): case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4): - case bpf_ctx_range(struct __sk_buff, data): - case bpf_ctx_range(struct __sk_buff, data_meta): - case bpf_ctx_range(struct __sk_buff, data_end): if (size != size_default) return false; break; @@ -9051,6 +9054,14 @@ static bool xdp_is_valid_access(int off, int size, } } return false; + } else { + switch (off) { + case offsetof(struct xdp_md, data_meta): + case offsetof(struct xdp_md, data): + case offsetof(struct xdp_md, data_end): + if (info->is_ldsx) + return false; + } } switch (off) { @@ -9381,12 +9392,12 @@ static bool flow_dissector_is_valid_access(int off, int size, switch (off) { case bpf_ctx_range(struct __sk_buff, data): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET; return true; case bpf_ctx_range(struct __sk_buff, data_end): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET_END; return true; -- 2.25.1

2 1

[PATCH OLK-6.6] thermal: core: Reference count the zone in thermal_zone_get_by_id()
by Xiongfeng Wang 30 Oct '24

30 Oct '24

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.12-rc3 commit a42a5839f400e929c489bb1b58f54596c4535167 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF5 CVE: CVE-2024-50028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has been returned by thermal_zone_get_by_id(). To address this, make thermal_zone_get_by_id() get a reference on the thermal zone device object to be returned with the help of get_device(), under thermal_list_lock, and adjust all of its callers to this change with the help of the cleanup.h infrastructure. Fixes: 1ce50e7d408e ("thermal: core: genetlink support for events/cmd/sampling") Cc: 6.8+ <stable(a)vger.kernel.org> # 6.8+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Lukasz Luba <lukasz.luba(a)arm.com> Link: https://patch.msgid.link/6112242.lOV4Wx5bFT@rjwysocki.net Conflicts: drivers/thermal/thermal_core.h drivers/thermal/thermal_netlink.c [wangxiongfeng: fix context conflicts] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/thermal/thermal_core.c | 1 + drivers/thermal/thermal_core.h | 3 +++ drivers/thermal/thermal_netlink.c | 9 +++------ 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index dee3022539cf..acf74fe64088 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -582,6 +582,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id) mutex_lock(&thermal_list_lock); list_for_each_entry(tz, &thermal_tz_list, node) { if (tz->id == id) { + get_device(&tz->device); match = tz; break; } diff --git a/drivers/thermal/thermal_core.h b/drivers/thermal/thermal_core.h index 024e82ebf592..91703b930956 100644 --- a/drivers/thermal/thermal_core.h +++ b/drivers/thermal/thermal_core.h @@ -56,6 +56,9 @@ int for_each_thermal_governor(int (*cb)(struct thermal_governor *, void *), struct thermal_zone_device *thermal_zone_get_by_id(int id); +DEFINE_CLASS(thermal_zone_get_by_id, struct thermal_zone_device *, + if (_T) put_device(&_T->device), thermal_zone_get_by_id(id), int id) + struct thermal_attr { struct device_attribute attr; char name[THERMAL_NAME_LENGTH]; diff --git a/drivers/thermal/thermal_netlink.c b/drivers/thermal/thermal_netlink.c index 08bc46c3ec7b..8d07531d9519 100644 --- a/drivers/thermal/thermal_netlink.c +++ b/drivers/thermal/thermal_netlink.c @@ -450,7 +450,6 @@ static int thermal_genl_cmd_tz_get_id(struct param *p) static int thermal_genl_cmd_tz_get_trip(struct param *p) { struct sk_buff *msg = p->msg; - struct thermal_zone_device *tz; struct nlattr *start_trip; struct thermal_trip trip; int ret, i, id; @@ -460,7 +459,7 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]); - tz = thermal_zone_get_by_id(id); + CLASS(thermal_zone_get_by_id, tz)(id); if (!tz) return -EINVAL; @@ -498,7 +497,6 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) static int thermal_genl_cmd_tz_get_temp(struct param *p) { struct sk_buff *msg = p->msg; - struct thermal_zone_device *tz; int temp, ret, id; if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID]) @@ -506,7 +504,7 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]); - tz = thermal_zone_get_by_id(id); + CLASS(thermal_zone_get_by_id, tz)(id); if (!tz) return -EINVAL; @@ -524,7 +522,6 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) static int thermal_genl_cmd_tz_get_gov(struct param *p) { struct sk_buff *msg = p->msg; - struct thermal_zone_device *tz; int id, ret = 0; if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID]) @@ -532,7 +529,7 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p) id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]); - tz = thermal_zone_get_by_id(id); + CLASS(thermal_zone_get_by_id, tz)(id); if (!tz) return -EINVAL; -- 2.20.1

2 1

[PATCH OLK-6.6] wifi: ath12k: fix array out-of-bound access in SoC stats
by Chen Zhongjin 30 Oct '24

30 Oct '24

From: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> stable inclusion from stable-v6.6.55 commit d0e4274d9dc9f8409d56d622cd3ecf7b6fd49e2f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8S CVE: CVE-2024-49931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e106b7ad13c1d246adaa57df73edb8f8b8acb240 ] Currently, the ath12k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath12k_dp_rx_process() function access ath12k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath12k_dp_rx_process() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240704070811.4186543-2-quic_periyasa@quicinc.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/net/wireless/ath/ath12k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c index d9bc07844fb7..70ad035acac7 100644 --- a/drivers/net/wireless/ath/ath12k/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c @@ -2670,7 +2670,7 @@ int ath12k_dp_rx_process(struct ath12k_base *ab, int ring_id, if (push_reason != HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) { dev_kfree_skb_any(msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++; continue; } -- 2.25.1

2 1

[PATCH OLK-6.6] bpf: Fail verification for sign-extension of packet data/data_end/data_meta
by Chen Zhongjin 30 Oct '24

30 Oct '24

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 92de36080c93296ef9005690705cba260b9bd68a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJQ CVE: CVE-2024-47702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ Reported-by: syzbot+ad9ec60c8eaf69e6f99c(a)syzkaller.appspotmail.com Fixes: 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20240723153439.2429035-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Conflicts: kernel/bpf/verifier.c [patch set:("bpf, lsm: Add check for BPF LSM return value") was not merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 8c4c2c39a6c1..7de3bcec8607 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -912,6 +912,7 @@ static_assert(__BPF_REG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT); */ struct bpf_insn_access_aux { enum bpf_reg_type reg_type; + bool is_ldsx; union { int ctx_field_size; struct { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d1041517a984..82f2be2ddd06 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5549,11 +5549,12 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id) + struct btf **btf, u32 *btf_id, bool is_ldsx) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, + .is_ldsx = is_ldsx, }; if (env->ops->is_valid_access && @@ -6802,7 +6803,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id); + &btf_id, is_ldsx); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { diff --git a/net/core/filter.c b/net/core/filter.c index e16d746c23da..e4f1dc9f222b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8601,13 +8601,16 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type if (off + size > offsetofend(struct __sk_buff, cb[4])) return false; break; + case bpf_ctx_range(struct __sk_buff, data): + case bpf_ctx_range(struct __sk_buff, data_meta): + case bpf_ctx_range(struct __sk_buff, data_end): + if (info->is_ldsx || size != size_default) + return false; + break; case bpf_ctx_range_till(struct __sk_buff, remote_ip6[0], remote_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, local_ip6[0], local_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4): case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4): - case bpf_ctx_range(struct __sk_buff, data): - case bpf_ctx_range(struct __sk_buff, data_meta): - case bpf_ctx_range(struct __sk_buff, data_end): if (size != size_default) return false; break; @@ -9051,6 +9054,14 @@ static bool xdp_is_valid_access(int off, int size, } } return false; + } else { + switch (off) { + case offsetof(struct xdp_md, data_meta): + case offsetof(struct xdp_md, data): + case offsetof(struct xdp_md, data_end): + if (info->is_ldsx) + return false; + } } switch (off) { @@ -9381,12 +9392,12 @@ static bool flow_dissector_is_valid_access(int off, int size, switch (off) { case bpf_ctx_range(struct __sk_buff, data): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET; return true; case bpf_ctx_range(struct __sk_buff, data_end): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET_END; return true; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm: omapdrm: Add missing check for alloc_ordered_workqueue
by Liu Chuang 30 Oct '24

30 Oct '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.10.227 commit 2bda89735199683b03f55b807bd1e31a3857520b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR94 CVE: CVE-2024-49879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e794b7b9b92977365c693760a259f8eef940c536 upstream. As it may return NULL pointer and cause NULL pointer dereference. Add check for the return value of alloc_ordered_workqueue. Cc: stable(a)vger.kernel.org Fixes: 2f95bc6d324a ("drm: omapdrm: Perform initialization/cleanup at probe/remove time") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240808061336.2796729-1-make… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/omapdrm/omap_drv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c index 53d5e184ee77..8c664ef0cf62 100644 --- a/drivers/gpu/drm/omapdrm/omap_drv.c +++ b/drivers/gpu/drm/omapdrm/omap_drv.c @@ -600,6 +600,10 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) soc = soc_device_match(omapdrm_soc_devices); priv->omaprev = soc ? (unsigned int)soc->data : 0; priv->wq = alloc_ordered_workqueue("omapdrm", 0); + if (!priv->wq) { + ret = -ENOMEM; + goto err_alloc_workqueue; + } mutex_init(&priv->list_lock); INIT_LIST_HEAD(&priv->obj_list); @@ -649,6 +653,7 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) err_gem_deinit: omap_gem_deinit(ddev); destroy_workqueue(priv->wq); +err_alloc_workqueue: omap_disconnect_pipelines(ddev); omap_crtc_pre_uninit(priv); drm_dev_put(ddev); -- 2.34.1

2 1

[OLK-6.6] thermal: core: Reference count the zone in thermal_zone_get_by_id()
by Xiongfeng Wang 30 Oct '24

30 Oct '24

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.12-rc3 commit a42a5839f400e929c489bb1b58f54596c4535167 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF5 CVE: CVE-2024-50028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has been returned by thermal_zone_get_by_id(). To address this, make thermal_zone_get_by_id() get a reference on the thermal zone device object to be returned with the help of get_device(), under thermal_list_lock, and adjust all of its callers to this change with the help of the cleanup.h infrastructure. Fixes: 1ce50e7d408e ("thermal: core: genetlink support for events/cmd/sampling") Cc: 6.8+ <stable(a)vger.kernel.org> # 6.8+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Lukasz Luba <lukasz.luba(a)arm.com> Link: https://patch.msgid.link/6112242.lOV4Wx5bFT@rjwysocki.net Conflicts: drivers/thermal/thermal_core.h drivers/thermal/thermal_netlink.c [wangxiongfeng: fix context conflicts] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/thermal/thermal_core.c | 1 + drivers/thermal/thermal_core.h | 3 +++ drivers/thermal/thermal_netlink.c | 9 +++------ 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index dee3022539cf..acf74fe64088 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -582,6 +582,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id) mutex_lock(&thermal_list_lock); list_for_each_entry(tz, &thermal_tz_list, node) { if (tz->id == id) { + get_device(&tz->device); match = tz; break; } diff --git a/drivers/thermal/thermal_core.h b/drivers/thermal/thermal_core.h index 024e82ebf592..91703b930956 100644 --- a/drivers/thermal/thermal_core.h +++ b/drivers/thermal/thermal_core.h @@ -56,6 +56,9 @@ int for_each_thermal_governor(int (*cb)(struct thermal_governor *, void *), struct thermal_zone_device *thermal_zone_get_by_id(int id); +DEFINE_CLASS(thermal_zone_get_by_id, struct thermal_zone_device *, + if (_T) put_device(&_T->device), thermal_zone_get_by_id(id), int id) + struct thermal_attr { struct device_attribute attr; char name[THERMAL_NAME_LENGTH]; diff --git a/drivers/thermal/thermal_netlink.c b/drivers/thermal/thermal_netlink.c index 08bc46c3ec7b..8d07531d9519 100644 --- a/drivers/thermal/thermal_netlink.c +++ b/drivers/thermal/thermal_netlink.c @@ -450,7 +450,6 @@ static int thermal_genl_cmd_tz_get_id(struct param *p) static int thermal_genl_cmd_tz_get_trip(struct param *p) { struct sk_buff *msg = p->msg; - struct thermal_zone_device *tz; struct nlattr *start_trip; struct thermal_trip trip; int ret, i, id; @@ -460,7 +459,7 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]); - tz = thermal_zone_get_by_id(id); + CLASS(thermal_zone_get_by_id, tz)(id); if (!tz) return -EINVAL; @@ -498,7 +497,6 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) static int thermal_genl_cmd_tz_get_temp(struct param *p) { struct sk_buff *msg = p->msg; - struct thermal_zone_device *tz; int temp, ret, id; if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID]) @@ -506,7 +504,7 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]); - tz = thermal_zone_get_by_id(id); + CLASS(thermal_zone_get_by_id, tz)(id); if (!tz) return -EINVAL; @@ -524,7 +522,6 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) static int thermal_genl_cmd_tz_get_gov(struct param *p) { struct sk_buff *msg = p->msg; - struct thermal_zone_device *tz; int id, ret = 0; if (!p->attrs[THERMAL_GENL_ATTR_TZ_ID]) @@ -532,7 +529,7 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p) id = nla_get_u32(p->attrs[THERMAL_GENL_ATTR_TZ_ID]); - tz = thermal_zone_get_by_id(id); + CLASS(thermal_zone_get_by_id, tz)(id); if (!tz) return -EINVAL; -- 2.20.1

1 0

[PATCH OLK-5.10] drm: omapdrm: Add missing check for alloc_ordered_workqueue
by Liu Chuang 30 Oct '24

30 Oct '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.10.227 commit 2bda89735199683b03f55b807bd1e31a3857520b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR94 CVE: CVE-2024-49879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e794b7b9b92977365c693760a259f8eef940c536 upstream. As it may return NULL pointer and cause NULL pointer dereference. Add check for the return value of alloc_ordered_workqueue. Cc: stable(a)vger.kernel.org Fixes: 2f95bc6d324a ("drm: omapdrm: Perform initialization/cleanup at probe/remove time") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240808061336.2796729-1-make… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/omapdrm/omap_drv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c index 53d5e184ee77..8c664ef0cf62 100644 --- a/drivers/gpu/drm/omapdrm/omap_drv.c +++ b/drivers/gpu/drm/omapdrm/omap_drv.c @@ -600,6 +600,10 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) soc = soc_device_match(omapdrm_soc_devices); priv->omaprev = soc ? (unsigned int)soc->data : 0; priv->wq = alloc_ordered_workqueue("omapdrm", 0); + if (!priv->wq) { + ret = -ENOMEM; + goto err_alloc_workqueue; + } mutex_init(&priv->list_lock); INIT_LIST_HEAD(&priv->obj_list); @@ -649,6 +653,7 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) err_gem_deinit: omap_gem_deinit(ddev); destroy_workqueue(priv->wq); +err_alloc_workqueue: omap_disconnect_pipelines(ddev); omap_crtc_pre_uninit(priv); drm_dev_put(ddev); -- 2.34.1

2 1

[PATCH OLK-6.6] drm: omapdrm: Add missing check for alloc_ordered_workqueue
by Liu Chuang 30 Oct '24

30 Oct '24

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.55 commit b57b53e8ffcdfda87d954fc4187426a54fe75a3d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR94 CVE: CVE-2024-49879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e794b7b9b92977365c693760a259f8eef940c536 upstream. As it may return NULL pointer and cause NULL pointer dereference. Add check for the return value of alloc_ordered_workqueue. Cc: stable(a)vger.kernel.org Fixes: 2f95bc6d324a ("drm: omapdrm: Perform initialization/cleanup at probe/remove time") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240808061336.2796729-1-make… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/omapdrm/omap_drv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c index e000577a95dd..21996b713d1c 100644 --- a/drivers/gpu/drm/omapdrm/omap_drv.c +++ b/drivers/gpu/drm/omapdrm/omap_drv.c @@ -695,6 +695,10 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) soc = soc_device_match(omapdrm_soc_devices); priv->omaprev = soc ? (uintptr_t)soc->data : 0; priv->wq = alloc_ordered_workqueue("omapdrm", 0); + if (!priv->wq) { + ret = -ENOMEM; + goto err_alloc_workqueue; + } mutex_init(&priv->list_lock); INIT_LIST_HEAD(&priv->obj_list); @@ -753,6 +757,7 @@ static int omapdrm_init(struct omap_drm_private *priv, struct device *dev) drm_mode_config_cleanup(ddev); omap_gem_deinit(ddev); destroy_workqueue(priv->wq); +err_alloc_workqueue: omap_disconnect_pipelines(ddev); drm_dev_put(ddev); return ret; -- 2.34.1

2 1

[PATCH OLK-6.6] btrfs: fix uninitialized pointer free in add_inode_ref()
by Yifan Qiao 30 Oct '24

30 Oct '24

From: Roi Martin <jroi.martin(a)gmail.com> stable inclusion from stable-v6.6.58 commit e11ce03b58743bf1e096c48fcaa7e6f08eb75dfa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB0EMU CVE: CVE-2024-50088 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 66691c6e2f18d2aa4b22ffb624b9bdc97e9979e4 upstream. The add_inode_ref() function does not initialize the "name" struct when it is declared. If any of the following calls to "read_one_inode() returns NULL, dir = read_one_inode(root, parent_objectid); if (!dir) { ret = -ENOENT; goto out; } inode = read_one_inode(root, inode_objectid); if (!inode) { ret = -EIO; goto out; } then "name.name" would be freed on "out" before being initialized. out: ... kfree(name.name); This issue was reported by Coverity with CID 1526744. Fixes: e43eec81c516 ("btrfs: use struct qstr instead of name and namelen pairs") CC: stable(a)vger.kernel.org # 6.6+ Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Roi Martin <jroi.martin(a)gmail.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/tree-log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c index e0037665aa92..9ca55ad589e5 100644 --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -1374,7 +1374,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans, struct inode *inode = NULL; unsigned long ref_ptr; unsigned long ref_end; - struct fscrypt_str name; + struct fscrypt_str name = { 0 }; int ret; int log_ref_ver = 0; u64 parent_objectid; -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] fix CVE-2024-49924
by Lin Yujun 30 Oct '24

30 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] thermal: core: Reference count the zone in thermal_zone_get_by_id()
by Xiongfeng Wang 30 Oct '24

30 Oct '24

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.12-rc3 commit a42a5839f400e929c489bb1b58f54596c4535167 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF5 CVE: CVE-2024-50028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has been returned by thermal_zone_get_by_id(). To address this, make thermal_zone_get_by_id() get a reference on the thermal zone device object to be returned with the help of get_device(), under thermal_list_lock, and adjust all of its callers to this change with the help of the cleanup.h infrastructure. Fixes: 1ce50e7d408e ("thermal: core: genetlink support for events/cmd/sampling") Cc: 6.8+ <stable(a)vger.kernel.org> # 6.8+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Lukasz Luba <lukasz.luba(a)arm.com> Link: https://patch.msgid.link/6112242.lOV4Wx5bFT@rjwysocki.net Conflicts: drivers/thermal/thermal_netlink.c [wangxiongfeng: fix conflict because __cleanup() based infrastructure DEFINE_CLASS() is not introduced.] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/thermal/thermal_core.c | 1 + drivers/thermal/thermal_netlink.c | 24 ++++++++++++++++++------ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index dd449945e1e5e..ae7feac0892e2 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -760,6 +760,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id) mutex_lock(&thermal_list_lock); list_for_each_entry(tz, &thermal_tz_list, node) { if (tz->id == id) { + get_device(&tz->device); match = tz; break; } diff --git a/drivers/thermal/thermal_netlink.c b/drivers/thermal/thermal_netlink.c index dc535831b6609..5a9a6d1ddd03d 100644 --- a/drivers/thermal/thermal_netlink.c +++ b/drivers/thermal/thermal_netlink.c @@ -463,8 +463,10 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) return -EINVAL; start_trip = nla_nest_start(msg, THERMAL_GENL_ATTR_TZ_TRIP); - if (!start_trip) + if (!start_trip) { + put_device(&tz->device); return -EMSGSIZE; + } mutex_lock(&tz->lock); @@ -489,10 +491,13 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) nla_nest_end(msg, start_trip); + put_device(&tz->device); + return 0; out_cancel_nest: mutex_unlock(&tz->lock); + put_device(&tz->device); return -EMSGSIZE; } @@ -514,13 +519,17 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) ret = thermal_zone_get_temp(tz, &temp); if (ret) - return ret; + goto out; if (nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, id) || - nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_TEMP, temp)) - return -EMSGSIZE; + nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_TEMP, temp)) { + ret = -EMSGSIZE; + goto out; + } - return 0; +out: + put_device(&tz->device); + return ret; } static int thermal_genl_cmd_tz_get_gov(struct param *p) @@ -542,10 +551,13 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p) if (nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, id) || nla_put_string(msg, THERMAL_GENL_ATTR_TZ_GOV_NAME, - tz->governor->name)) + tz->governor->name)) { + put_device(&tz->device); ret = -EMSGSIZE; + } mutex_unlock(&tz->lock); + put_device(&tz->device); return ret; } -- 2.20.1

2 1

[PATCH OLK-5.10] thermal: core: Reference count the zone in thermal_zone_get_by_id()
by Xiongfeng Wang 30 Oct '24

30 Oct '24

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.12-rc3 commit a42a5839f400e929c489bb1b58f54596c4535167 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRF5 CVE: CVE-2024-50028 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has been returned by thermal_zone_get_by_id(). To address this, make thermal_zone_get_by_id() get a reference on the thermal zone device object to be returned with the help of get_device(), under thermal_list_lock, and adjust all of its callers to this change with the help of the cleanup.h infrastructure. Fixes: 1ce50e7d408e ("thermal: core: genetlink support for events/cmd/sampling") Cc: 6.8+ <stable(a)vger.kernel.org> # 6.8+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Lukasz Luba <lukasz.luba(a)arm.com> Link: https://patch.msgid.link/6112242.lOV4Wx5bFT@rjwysocki.net Conflicts: drivers/thermal/thermal_netlink.c [wangxiongfeng: fix conflict because __cleanup() based infrastructure DEFINE_CLASS() is not introduced.] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/thermal/thermal_core.c | 1 + drivers/thermal/thermal_netlink.c | 24 ++++++++++++++++++------ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c index 1cf49912dc96c..49e3cb07ae9e8 100644 --- a/drivers/thermal/thermal_core.c +++ b/drivers/thermal/thermal_core.c @@ -760,6 +760,7 @@ struct thermal_zone_device *thermal_zone_get_by_id(int id) mutex_lock(&thermal_list_lock); list_for_each_entry(tz, &thermal_tz_list, node) { if (tz->id == id) { + get_device(&tz->device); match = tz; break; } diff --git a/drivers/thermal/thermal_netlink.c b/drivers/thermal/thermal_netlink.c index dc535831b6609..5a9a6d1ddd03d 100644 --- a/drivers/thermal/thermal_netlink.c +++ b/drivers/thermal/thermal_netlink.c @@ -463,8 +463,10 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) return -EINVAL; start_trip = nla_nest_start(msg, THERMAL_GENL_ATTR_TZ_TRIP); - if (!start_trip) + if (!start_trip) { + put_device(&tz->device); return -EMSGSIZE; + } mutex_lock(&tz->lock); @@ -489,10 +491,13 @@ static int thermal_genl_cmd_tz_get_trip(struct param *p) nla_nest_end(msg, start_trip); + put_device(&tz->device); + return 0; out_cancel_nest: mutex_unlock(&tz->lock); + put_device(&tz->device); return -EMSGSIZE; } @@ -514,13 +519,17 @@ static int thermal_genl_cmd_tz_get_temp(struct param *p) ret = thermal_zone_get_temp(tz, &temp); if (ret) - return ret; + goto out; if (nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, id) || - nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_TEMP, temp)) - return -EMSGSIZE; + nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_TEMP, temp)) { + ret = -EMSGSIZE; + goto out; + } - return 0; +out: + put_device(&tz->device); + return ret; } static int thermal_genl_cmd_tz_get_gov(struct param *p) @@ -542,10 +551,13 @@ static int thermal_genl_cmd_tz_get_gov(struct param *p) if (nla_put_u32(msg, THERMAL_GENL_ATTR_TZ_ID, id) || nla_put_string(msg, THERMAL_GENL_ATTR_TZ_GOV_NAME, - tz->governor->name)) + tz->governor->name)) { + put_device(&tz->device); ret = -EMSGSIZE; + } mutex_unlock(&tz->lock); + put_device(&tz->device); return ret; } -- 2.20.1

2 1

[PATCH OLK-6.6] drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func
by Xiongfeng Wang 30 Oct '24

30 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 28574b08c70e56d34d6f6379326a860b96749051 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCD CVE: CVE-2024-49909 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- This commit adds a null check for the set_output_gamma function pointer in the dcn32_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma. Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c [wangxiongfeng: fix conflicts because the file is renamed] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c index 650e1598bddc..2289c17f6ead 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c @@ -587,7 +587,9 @@ bool dcn32_set_output_transfer_func(struct dc *dc, } } - mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + if (mpc->funcs->set_output_gamma) + mpc->funcs->set_output_gamma(mpc, mpcc_id, params); + return ret; } -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-49924
by Lin Yujun 30 Oct '24

30 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] fix CVE-2024-49924
by Lin Yujun 30 Oct '24

30 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-49924
by Lin Yujun 30 Oct '24

30 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
by Luo Gengkun 30 Oct '24

30 Oct '24

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.1-rc7 commit 05530ef7cf7c7d700f6753f058999b1b5099a026 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDZ CVE: CVE-2022-48994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Reported-by: kernel test robot <lkp(a)intel.com> Link: https://lore.kernel.org/lkml/202211041527.HD8TLSE1-lkp@intel.com Cc: Jaroslav Kysela <perex(a)perex.cz> Cc: Takashi Iwai <tiwai(a)suse.com> Cc: "Gustavo A. R. Silva" <gustavoars(a)kernel.org> Cc: alsa-devel(a)alsa-project.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20221118232346.never.380-kees@kernel.org Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/core/seq/seq_memory.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c index 5b0388202bac..ac854beb8347 100644 --- a/sound/core/seq/seq_memory.c +++ b/sound/core/seq/seq_memory.c @@ -126,15 +126,19 @@ EXPORT_SYMBOL(snd_seq_dump_var_event); * expand the variable length event to linear buffer space. */ -static int seq_copy_in_kernel(char **bufptr, const void *src, int size) +static int seq_copy_in_kernel(void *ptr, void *src, int size) { + char **bufptr = ptr; + memcpy(*bufptr, src, size); *bufptr += size; return 0; } -static int seq_copy_in_user(char __user **bufptr, const void *src, int size) +static int seq_copy_in_user(void *ptr, void *src, int size) { + char __user **bufptr = ptr; + if (copy_to_user(*bufptr, src, size)) return -EFAULT; *bufptr += size; @@ -163,8 +167,7 @@ int snd_seq_expand_var_event(const struct snd_seq_event *event, int count, char return newlen; } err = snd_seq_dump_var_event(event, - in_kernel ? (snd_seq_dump_func_t)seq_copy_in_kernel : - (snd_seq_dump_func_t)seq_copy_in_user, + in_kernel ? seq_copy_in_kernel : seq_copy_in_user, &buf); return err < 0 ? err : newlen; } -- 2.34.1

2 1

[PATCH V2 OLK-6.6 0/2] add vdpa support for x86 and enable vdpa migration.
by Jiang Dongxu 30 Oct '24

30 Oct '24

From: jiangdongxu <jiangdongxu1(a)huawei.com> Christoph Hellwig (1): virtio_blk: remove the broken zone revalidation support jiangdongxu (1): vdpa: add support for x86 and open vdpa migration build config arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 5 +++-- drivers/block/virtio_blk.c | 26 -------------------------- 3 files changed, 4 insertions(+), 29 deletions(-) -- 2.27.0

2 3

[PATCH OLK-6.6] vhost_vdpa: assign irq bypass producer token correctly
by Liu Chuang 30 Oct '24

30 Oct '24

From: Jason Wang <jasowang(a)redhat.com> stable inclusion from stable-v6.6.54 commit ca64edd7ae93402af2596a952e0d94d545e2b9c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSA CVE: CVE-2024-47748 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 02e9e9366fefe461719da5d173385b6685f70319 ] We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not. Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status(). Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set. Reported-by: Dragos Tatulea <dtatulea(a)nvidia.com> Tested-by: Dragos Tatulea <dtatulea(a)nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea(a)nvidia.com> Fixes: 2cf1ba9a4d15 ("vhost_vdpa: implement IRQ offloading in vhost_vdpa") Signed-off-by: Jason Wang <jasowang(a)redhat.com> Message-Id: <20240816031900.18013-1-jasowang(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/vhost/vdpa.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index ba8086633c59..ef7009a9d5ec 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -192,11 +192,9 @@ static void vhost_vdpa_setup_vq_irq(struct vhost_vdpa *v, u16 qid) if (irq < 0) return; - irq_bypass_unregister_producer(&vq->call_ctx.producer); if (!vq->call_ctx.ctx) return; - vq->call_ctx.producer.token = vq->call_ctx.ctx; vq->call_ctx.producer.irq = irq; ret = irq_bypass_register_producer(&vq->call_ctx.producer); if (unlikely(ret)) @@ -751,6 +749,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, vq->last_avail_idx = vq_state.split.avail_index; } break; + case VHOST_SET_VRING_CALL: + if (vq->call_ctx.ctx) { + if (ops->get_status(vdpa) & + VIRTIO_CONFIG_S_DRIVER_OK) + vhost_vdpa_unsetup_vq_irq(v, idx); + vq->call_ctx.producer.token = NULL; + } + break; } r = vhost_vring_ioctl(&v->vdev, cmd, argp); @@ -783,13 +789,16 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, cb.callback = vhost_vdpa_virtqueue_cb; cb.private = vq; cb.trigger = vq->call_ctx.ctx; + vq->call_ctx.producer.token = vq->call_ctx.ctx; + if (ops->get_status(vdpa) & + VIRTIO_CONFIG_S_DRIVER_OK) + vhost_vdpa_setup_vq_irq(v, idx); } else { cb.callback = NULL; cb.private = NULL; cb.trigger = NULL; } ops->set_vq_cb(vdpa, idx, &cb); - vhost_vdpa_setup_vq_irq(v, idx); break; case VHOST_SET_VRING_NUM: @@ -1517,6 +1526,7 @@ static int vhost_vdpa_open(struct inode *inode, struct file *filep) for (i = 0; i < nvqs; i++) { vqs[i] = &v->vqs[i]; vqs[i]->handle_kick = handle_vq_kick; + vqs[i]->call_ctx.ctx = NULL; } vhost_dev_init(dev, vqs, nvqs, 0, 0, 0, false, vhost_vdpa_process_iotlb_msg); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] vhost_vdpa: assign irq bypass producer token correctly
by Liu Chuang 30 Oct '24

30 Oct '24

From: Jason Wang <jasowang(a)redhat.com> stable inclusion from stable-v5.10.227 commit 0c170b1e918b9afac25e2bbd01eaa2bfc0ece8c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSA CVE: CVE-2024-47748 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 02e9e9366fefe461719da5d173385b6685f70319 ] We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not. Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status(). Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set. Reported-by: Dragos Tatulea <dtatulea(a)nvidia.com> Tested-by: Dragos Tatulea <dtatulea(a)nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea(a)nvidia.com> Fixes: 2cf1ba9a4d15 ("vhost_vdpa: implement IRQ offloading in vhost_vdpa") Signed-off-by: Jason Wang <jasowang(a)redhat.com> Message-Id: <20240816031900.18013-1-jasowang(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/vdpa.c [Context difference.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/vhost/vdpa.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index cdcada1e2b9b..88c9d7665ced 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -193,11 +193,9 @@ static void vhost_vdpa_setup_vq_irq(struct vhost_vdpa *v, u16 qid) if (irq < 0) return; - irq_bypass_unregister_producer(&vq->call_ctx.producer); if (!vq->call_ctx.ctx) return; - vq->call_ctx.producer.token = vq->call_ctx.ctx; vq->call_ctx.producer.irq = irq; ret = irq_bypass_register_producer(&vq->call_ctx.producer); if (unlikely(ret)) @@ -750,6 +748,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, vq->last_avail_idx = vq_state.split.avail_index; } break; + case VHOST_SET_VRING_CALL: + if (vq->call_ctx.ctx) { + if (ops->get_status(vdpa) & + VIRTIO_CONFIG_S_DRIVER_OK) + vhost_vdpa_unsetup_vq_irq(v, idx); + vq->call_ctx.producer.token = NULL; + } + break; } r = vhost_vring_ioctl(&v->vdev, cmd, argp); @@ -781,12 +787,15 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, if (vq->call_ctx.ctx) { cb.callback = vhost_vdpa_virtqueue_cb; cb.private = vq; + vq->call_ctx.producer.token = vq->call_ctx.ctx; + if (ops->get_status(vdpa) & + VIRTIO_CONFIG_S_DRIVER_OK) + vhost_vdpa_setup_vq_irq(v, idx); } else { cb.callback = NULL; cb.private = NULL; } ops->set_vq_cb(vdpa, idx, &cb); - vhost_vdpa_setup_vq_irq(v, idx); break; case VHOST_SET_VRING_NUM: @@ -1510,6 +1519,7 @@ static int vhost_vdpa_open(struct inode *inode, struct file *filep) for (i = 0; i < nvqs; i++) { vqs[i] = &v->vqs[i]; vqs[i]->handle_kick = handle_vq_kick; + vqs[i]->call_ctx.ctx = NULL; } vhost_dev_init(dev, vqs, nvqs, 0, 0, 0, false, vhost_vdpa_process_iotlb_msg); -- 2.34.1

2 1

[PATCH OLK-5.10] vhost_vdpa: assign irq bypass producer token correctly
by Liu Chuang 30 Oct '24

30 Oct '24

From: Jason Wang <jasowang(a)redhat.com> stable inclusion from stable-v5.10.227 commit 0c170b1e918b9afac25e2bbd01eaa2bfc0ece8c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSA CVE: CVE-2024-47748 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 02e9e9366fefe461719da5d173385b6685f70319 ] We used to call irq_bypass_unregister_producer() in vhost_vdpa_setup_vq_irq() which is problematic as we don't know if the token pointer is still valid or not. Actually, we use the eventfd_ctx as the token so the life cycle of the token should be bound to the VHOST_SET_VRING_CALL instead of vhost_vdpa_setup_vq_irq() which could be called by set_status(). Fixing this by setting up irq bypass producer's token when handling VHOST_SET_VRING_CALL and un-registering the producer before calling vhost_vring_ioctl() to prevent a possible use after free as eventfd could have been released in vhost_vring_ioctl(). And such registering and unregistering will only be done if DRIVER_OK is set. Reported-by: Dragos Tatulea <dtatulea(a)nvidia.com> Tested-by: Dragos Tatulea <dtatulea(a)nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea(a)nvidia.com> Fixes: 2cf1ba9a4d15 ("vhost_vdpa: implement IRQ offloading in vhost_vdpa") Signed-off-by: Jason Wang <jasowang(a)redhat.com> Message-Id: <20240816031900.18013-1-jasowang(a)redhat.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/vdpa.c [Context difference.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/vhost/vdpa.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index cdcada1e2b9b..88c9d7665ced 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -193,11 +193,9 @@ static void vhost_vdpa_setup_vq_irq(struct vhost_vdpa *v, u16 qid) if (irq < 0) return; - irq_bypass_unregister_producer(&vq->call_ctx.producer); if (!vq->call_ctx.ctx) return; - vq->call_ctx.producer.token = vq->call_ctx.ctx; vq->call_ctx.producer.irq = irq; ret = irq_bypass_register_producer(&vq->call_ctx.producer); if (unlikely(ret)) @@ -750,6 +748,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, vq->last_avail_idx = vq_state.split.avail_index; } break; + case VHOST_SET_VRING_CALL: + if (vq->call_ctx.ctx) { + if (ops->get_status(vdpa) & + VIRTIO_CONFIG_S_DRIVER_OK) + vhost_vdpa_unsetup_vq_irq(v, idx); + vq->call_ctx.producer.token = NULL; + } + break; } r = vhost_vring_ioctl(&v->vdev, cmd, argp); @@ -781,12 +787,15 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, if (vq->call_ctx.ctx) { cb.callback = vhost_vdpa_virtqueue_cb; cb.private = vq; + vq->call_ctx.producer.token = vq->call_ctx.ctx; + if (ops->get_status(vdpa) & + VIRTIO_CONFIG_S_DRIVER_OK) + vhost_vdpa_setup_vq_irq(v, idx); } else { cb.callback = NULL; cb.private = NULL; } ops->set_vq_cb(vdpa, idx, &cb); - vhost_vdpa_setup_vq_irq(v, idx); break; case VHOST_SET_VRING_NUM: @@ -1510,6 +1519,7 @@ static int vhost_vdpa_open(struct inode *inode, struct file *filep) for (i = 0; i < nvqs; i++) { vqs[i] = &v->vqs[i]; vqs[i]->handle_kick = handle_vq_kick; + vqs[i]->call_ctx.ctx = NULL; } vhost_dev_init(dev, vqs, nvqs, 0, 0, 0, false, vhost_vdpa_process_iotlb_msg); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] scsi: iscsi_tcp: restrict to TCP sockets
by Yu Kuai 30 Oct '24

30 Oct '24

Eric Dumazet (1): scsi: iscsi_tcp: restrict to TCP sockets John Fastabend (1): bpf, sockmap: Use stricter sk state checks in sk_lookup_assign drivers/scsi/iscsi_tcp.c | 5 +++++ include/linux/skmsg.h | 12 ++++++++++++ net/core/filter.c | 6 ++++-- net/core/sock_map.c | 12 ------------ 4 files changed, 21 insertions(+), 14 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/2] mm: memcg: don't periodically flush stats when memcg is disabled
by Chen Ridong 30 Oct '24

30 Oct '24

mm: memcg: don't periodically flush stats when memcg is disabled Shakeel Butt (1): mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats T.J. Mercier (1): mm: memcg: don't periodically flush stats when memcg is disabled mm/memcontrol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] mm: memcg: don't periodically flush stats when memcg is disabled
by Chen Ridong 30 Oct '24

30 Oct '24

From: "T.J. Mercier" <tjmercier(a)google.com> mainline inclusion from mainline-v6.9-rc1 commit 13ef7424577ff9b663aeaa4fda67e186d9856df3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0CT3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- The root memcg is onlined even when memcg is disabled. When it's onlined a 2 second periodic stat flush is started, but no stat flushing is required when memcg is disabled because there can be no child memcgs. Most calls to flush memcg stats are avoided when memcg is disabled as a result of the mem_cgroup_disabled check added in 7d7ef0a4686a ("mm: memcg: restore subtree stats flushing"), but the periodic flushing started in mem_cgroup_css_online is not. Skip it. Link: https://lkml.kernel.org/r/20240126211927.1171338-1-tjmercier@google.com Fixes: aa48e47e3906 ("memcg: infrastructure to flush memcg stats") Signed-off-by: T.J. Mercier <tjmercier(a)google.com> Acked-by: Shakeel Butt <shakeelb(a)google.com> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Acked-by: Chris Li <chrisl(a)kernel.org> Reported-by: Minchan Kim <minchan(a)google.com> Reviewed-by: Yosry Ahmed <yosryahmed(a)google.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Michal Koutn <mkoutny(a)suse.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/memcontrol.c [context can not be matched] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index aefaa33147b1..3e928581ab47 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6581,7 +6581,7 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css) refcount_set(&memcg->id.ref, 1); css_get(css); - if (unlikely(mem_cgroup_is_root(memcg))) + if (unlikely(mem_cgroup_is_root(memcg)) && !mem_cgroup_disabled()) queue_delayed_work(system_unbound_wq, &stats_flush_dwork, 2UL*HZ); return 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] mm: memcg: don't periodically flush stats when memcg is disabled
by Chen Ridong 30 Oct '24

30 Oct '24

From: "T.J. Mercier" <tjmercier(a)google.com> mainline inclusion from mainline-v6.9-rc1 commit 13ef7424577ff9b663aeaa4fda67e186d9856df3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0CT3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- The root memcg is onlined even when memcg is disabled. When it's onlined a 2 second periodic stat flush is started, but no stat flushing is required when memcg is disabled because there can be no child memcgs. Most calls to flush memcg stats are avoided when memcg is disabled as a result of the mem_cgroup_disabled check added in 7d7ef0a4686a ("mm: memcg: restore subtree stats flushing"), but the periodic flushing started in mem_cgroup_css_online is not. Skip it. Link: https://lkml.kernel.org/r/20240126211927.1171338-1-tjmercier@google.com Fixes: aa48e47e3906 ("memcg: infrastructure to flush memcg stats") Signed-off-by: T.J. Mercier <tjmercier(a)google.com> Acked-by: Shakeel Butt <shakeelb(a)google.com> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Acked-by: Chris Li <chrisl(a)kernel.org> Reported-by: Minchan Kim <minchan(a)google.com> Reviewed-by: Yosry Ahmed <yosryahmed(a)google.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Michal Koutn <mkoutny(a)suse.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/memcontrol.c [context can not be matched] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- mm/memcontrol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index aefaa33147b1..3e928581ab47 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6581,7 +6581,7 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css) refcount_set(&memcg->id.ref, 1); css_get(css); - if (unlikely(mem_cgroup_is_root(memcg))) + if (unlikely(mem_cgroup_is_root(memcg)) && !mem_cgroup_disabled()) queue_delayed_work(system_unbound_wq, &stats_flush_dwork, 2UL*HZ); return 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] crypto: xor - fix template benchmarking
by Chen Ridong 30 Oct '24

30 Oct '24

crypto: xor - fix template benchmarking Bhaskar Chowdhury (1): crypto: xor - Fix typo of optimization Helge Deller (1): crypto: xor - fix template benchmarking crypto/xor.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] crypto: xor - fix template benchmarking
by Chen Ridong 30 Oct '24

30 Oct '24

crypto: xor - fix template benchmarking Bhaskar Chowdhury (1): crypto: xor - Fix typo of optimization Helge Deller (1): crypto: xor - fix template benchmarking crypto/xor.c | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] add vdpa support for x86 and enable vdpa migration.
by Jiang Dongxu 30 Oct '24

30 Oct '24

From: jiangdongxu <jiangdongxu1(a)huawei.com> Christoph Hellwig (1): virtio_blk: remove the broken zone revalidation support jiangdongxu (1): vdpa: add support for x86 and open vdpa migration build config arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 5 +++-- drivers/block/virtio_blk.c | 26 -------------------------- 3 files changed, 4 insertions(+), 29 deletions(-) -- 2.27.0

2 3

[openeuler:OLK-6.6 3971/15883] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3976:43: warning: ', rx power: ' directive output may be truncated writing 12 bytes into a region of size between 1 and 512
by kernel test robot 30 Oct '24

30 Oct '24

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 89f3b5ff06122cbf06bad6c710c9dab575deff33 commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [3971/15883] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: x86_64-buildonly-randconfig-002-20241030 (https://download.01.org/0day-ci/archive/20241030/202410301153.q4SlheqM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241030/202410301153.q4SlheqM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410301153.q4SlheqM-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1061:5: warning: no previous prototype for 'hinic_msg_to_mgmt_no_ack' [-Wmissing-prototypes] 1061 | int hinic_msg_to_mgmt_no_ack(void *hwdev, enum hinic_mod_type mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1978:5: warning: no previous prototype for 'comm_pf_mbox_handler' [-Wmissing-prototypes] 1978 | int comm_pf_mbox_handler(void *handle, u16 vf_id, u8 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2749:5: warning: no previous prototype for 'hinic_ppf_ht_gpa_init' [-Wmissing-prototypes] 2749 | int hinic_ppf_ht_gpa_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2795:6: warning: no previous prototype for 'hinic_ppf_ht_gpa_deinit' [-Wmissing-prototypes] 2795 | void hinic_ppf_ht_gpa_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2872:5: warning: no previous prototype for 'mqm_eqm_try_alloc_mem' [-Wmissing-prototypes] 2872 | int mqm_eqm_try_alloc_mem(struct hinic_hwdev *hwdev, u32 page_size, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2909:5: warning: no previous prototype for 'mqm_eqm_alloc_page_mem' [-Wmissing-prototypes] 2909 | int mqm_eqm_alloc_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2934:6: warning: no previous prototype for 'mqm_eqm_free_page_mem' [-Wmissing-prototypes] 2934 | void mqm_eqm_free_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2950:5: warning: no previous prototype for 'mqm_eqm_set_cfg_2_hw' [-Wmissing-prototypes] 2950 | int mqm_eqm_set_cfg_2_hw(struct hinic_hwdev *hwdev, u32 valid) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2975:5: warning: no previous prototype for 'mqm_eqm_set_page_2_hw' [-Wmissing-prototypes] 2975 | int mqm_eqm_set_page_2_hw(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3053:5: warning: no previous prototype for 'mqm_eqm_init' [-Wmissing-prototypes] 3053 | int mqm_eqm_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3116:6: warning: no previous prototype for 'mqm_eqm_deinit' [-Wmissing-prototypes] 3116 | void mqm_eqm_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c: In function 'port_sfp_info_event': drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3719:13: warning: the comparison will always evaluate as 'true' for the address of 'rt_cmd' will never be NULL [-Waddress] 3719 | if (!chip_node->rt_cmd) | ^ In file included from drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:28: drivers/net/ethernet/huawei/hinic/hinic_hw.h:319:39: note: 'rt_cmd' declared here 319 | struct hinic_port_routine_cmd rt_cmd[HINIC_MAX_PORT_ID]; | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c: In function 'port_sfp_abs_event': drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3748:13: warning: the comparison will always evaluate as 'true' for the address of 'rt_cmd' will never be NULL [-Waddress] 3748 | if (!chip_node->rt_cmd) | ^ drivers/net/ethernet/huawei/hinic/hinic_hw.h:319:39: note: 'rt_cmd' declared here 319 | struct hinic_port_routine_cmd rt_cmd[HINIC_MAX_PORT_ID]; | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4581:5: warning: no previous prototype for '_set_led_status' [-Wmissing-prototypes] 4581 | int _set_led_status(struct hinic_hwdev *hwdev, u8 port, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4667:5: warning: no previous prototype for 'hinic_get_phy_init_status' [-Wmissing-prototypes] 4667 | int hinic_get_phy_init_status(void *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c: In function '__print_cable_info.constprop': drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3959:23: warning: 'snprintf' argument 4 overlaps destination object 'tmp_str' [-Wrestrict] 3959 | err = snprintf(tmp_str, sizeof(tmp_str), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3960 | "%s, %s, Temperature: %u", tmp_str, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3961 | info->sfp_type ? "SFP" : "QSFP", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3962 | info->cable_temp); | ~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3914:14: note: destination object referenced by 'restrict'-qualified argument 1 was declared here 3914 | char tmp_str[CAP_INFO_MAC_LEN] = {0}; | ^~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3976:43: warning: ', rx power: ' directive output may be truncated writing 12 bytes into a region of size between 1 and 512 [-Wformat-truncation=] 3976 | "%s, rx power: %uuw %uuW %uuW %uuW", | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3975:31: note: 'snprintf' output between 28 and 575 bytes into a destination of size 512 3975 | err = snprintf(tmp_str, sizeof(tmp_str), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3976 | "%s, rx power: %uuw %uuW %uuW %uuW", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3977 | tmp_str, info->power[0], info->power[1], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3978 | info->power[2], info->power[3]); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3975:31: warning: 'snprintf' argument 4 overlaps destination object 'tmp_str' [-Wrestrict] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3914:14: note: destination object referenced by 'restrict'-qualified argument 1 was declared here 3914 | char tmp_str[CAP_INFO_MAC_LEN] = {0}; | ^~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3972:43: warning: ', rx power: ' directive output may be truncated writing 12 bytes into a region of size between 1 and 512 [-Wformat-truncation=] 3972 | "%s, rx power: %uuW, tx power: %uuW", | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3971:31: note: 'snprintf' output between 31 and 560 bytes into a destination of size 512 3971 | err = snprintf(tmp_str, sizeof(tmp_str), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3972 | "%s, rx power: %uuW, tx power: %uuW", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3973 | tmp_str, info->power[0], info->power[1]); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3971:31: warning: 'snprintf' argument 4 overlaps destination object 'tmp_str' [-Wrestrict] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3914:14: note: destination object referenced by 'restrict'-qualified argument 1 was declared here 3914 | char tmp_str[CAP_INFO_MAC_LEN] = {0}; | ^~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_main.c:182:5: warning: no previous prototype for 'hinic_netdev_event' [-Wmissing-prototypes] 182 | int hinic_netdev_event(struct notifier_block *notifier, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_main.c:3058:6: warning: no previous prototype for 'nic_event' [-Wmissing-prototypes] 3058 | void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, | ^~~~~~~~~ vim +3976 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c 3910 3911 static void __print_cable_info(struct hinic_hwdev *hwdev, 3912 struct hinic_link_info *info) 3913 { 3914 char tmp_str[CAP_INFO_MAC_LEN] = {0}; 3915 char tmp_vendor[VENDOR_MAX_LEN] = {0}; 3916 char *port_type = "Unknown port type"; 3917 int i; 3918 int err = 0; 3919 3920 if (info->cable_absent) { 3921 sdk_info(hwdev->dev_hdl, "Cable unpresent\n"); 3922 return; 3923 } 3924 3925 if (info->port_type < LINK_PORT_MAX_TYPE) 3926 port_type = __hw_to_char_port_type[info->port_type]; 3927 else 3928 sdk_info(hwdev->dev_hdl, "Unknown port type: %u\n", 3929 info->port_type); 3930 if (info->port_type == LINK_PORT_FIBRE) { 3931 if (info->port_sub_type == FIBRE_SUBTYPE_SR) 3932 port_type = "Fibre-SR"; 3933 else if (info->port_sub_type == FIBRE_SUBTYPE_LR) 3934 port_type = "Fibre-LR"; 3935 } 3936 3937 for (i = sizeof(info->vendor_name) - 1; i >= 0; i--) { 3938 if (info->vendor_name[i] == ' ') 3939 info->vendor_name[i] = '\0'; 3940 else 3941 break; 3942 } 3943 3944 memcpy(tmp_vendor, info->vendor_name, 3945 sizeof(info->vendor_name)); 3946 err = snprintf(tmp_str, sizeof(tmp_str), 3947 "Vendor: %s, %s, length: %um, max_speed: %uGbps", 3948 tmp_vendor, port_type, info->cable_length, 3949 info->cable_max_speed); 3950 if (err <= 0 || err >= CAP_INFO_MAC_LEN) { 3951 sdk_err(hwdev->dev_hdl, 3952 "Failed snprintf cable vendor info, function return(%d) and dest_len(%d)\n", 3953 err, CAP_INFO_MAC_LEN); 3954 return; 3955 } 3956 3957 if (info->port_type == LINK_PORT_FIBRE || 3958 info->port_type == LINK_PORT_AOC) { 3959 err = snprintf(tmp_str, sizeof(tmp_str), 3960 "%s, %s, Temperature: %u", tmp_str, 3961 info->sfp_type ? "SFP" : "QSFP", 3962 info->cable_temp); 3963 if (err <= 0 || err >= CAP_INFO_MAC_LEN) { 3964 sdk_err(hwdev->dev_hdl, 3965 "Failed snprintf cable Temp, function return(%d) and dest_len(%d)\n", 3966 err, CAP_INFO_MAC_LEN); 3967 return; 3968 } 3969 3970 if (info->sfp_type) { 3971 err = snprintf(tmp_str, sizeof(tmp_str), 3972 "%s, rx power: %uuW, tx power: %uuW", 3973 tmp_str, info->power[0], info->power[1]); 3974 } else { 3975 err = snprintf(tmp_str, sizeof(tmp_str), > 3976 "%s, rx power: %uuw %uuW %uuW %uuW", 3977 tmp_str, info->power[0], info->power[1], 3978 info->power[2], info->power[3]); 3979 } 3980 if (err <= 0 || err >= CAP_INFO_MAC_LEN) { 3981 sdk_err(hwdev->dev_hdl, 3982 "Failed snprintf power info, function return(%d) and dest_len(%d)\n", 3983 err, CAP_INFO_MAC_LEN); 3984 return; 3985 } 3986 } 3987 3988 sdk_info(hwdev->dev_hdl, "Cable information: %s\n", 3989 tmp_str); 3990 } 3991 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ocfs2: reserve space for inline xattr before attaching reflink tree
by Yi Yang 30 Oct '24

30 Oct '24

From: Gautham Ananthakrishna <gautham.ananthakrishna(a)oracle.com> mainline inclusion from mainline-v6.12-rc1 commit 5ca60b86f57a4d9648f68418a725b3a7de2816b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA7 CVE: CVE-2024-49958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. Upon troubleshooting, the fsck -fn output showed the below corruption [EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record, but fsck believes the largest valid value is 227. Clamp the next record value? n The stat output from the debugfs.ocfs2 showed the following corruption where the "Next Free Rec:" had overshot the "Count:" in the root metadata block. Inode: 33080590 Mode: 0640 Generation: 2619713622 (0x9c25a856) FS Generation: 904309833 (0x35e6ac49) CRC32: 00000000 ECC: 0000 Type: Regular Attr: 0x0 Flags: Valid Dynamic Features: (0x16) HasXattr InlineXattr Refcounted Extended Attributes Block: 0 Extended Attributes Inline Size: 256 User: 0 (root) Group: 0 (root) Size: 281320357888 Links: 1 Clusters: 141738 ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024 atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024 mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024 dtime: 0x0 -- Wed Dec 31 17:00:00 1969 Refcount Block: 2777346 Last Extblk: 2886943 Orphan Slot: 0 Sub Alloc Slot: 0 Sub Alloc Bit: 14 Tree Depth: 1 Count: 227 Next Free Rec: 230 ## Offset Clusters Block# 0 0 2310 2776351 1 2310 2139 2777375 2 4449 1221 2778399 3 5670 731 2779423 4 6401 566 2780447 ....... .... ....... ....... .... ....... The issue was in the reflink workfow while reserving space for inline xattr. The problematic function is ocfs2_reflink_xattr_inline(). By the time this function is called the reflink tree is already recreated at the destination inode from the source inode. At this point, this function reserves space for inline xattrs at the destination inode without even checking if there is space at the root metadata block. It simply reduces the l_count from 243 to 227 thereby making space of 256 bytes for inline xattr whereas the inode already has extents beyond this index (in this case up to 230), thereby causing corruption. The fix for this is to reserve space for inline metadata at the destination inode before the reflink tree gets recreated. The customer has verified the fix. Link: https://lkml.kernel.org/r/20240918063844.1830332-1-gautham.ananthakrishna@o… Fixes: ef962df057aa ("ocfs2: xattr: fix inlined xattr reflink") Signed-off-by: Gautham Ananthakrishna <gautham.ananthakrishna(a)oracle.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- fs/ocfs2/refcounttree.c | 26 ++++++++++++++++++++++++-- fs/ocfs2/xattr.c | 11 +---------- 2 files changed, 25 insertions(+), 12 deletions(-) diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c index fc197e599e8c..9da1c9ca0cec 100644 --- a/fs/ocfs2/refcounttree.c +++ b/fs/ocfs2/refcounttree.c @@ -35,6 +35,7 @@ #include "namei.h" #include "ocfs2_trace.h" #include "file.h" +#include "symlink.h" #include <linux/bio.h> #include <linux/blkdev.h> @@ -4192,8 +4193,9 @@ static int __ocfs2_reflink(struct dentry *old_dentry, int ret; struct inode *inode = d_inode(old_dentry); struct buffer_head *new_bh = NULL; + struct ocfs2_inode_info *oi = OCFS2_I(inode); - if (OCFS2_I(inode)->ip_flags & OCFS2_INODE_SYSTEM_FILE) { + if (oi->ip_flags & OCFS2_INODE_SYSTEM_FILE) { ret = -EINVAL; mlog_errno(ret); goto out; @@ -4219,6 +4221,26 @@ static int __ocfs2_reflink(struct dentry *old_dentry, goto out_unlock; } + if ((oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) && + (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL)) { + /* + * Adjust extent record count to reserve space for extended attribute. + * Inline data count had been adjusted in ocfs2_duplicate_inline_data(). + */ + struct ocfs2_inode_info *new_oi = OCFS2_I(new_inode); + + if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) && + !(ocfs2_inode_is_fast_symlink(new_inode))) { + struct ocfs2_dinode *new_di = (struct ocfs2_dinode *)new_bh->b_data; + struct ocfs2_dinode *old_di = (struct ocfs2_dinode *)old_bh->b_data; + struct ocfs2_extent_list *el = &new_di->id2.i_list; + int inline_size = le16_to_cpu(old_di->i_xattr_inline_size); + + le16_add_cpu(&el->l_count, -(inline_size / + sizeof(struct ocfs2_extent_rec))); + } + } + ret = ocfs2_create_reflink_node(inode, old_bh, new_inode, new_bh, preserve); if (ret) { @@ -4226,7 +4248,7 @@ static int __ocfs2_reflink(struct dentry *old_dentry, goto inode_unlock; } - if (OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_XATTR_FL) { + if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) { ret = ocfs2_reflink_xattrs(inode, old_bh, new_inode, new_bh, preserve); diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index c146e12a8601..58361f7b20e3 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -6525,16 +6525,7 @@ static int ocfs2_reflink_xattr_inline(struct ocfs2_xattr_reflink *args) } new_oi = OCFS2_I(args->new_inode); - /* - * Adjust extent record count to reserve space for extended attribute. - * Inline data count had been adjusted in ocfs2_duplicate_inline_data(). - */ - if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) && - !(ocfs2_inode_is_fast_symlink(args->new_inode))) { - struct ocfs2_extent_list *el = &new_di->id2.i_list; - le16_add_cpu(&el->l_count, -(inline_size / - sizeof(struct ocfs2_extent_rec))); - } + spin_lock(&new_oi->ip_lock); new_oi->ip_dyn_features |= OCFS2_HAS_XATTR_FL | OCFS2_INLINE_XATTR_FL; new_di->i_dyn_features = cpu_to_le16(new_oi->ip_dyn_features); -- 2.25.1

2 1

[PATCH OLK-5.10] ocfs2: reserve space for inline xattr before attaching reflink tree
by Yi Yang 30 Oct '24

30 Oct '24

From: Gautham Ananthakrishna <gautham.ananthakrishna(a)oracle.com> stable inclusion from stable-v5.10.227 commit aac31d654a0a31cb0d2fa36ae694f4e164a52707 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA7 CVE: CVE-2024-49958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ca60b86f57a4d9648f68418a725b3a7de2816b0 upstream. One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. Upon troubleshooting, the fsck -fn output showed the below corruption [EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record, but fsck believes the largest valid value is 227. Clamp the next record value? n The stat output from the debugfs.ocfs2 showed the following corruption where the "Next Free Rec:" had overshot the "Count:" in the root metadata block. Inode: 33080590 Mode: 0640 Generation: 2619713622 (0x9c25a856) FS Generation: 904309833 (0x35e6ac49) CRC32: 00000000 ECC: 0000 Type: Regular Attr: 0x0 Flags: Valid Dynamic Features: (0x16) HasXattr InlineXattr Refcounted Extended Attributes Block: 0 Extended Attributes Inline Size: 256 User: 0 (root) Group: 0 (root) Size: 281320357888 Links: 1 Clusters: 141738 ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024 atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024 mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024 dtime: 0x0 -- Wed Dec 31 17:00:00 1969 Refcount Block: 2777346 Last Extblk: 2886943 Orphan Slot: 0 Sub Alloc Slot: 0 Sub Alloc Bit: 14 Tree Depth: 1 Count: 227 Next Free Rec: 230 ## Offset Clusters Block# 0 0 2310 2776351 1 2310 2139 2777375 2 4449 1221 2778399 3 5670 731 2779423 4 6401 566 2780447 ....... .... ....... ....... .... ....... The issue was in the reflink workfow while reserving space for inline xattr. The problematic function is ocfs2_reflink_xattr_inline(). By the time this function is called the reflink tree is already recreated at the destination inode from the source inode. At this point, this function reserves space for inline xattrs at the destination inode without even checking if there is space at the root metadata block. It simply reduces the l_count from 243 to 227 thereby making space of 256 bytes for inline xattr whereas the inode already has extents beyond this index (in this case up to 230), thereby causing corruption. The fix for this is to reserve space for inline metadata at the destination inode before the reflink tree gets recreated. The customer has verified the fix. Link: https://lkml.kernel.org/r/20240918063844.1830332-1-gautham.ananthakrishna@o… Fixes: ef962df057aa ("ocfs2: xattr: fix inlined xattr reflink") Signed-off-by: Gautham Ananthakrishna <gautham.ananthakrishna(a)oracle.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- fs/ocfs2/refcounttree.c | 26 ++++++++++++++++++++++++-- fs/ocfs2/xattr.c | 11 +---------- 2 files changed, 25 insertions(+), 12 deletions(-) diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c index 3b397fa9c9e8..85d25c211c87 100644 --- a/fs/ocfs2/refcounttree.c +++ b/fs/ocfs2/refcounttree.c @@ -27,6 +27,7 @@ #include "namei.h" #include "ocfs2_trace.h" #include "file.h" +#include "symlink.h" #include <linux/bio.h> #include <linux/blkdev.h> @@ -4184,8 +4185,9 @@ static int __ocfs2_reflink(struct dentry *old_dentry, int ret; struct inode *inode = d_inode(old_dentry); struct buffer_head *new_bh = NULL; + struct ocfs2_inode_info *oi = OCFS2_I(inode); - if (OCFS2_I(inode)->ip_flags & OCFS2_INODE_SYSTEM_FILE) { + if (oi->ip_flags & OCFS2_INODE_SYSTEM_FILE) { ret = -EINVAL; mlog_errno(ret); goto out; @@ -4211,6 +4213,26 @@ static int __ocfs2_reflink(struct dentry *old_dentry, goto out_unlock; } + if ((oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) && + (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL)) { + /* + * Adjust extent record count to reserve space for extended attribute. + * Inline data count had been adjusted in ocfs2_duplicate_inline_data(). + */ + struct ocfs2_inode_info *new_oi = OCFS2_I(new_inode); + + if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) && + !(ocfs2_inode_is_fast_symlink(new_inode))) { + struct ocfs2_dinode *new_di = (struct ocfs2_dinode *)new_bh->b_data; + struct ocfs2_dinode *old_di = (struct ocfs2_dinode *)old_bh->b_data; + struct ocfs2_extent_list *el = &new_di->id2.i_list; + int inline_size = le16_to_cpu(old_di->i_xattr_inline_size); + + le16_add_cpu(&el->l_count, -(inline_size / + sizeof(struct ocfs2_extent_rec))); + } + } + ret = ocfs2_create_reflink_node(inode, old_bh, new_inode, new_bh, preserve); if (ret) { @@ -4218,7 +4240,7 @@ static int __ocfs2_reflink(struct dentry *old_dentry, goto inode_unlock; } - if (OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_XATTR_FL) { + if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) { ret = ocfs2_reflink_xattrs(inode, old_bh, new_inode, new_bh, preserve); diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 977a739d5448..00ede36aeec9 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -6526,16 +6526,7 @@ static int ocfs2_reflink_xattr_inline(struct ocfs2_xattr_reflink *args) } new_oi = OCFS2_I(args->new_inode); - /* - * Adjust extent record count to reserve space for extended attribute. - * Inline data count had been adjusted in ocfs2_duplicate_inline_data(). - */ - if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) && - !(ocfs2_inode_is_fast_symlink(args->new_inode))) { - struct ocfs2_extent_list *el = &new_di->id2.i_list; - le16_add_cpu(&el->l_count, -(inline_size / - sizeof(struct ocfs2_extent_rec))); - } + spin_lock(&new_oi->ip_lock); new_oi->ip_dyn_features |= OCFS2_HAS_XATTR_FL | OCFS2_INLINE_XATTR_FL; new_di->i_dyn_features = cpu_to_le16(new_oi->ip_dyn_features); -- 2.25.1

2 1

[PATCH OLK-6.6] security/keys: fix slab-out-of-bounds in key_task_permission
by Yi Yang 30 Oct '24

30 Oct '24

From: Chen Ridong <chenridong(a)huawei.com> maillist inclusion category: Bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAU173 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/comm… ---------------------------------------------------------------------- KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 security/keys/permission.c:54 Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362 CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15 Call Trace: __dump_stack lib/dump_stack.c:82 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:123 print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 kasan_report+0x3a/0x50 mm/kasan/report.c:585 __kuid_val include/linux/uidgid.h:36 [inline] uid_eq include/linux/uidgid.h:63 [inline] key_task_permission+0x394/0x410 security/keys/permission.c:54 search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793 This issue was also reported by syzbot. It can be reproduced by following these steps(more details [1]): 1. Obtain more than 32 inputs that have similar hashes, which ends with the pattern '0xxxxxxxe6'. 2. Reboot and add the keys obtained in step 1. The reproducer demonstrates how this issue happened: 1. In the search_nested_keyrings function, when it iterates through the slots in a node(below tag ascend_to_node), if the slot pointer is meta and node->back_pointer != NULL(it means a root), it will proceed to descend_to_node. However, there is an exception. If node is the root, and one of the slots points to a shortcut, it will be treated as a keyring. 2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function. However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as ASSOC_ARRAY_PTR_SUBTYPE_MASK. 3. When 32 keys with the similar hashes are added to the tree, the ROOT has keys with hashes that are not similar (e.g. slot 0) and it splits NODE A without using a shortcut. When NODE A is filled with keys that all hashes are xxe6, the keys are similar, NODE A will split with a shortcut. Finally, it forms the tree as shown below, where slot 6 points to a shortcut. NODE A +------>+---+ ROOT | | 0 | xxe6 +---+ | +---+ xxxx | 0 | shortcut : : xxe6 +---+ | +---+ xxe6 : : | | | xxe6 +---+ | +---+ | 6 |---+ : : xxe6 +---+ +---+ xxe6 : : | f | xxe6 +---+ +---+ xxe6 | f | +---+ 4. As mentioned above, If a slot(slot 6) of the root points to a shortcut, it may be mistakenly transferred to a key*, leading to a read out-of-bounds read. To fix this issue, one should jump to descend_to_node if the ptr is a shortcut, regardless of whether the node is root or not. [1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@h… [jarkko: tweaked the commit message a bit to have an appropriate closes tag.] Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring") Reported-by: syzbot+5b415c07907a2990d1a3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000cbb7860611f61147@google.com/T/ Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/keys/keyring.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/security/keys/keyring.c b/security/keys/keyring.c index 4448758f643a..f331725d5a37 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring, for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) { ptr = READ_ONCE(node->slots[slot]); - if (assoc_array_ptr_is_meta(ptr) && node->back_pointer) - goto descend_to_node; + if (assoc_array_ptr_is_meta(ptr)) { + if (node->back_pointer || + assoc_array_ptr_is_shortcut(ptr)) + goto descend_to_node; + } if (!keyring_ptr_is_keyring(ptr)) continue; -- 2.25.1

2 1

[PATCH OLK-5.10] security/keys: fix slab-out-of-bounds in key_task_permission
by Yi Yang 30 Oct '24

30 Oct '24

From: Chen Ridong <chenridong(a)huawei.com> maillist inclusion category: Bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAU173 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/comm… ---------------------------------------------------------------------- KASAN reports an out of bounds read: BUG: KASAN: slab-out-of-bounds in __kuid_val include/linux/uidgid.h:36 BUG: KASAN: slab-out-of-bounds in uid_eq include/linux/uidgid.h:63 [inline] BUG: KASAN: slab-out-of-bounds in key_task_permission+0x394/0x410 security/keys/permission.c:54 Read of size 4 at addr ffff88813c3ab618 by task stress-ng/4362 CPU: 2 PID: 4362 Comm: stress-ng Not tainted 5.10.0-14930-gafbffd6c3ede #15 Call Trace: __dump_stack lib/dump_stack.c:82 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:123 print_address_description.constprop.0+0x19/0x170 mm/kasan/report.c:400 __kasan_report.cold+0x6c/0x84 mm/kasan/report.c:560 kasan_report+0x3a/0x50 mm/kasan/report.c:585 __kuid_val include/linux/uidgid.h:36 [inline] uid_eq include/linux/uidgid.h:63 [inline] key_task_permission+0x394/0x410 security/keys/permission.c:54 search_nested_keyrings+0x90e/0xe90 security/keys/keyring.c:793 This issue was also reported by syzbot. It can be reproduced by following these steps(more details [1]): 1. Obtain more than 32 inputs that have similar hashes, which ends with the pattern '0xxxxxxxe6'. 2. Reboot and add the keys obtained in step 1. The reproducer demonstrates how this issue happened: 1. In the search_nested_keyrings function, when it iterates through the slots in a node(below tag ascend_to_node), if the slot pointer is meta and node->back_pointer != NULL(it means a root), it will proceed to descend_to_node. However, there is an exception. If node is the root, and one of the slots points to a shortcut, it will be treated as a keyring. 2. Whether the ptr is keyring decided by keyring_ptr_is_keyring function. However, KEYRING_PTR_SUBTYPE is 0x2UL, the same as ASSOC_ARRAY_PTR_SUBTYPE_MASK. 3. When 32 keys with the similar hashes are added to the tree, the ROOT has keys with hashes that are not similar (e.g. slot 0) and it splits NODE A without using a shortcut. When NODE A is filled with keys that all hashes are xxe6, the keys are similar, NODE A will split with a shortcut. Finally, it forms the tree as shown below, where slot 6 points to a shortcut. NODE A +------>+---+ ROOT | | 0 | xxe6 +---+ | +---+ xxxx | 0 | shortcut : : xxe6 +---+ | +---+ xxe6 : : | | | xxe6 +---+ | +---+ | 6 |---+ : : xxe6 +---+ +---+ xxe6 : : | f | xxe6 +---+ +---+ xxe6 | f | +---+ 4. As mentioned above, If a slot(slot 6) of the root points to a shortcut, it may be mistakenly transferred to a key*, leading to a read out-of-bounds read. To fix this issue, one should jump to descend_to_node if the ptr is a shortcut, regardless of whether the node is root or not. [1] https://lore.kernel.org/linux-kernel/1cfa878e-8c7b-4570-8606-21daf5e13ce7@h… [jarkko: tweaked the commit message a bit to have an appropriate closes tag.] Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring") Reported-by: syzbot+5b415c07907a2990d1a3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000cbb7860611f61147@google.com/T/ Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/keys/keyring.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/security/keys/keyring.c b/security/keys/keyring.c index 14abfe765b7e..9f0fc81a3a7b 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring, for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) { ptr = READ_ONCE(node->slots[slot]); - if (assoc_array_ptr_is_meta(ptr) && node->back_pointer) - goto descend_to_node; + if (assoc_array_ptr_is_meta(ptr)) { + if (node->back_pointer || + assoc_array_ptr_is_shortcut(ptr)) + goto descend_to_node; + } if (!keyring_ptr_is_keyring(ptr)) continue; -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
by Zheng Qixing 30 Oct '24

30 Oct '24

From: Martin Wilck <mwilck(a)suse.com> stable inclusion from stable-v6.6.54 commit 568c7c4c77eee6df7677bb861b7cee7398a3255d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPK3 CVE: CVE-2024-47682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- commit f81eaf08385ddd474a2f41595a7757502870c0eb upstream. Ff the device returns page 0xb1 with length 8 (happens with qemu v2.x, for example), sd_read_block_characteristics() may attempt an out-of-bounds memory access when accessing the zoned field at offset 8. Fixes: 7fb019c46eee ("scsi: sd: Switch to using scsi_device VPD pages") Cc: stable(a)vger.kernel.org Signed-off-by: Martin Wilck <mwilck(a)suse.com> Link: https://lore.kernel.org/r/20240912134308.282824-1-mwilck@suse.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/sd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 9ebf64a91586..11245bf46f85 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -3118,7 +3118,7 @@ static void sd_read_block_characteristics(struct scsi_disk *sdkp) rcu_read_lock(); vpd = rcu_dereference(sdkp->device->vpd_pgb1); - if (!vpd || vpd->len < 8) { + if (!vpd || vpd->len <= 8) { rcu_read_unlock(); return; } -- 2.39.2

2 1

[openEuler-22.03-LTS-SP1] ocfs2: reserve space for inline xattr before attaching reflink tree
by Yi Yang 30 Oct '24

30 Oct '24

From: Gautham Ananthakrishna <gautham.ananthakrishna(a)oracle.com> stable inclusion from stable-v5.10.227 commit aac31d654a0a31cb0d2fa36ae694f4e164a52707 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA7 CVE: CVE-2024-49958 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5ca60b86f57a4d9648f68418a725b3a7de2816b0 upstream. One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. Upon troubleshooting, the fsck -fn output showed the below corruption [EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record, but fsck believes the largest valid value is 227. Clamp the next record value? n The stat output from the debugfs.ocfs2 showed the following corruption where the "Next Free Rec:" had overshot the "Count:" in the root metadata block. Inode: 33080590 Mode: 0640 Generation: 2619713622 (0x9c25a856) FS Generation: 904309833 (0x35e6ac49) CRC32: 00000000 ECC: 0000 Type: Regular Attr: 0x0 Flags: Valid Dynamic Features: (0x16) HasXattr InlineXattr Refcounted Extended Attributes Block: 0 Extended Attributes Inline Size: 256 User: 0 (root) Group: 0 (root) Size: 281320357888 Links: 1 Clusters: 141738 ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024 atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024 mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024 dtime: 0x0 -- Wed Dec 31 17:00:00 1969 Refcount Block: 2777346 Last Extblk: 2886943 Orphan Slot: 0 Sub Alloc Slot: 0 Sub Alloc Bit: 14 Tree Depth: 1 Count: 227 Next Free Rec: 230 ## Offset Clusters Block# 0 0 2310 2776351 1 2310 2139 2777375 2 4449 1221 2778399 3 5670 731 2779423 4 6401 566 2780447 ....... .... ....... ....... .... ....... The issue was in the reflink workfow while reserving space for inline xattr. The problematic function is ocfs2_reflink_xattr_inline(). By the time this function is called the reflink tree is already recreated at the destination inode from the source inode. At this point, this function reserves space for inline xattrs at the destination inode without even checking if there is space at the root metadata block. It simply reduces the l_count from 243 to 227 thereby making space of 256 bytes for inline xattr whereas the inode already has extents beyond this index (in this case up to 230), thereby causing corruption. The fix for this is to reserve space for inline metadata at the destination inode before the reflink tree gets recreated. The customer has verified the fix. Link: https://lkml.kernel.org/r/20240918063844.1830332-1-gautham.ananthakrishna@o… Fixes: ef962df057aa ("ocfs2: xattr: fix inlined xattr reflink") Signed-off-by: Gautham Ananthakrishna <gautham.ananthakrishna(a)oracle.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- fs/ocfs2/refcounttree.c | 26 ++++++++++++++++++++++++-- fs/ocfs2/xattr.c | 11 +---------- 2 files changed, 25 insertions(+), 12 deletions(-) diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c index 3b397fa9c9e8..85d25c211c87 100644 --- a/fs/ocfs2/refcounttree.c +++ b/fs/ocfs2/refcounttree.c @@ -27,6 +27,7 @@ #include "namei.h" #include "ocfs2_trace.h" #include "file.h" +#include "symlink.h" #include <linux/bio.h> #include <linux/blkdev.h> @@ -4184,8 +4185,9 @@ static int __ocfs2_reflink(struct dentry *old_dentry, int ret; struct inode *inode = d_inode(old_dentry); struct buffer_head *new_bh = NULL; + struct ocfs2_inode_info *oi = OCFS2_I(inode); - if (OCFS2_I(inode)->ip_flags & OCFS2_INODE_SYSTEM_FILE) { + if (oi->ip_flags & OCFS2_INODE_SYSTEM_FILE) { ret = -EINVAL; mlog_errno(ret); goto out; @@ -4211,6 +4213,26 @@ static int __ocfs2_reflink(struct dentry *old_dentry, goto out_unlock; } + if ((oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) && + (oi->ip_dyn_features & OCFS2_INLINE_XATTR_FL)) { + /* + * Adjust extent record count to reserve space for extended attribute. + * Inline data count had been adjusted in ocfs2_duplicate_inline_data(). + */ + struct ocfs2_inode_info *new_oi = OCFS2_I(new_inode); + + if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) && + !(ocfs2_inode_is_fast_symlink(new_inode))) { + struct ocfs2_dinode *new_di = (struct ocfs2_dinode *)new_bh->b_data; + struct ocfs2_dinode *old_di = (struct ocfs2_dinode *)old_bh->b_data; + struct ocfs2_extent_list *el = &new_di->id2.i_list; + int inline_size = le16_to_cpu(old_di->i_xattr_inline_size); + + le16_add_cpu(&el->l_count, -(inline_size / + sizeof(struct ocfs2_extent_rec))); + } + } + ret = ocfs2_create_reflink_node(inode, old_bh, new_inode, new_bh, preserve); if (ret) { @@ -4218,7 +4240,7 @@ static int __ocfs2_reflink(struct dentry *old_dentry, goto inode_unlock; } - if (OCFS2_I(inode)->ip_dyn_features & OCFS2_HAS_XATTR_FL) { + if (oi->ip_dyn_features & OCFS2_HAS_XATTR_FL) { ret = ocfs2_reflink_xattrs(inode, old_bh, new_inode, new_bh, preserve); diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 495fb5b7a087..42368577786e 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -6526,16 +6526,7 @@ static int ocfs2_reflink_xattr_inline(struct ocfs2_xattr_reflink *args) } new_oi = OCFS2_I(args->new_inode); - /* - * Adjust extent record count to reserve space for extended attribute. - * Inline data count had been adjusted in ocfs2_duplicate_inline_data(). - */ - if (!(new_oi->ip_dyn_features & OCFS2_INLINE_DATA_FL) && - !(ocfs2_inode_is_fast_symlink(args->new_inode))) { - struct ocfs2_extent_list *el = &new_di->id2.i_list; - le16_add_cpu(&el->l_count, -(inline_size / - sizeof(struct ocfs2_extent_rec))); - } + spin_lock(&new_oi->ip_lock); new_oi->ip_dyn_features |= OCFS2_HAS_XATTR_FL | OCFS2_INLINE_XATTR_FL; new_di->i_dyn_features = cpu_to_le16(new_oi->ip_dyn_features); -- 2.25.1

1 0

[PATCH OLK-5.10] block: fix potential invalid pointer dereference in blk_add_partition
by Zheng Qixing 30 Oct '24

30 Oct '24

From: Riyan Dhiman <riyandhiman14(a)gmail.com> stable inclusion from stable-v5.10.227 commit 4bc4272e2506941c3f3d4fb8b0c659ee814dcf6f category: bugifx bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJH CVE: CVE-2024-47705 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26e197b7f9240a4ac301dd0ad520c0c697c2ea7d ] The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer. This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls. Fixes: b72053072c0b (block: allow partitions on host aware zone devices) Signed-off-by: Riyan Dhiman <riyandhiman14(a)gmail.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240911132954.5874-1-riyandhiman14@gmail.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: block/partitions/core.c [Context inconsistency.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/partitions/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/partitions/core.c b/block/partitions/core.c index 8e0bddf0fa51..7e1fd93a5634 100644 --- a/block/partitions/core.c +++ b/block/partitions/core.c @@ -705,9 +705,11 @@ static bool blk_add_partition(struct gendisk *disk, struct block_device *bdev, part = add_partition(disk, p, from, size, state->parts[p].flags, &state->parts[p].info); - if (IS_ERR(part) && PTR_ERR(part) != -ENXIO) { - printk(KERN_ERR " %s: p%d could not be added: %ld\n", - disk->disk_name, p, -PTR_ERR(part)); + if (IS_ERR(part)) { + if (PTR_ERR(part) != -ENXIO) { + printk(KERN_ERR " %s: p%d could not be added: %ld\n", + disk->disk_name, p, -PTR_ERR(part)); + } return true; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] block: fix potential invalid pointer dereference in blk_add_partition
by Zheng Qixing 30 Oct '24

30 Oct '24

From: Riyan Dhiman <riyandhiman14(a)gmail.com> stable inclusion from stable-v5.10.227 commit 4bc4272e2506941c3f3d4fb8b0c659ee814dcf6f category: bugifx bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJH CVE: CVE-2024-47705 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26e197b7f9240a4ac301dd0ad520c0c697c2ea7d ] The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer. This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls. Fixes: b72053072c0b (block: allow partitions on host aware zone devices) Signed-off-by: Riyan Dhiman <riyandhiman14(a)gmail.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20240911132954.5874-1-riyandhiman14@gmail.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: block/partitions/core.c [Context inconsistency.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/partitions/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/partitions/core.c b/block/partitions/core.c index 8e0bddf0fa51..7e1fd93a5634 100644 --- a/block/partitions/core.c +++ b/block/partitions/core.c @@ -705,9 +705,11 @@ static bool blk_add_partition(struct gendisk *disk, struct block_device *bdev, part = add_partition(disk, p, from, size, state->parts[p].flags, &state->parts[p].info); - if (IS_ERR(part) && PTR_ERR(part) != -ENXIO) { - printk(KERN_ERR " %s: p%d could not be added: %ld\n", - disk->disk_name, p, -PTR_ERR(part)); + if (IS_ERR(part)) { + if (PTR_ERR(part) != -ENXIO) { + printk(KERN_ERR " %s: p%d could not be added: %ld\n", + disk->disk_name, p, -PTR_ERR(part)); + } return true; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] nilfs2: fix state management in error path of log writing function
by Chen Ridong 30 Oct '24

30 Oct '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.11-rc7 commit 6576dd6695f2afca3f4954029ac4a64f82ba60ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVUFV CVE: CVE-2024-47669 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- After commit a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") was applied, the log writing function nilfs_segctor_do_construct() was able to issue I/O requests continuously even if user data blocks were split into multiple logs across segments, but two potential flaws were introduced in its error handling. First, if nilfs_segctor_begin_construction() fails while creating the second or subsequent logs, the log writing function returns without calling nilfs_segctor_abort_construction(), so the writeback flag set on pages/folios will remain uncleared. This causes page cache operations to hang waiting for the writeback flag. For example, truncate_inode_pages_final(), which is called via nilfs_evict_inode() when an inode is evicted from memory, will hang. Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. As a result, if the next log write involves checkpoint creation, that's fine, but if a partial log write is performed that does not, inodes with NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files" list, and their data and b-tree blocks may not be written to the device, corrupting the block mapping. Fix these issues by uniformly calling nilfs_segctor_abort_construction() on failure of each step in the loop in nilfs_segctor_do_construct(), having it clean up logs and segment usages according to progress, and correcting the conditions for calling nilfs_redirty_inodes() to ensure that the NILFS_I_COLLECTED flag is cleared. Link: https://lkml.kernel.org/r/20240814101119.4070-1-konishi.ryusuke@gmail.com Fixes: a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- fs/nilfs2/segment.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c index 633809581852..6c48d2b27707 100644 --- a/fs/nilfs2/segment.c +++ b/fs/nilfs2/segment.c @@ -1799,6 +1799,9 @@ static void nilfs_segctor_abort_construction(struct nilfs_sc_info *sci, nilfs_abort_logs(&logs, ret ? : err); list_splice_tail_init(&sci->sc_segbufs, &logs); + if (list_empty(&logs)) + return; /* if the first segment buffer preparation failed */ + nilfs_cancel_segusage(&logs, nilfs->ns_sufile); nilfs_free_incomplete_logs(&logs, nilfs); @@ -2040,7 +2043,7 @@ static int nilfs_segctor_do_construct(struct nilfs_sc_info *sci, int mode) err = nilfs_segctor_begin_construction(sci, nilfs); if (unlikely(err)) - goto out; + goto failed; /* Update time stamp */ sci->sc_seg_ctime = ktime_get_real_seconds(); @@ -2103,10 +2106,9 @@ static int nilfs_segctor_do_construct(struct nilfs_sc_info *sci, int mode) return err; failed_to_write: - if (sci->sc_stage.flags & NILFS_CF_IFILE_STARTED) - nilfs_redirty_inodes(&sci->sc_dirty_files); - failed: + if (mode == SC_LSEG_SR && nilfs_sc_cstage_get(sci) >= NILFS_ST_IFILE) + nilfs_redirty_inodes(&sci->sc_dirty_files); if (nilfs_doing_gc()) nilfs_redirty_inodes(&sci->sc_gc_inodes); nilfs_segctor_abort_construction(sci, nilfs, err); -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: fix UAF in async decryption
by Long Li 30 Oct '24

30 Oct '24

From: Enzo Matsumiya <ematsumiya(a)suse.de> mainline inclusion from mainline-v6.10-rc2 commit b0abcd65ec545701b8793e12bc27dc98042b151a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE5 CVE: CVE-2024-50047 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Call Trace: [ 194.200191] <TASK> [ 194.200327] dump_stack_lvl+0x4e/0x70 [ 194.200558] ? gf128mul_4k_lle+0xc1/0x110 [ 194.200809] print_report+0x174/0x505 [ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 194.201352] ? srso_return_thunk+0x5/0x5f [ 194.201604] ? __virt_addr_valid+0xdf/0x1c0 [ 194.201868] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202128] kasan_report+0xc8/0x150 [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202616] gf128mul_4k_lle+0xc1/0x110 [ 194.202863] ghash_update+0x184/0x210 [ 194.203103] shash_ahash_update+0x184/0x2a0 [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10 [ 194.203651] ? srso_return_thunk+0x5/0x5f [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340 [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140 [ 194.204434] crypt_message+0xec1/0x10a0 [cifs] [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs] [ 194.208507] ? srso_return_thunk+0x5/0x5f [ 194.209205] ? srso_return_thunk+0x5/0x5f [ 194.209925] ? srso_return_thunk+0x5/0x5f [ 194.210443] ? srso_return_thunk+0x5/0x5f [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs] [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [ 194.214670] ? srso_return_thunk+0x5/0x5f [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs] This is because TFM is being used in parallel. Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()). Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation. Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/client/smb2ops.c | 47 ++++++++++++++++++++++++----------------- fs/smb/client/smb2pdu.c | 6 ++++++ 2 files changed, 34 insertions(+), 19 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index acd5d7d79352..a484bbe9e9de 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4245,7 +4245,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) */ static int crypt_message(struct TCP_Server_Info *server, int num_rqst, - struct smb_rqst *rqst, int enc) + struct smb_rqst *rqst, int enc, struct crypto_aead *tfm) { struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)rqst[0].rq_iov[0].iov_base; @@ -4256,8 +4256,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, u8 key[SMB3_ENC_DEC_KEY_SIZE]; struct aead_request *req; u8 *iv; - DECLARE_CRYPTO_WAIT(wait); - struct crypto_aead *tfm; unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); void *creq; size_t sensitive_size; @@ -4269,14 +4267,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, return rc; } - rc = smb3_crypto_aead_allocate(server); - if (rc) { - cifs_server_dbg(VFS, "%s: crypto alloc failed\n", __func__); - return rc; - } - - tfm = enc ? server->secmech.enc : server->secmech.dec; - if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE); @@ -4316,11 +4306,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, aead_request_set_crypt(req, sg, sg, crypt_len, iv); aead_request_set_ad(req, assoc_data_len); - aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, - crypto_req_done, &wait); - - rc = crypto_wait_req(enc ? crypto_aead_encrypt(req) - : crypto_aead_decrypt(req), &wait); + rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); if (!rc && enc) memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); @@ -4427,7 +4413,7 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst, /* fill the 1st iov with a transform header */ fill_transform_hdr(tr_hdr, orig_len, old_rq, server->cipher_type); - rc = crypt_message(server, num_rqst, new_rq, 1); + rc = crypt_message(server, num_rqst, new_rq, 1, server->secmech.enc); cifs_dbg(FYI, "Encrypt message returned %d\n", rc); if (rc) goto err_free; @@ -4452,8 +4438,9 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, unsigned int buf_data_size, struct iov_iter *iter, bool is_offloaded) { - struct kvec iov[2]; + struct crypto_aead *tfm; struct smb_rqst rqst = {NULL}; + struct kvec iov[2]; size_t iter_size = 0; int rc; @@ -4470,9 +4457,31 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, iter_size = iov_iter_count(iter); } - rc = crypt_message(server, 1, &rqst, 0); + if (is_offloaded) { + if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) || + (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) + tfm = crypto_alloc_aead("gcm(aes)", 0, 0); + else + tfm = crypto_alloc_aead("ccm(aes)", 0, 0); + if (IS_ERR(tfm)) { + rc = PTR_ERR(tfm); + cifs_server_dbg(VFS, "%s: Failed alloc decrypt TFM, rc=%d\n", __func__, rc); + + return rc; + } + } else { + if (unlikely(!server->secmech.dec)) + return -EIO; + + tfm = server->secmech.dec; + } + + rc = crypt_message(server, 1, &rqst, 0, tfm); cifs_dbg(FYI, "Decrypt message returned %d\n", rc); + if (is_offloaded) + crypto_free_aead(tfm); + if (rc) return rc; diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index bf45b8652e58..83a03201bb86 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -1263,6 +1263,12 @@ SMB2_negotiate(const unsigned int xid, else cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); } + + if (server->cipher_type && !rc) { + rc = smb3_crypto_aead_allocate(server); + if (rc) + cifs_server_dbg(VFS, "%s: crypto alloc failed, rc=%d\n", __func__, rc); + } neg_exit: free_rsp_buf(resp_buftype, rsp); return rc; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] smb: client: fix UAF in async decryption
by Long Li 30 Oct '24

30 Oct '24

From: Enzo Matsumiya <ematsumiya(a)suse.de> mainline inclusion from mainline-v6.10-rc2 commit b0abcd65ec545701b8793e12bc27dc98042b151a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE5 CVE: CVE-2024-50047 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Call Trace: [ 194.200191] <TASK> [ 194.200327] dump_stack_lvl+0x4e/0x70 [ 194.200558] ? gf128mul_4k_lle+0xc1/0x110 [ 194.200809] print_report+0x174/0x505 [ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 194.201352] ? srso_return_thunk+0x5/0x5f [ 194.201604] ? __virt_addr_valid+0xdf/0x1c0 [ 194.201868] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202128] kasan_report+0xc8/0x150 [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202616] gf128mul_4k_lle+0xc1/0x110 [ 194.202863] ghash_update+0x184/0x210 [ 194.203103] shash_ahash_update+0x184/0x2a0 [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10 [ 194.203651] ? srso_return_thunk+0x5/0x5f [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340 [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140 [ 194.204434] crypt_message+0xec1/0x10a0 [cifs] [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs] [ 194.208507] ? srso_return_thunk+0x5/0x5f [ 194.209205] ? srso_return_thunk+0x5/0x5f [ 194.209925] ? srso_return_thunk+0x5/0x5f [ 194.210443] ? srso_return_thunk+0x5/0x5f [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs] [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [ 194.214670] ? srso_return_thunk+0x5/0x5f [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs] This is because TFM is being used in parallel. Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()). Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation. Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2ops.c fs/smb/client/smb2pdu.c fs/cifs/smb2ops.c fs/cifs/smb2pdu.c [Conflicts due to cifs rename to smb/clinet] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/smb2ops.c | 49 ++++++++++++++++++++++++++++------------------- fs/cifs/smb2pdu.c | 6 ++++++ 2 files changed, 35 insertions(+), 20 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 91c653c720a6..21622261fbf9 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -4258,7 +4258,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) */ static int crypt_message(struct TCP_Server_Info *server, int num_rqst, - struct smb_rqst *rqst, int enc) + struct smb_rqst *rqst, int enc, struct crypto_aead *tfm) { struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)rqst[0].rq_iov[0].iov_base; @@ -4270,8 +4270,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, struct aead_request *req; char *iv; unsigned int iv_len; - DECLARE_CRYPTO_WAIT(wait); - struct crypto_aead *tfm; unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); rc = smb2_get_enc_key(server, tr_hdr->SessionId, enc, key); @@ -4281,15 +4279,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, return rc; } - rc = smb3_crypto_aead_allocate(server); - if (rc) { - cifs_server_dbg(VFS, "%s: crypto alloc failed\n", __func__); - return rc; - } - - tfm = enc ? server->secmech.ccmaesencrypt : - server->secmech.ccmaesdecrypt; - if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE); @@ -4344,11 +4333,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, aead_request_set_crypt(req, sg, sg, crypt_len, iv); aead_request_set_ad(req, assoc_data_len); - aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, - crypto_req_done, &wait); - - rc = crypto_wait_req(enc ? crypto_aead_encrypt(req) - : crypto_aead_decrypt(req), &wait); + rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); if (!rc && enc) memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); @@ -4441,7 +4426,8 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst, /* fill the 1st iov with a transform header */ fill_transform_hdr(tr_hdr, orig_len, old_rq, server->cipher_type); - rc = crypt_message(server, num_rqst, new_rq, 1); + rc = crypt_message(server, num_rqst, new_rq, 1, + server->secmech.ccmaesencrypt); cifs_dbg(FYI, "Encrypt message returned %d\n", rc); if (rc) goto err_free; @@ -4467,8 +4453,9 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, unsigned int npages, unsigned int page_data_size, bool is_offloaded) { - struct kvec iov[2]; + struct crypto_aead *tfm; struct smb_rqst rqst = {NULL}; + struct kvec iov[2]; int rc; iov[0].iov_base = buf; @@ -4483,9 +4470,31 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, rqst.rq_pagesz = PAGE_SIZE; rqst.rq_tailsz = (page_data_size % PAGE_SIZE) ? : PAGE_SIZE; - rc = crypt_message(server, 1, &rqst, 0); + if (is_offloaded) { + if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) || + (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) + tfm = crypto_alloc_aead("gcm(aes)", 0, 0); + else + tfm = crypto_alloc_aead("ccm(aes)", 0, 0); + if (IS_ERR(tfm)) { + rc = PTR_ERR(tfm); + cifs_server_dbg(VFS, "%s: Failed alloc decrypt TFM, rc=%d\n", __func__, rc); + + return rc; + } + } else { + if (unlikely(!server->secmech.ccmaesdecrypt)) + return -EIO; + + tfm = server->secmech.ccmaesdecrypt; + } + + rc = crypt_message(server, 1, &rqst, 0, tfm); cifs_dbg(FYI, "Decrypt message returned %d\n", rc); + if (is_offloaded) + crypto_free_aead(tfm); + if (rc) return rc; diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 0c4a2474e75b..b1b0d26c8486 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -993,6 +993,12 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) else cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); } + + if (server->cipher_type && !rc) { + rc = smb3_crypto_aead_allocate(server); + if (rc) + cifs_server_dbg(VFS, "%s: crypto alloc failed, rc=%d\n", __func__, rc); + } neg_exit: free_rsp_buf(resp_buftype, rsp); return rc; -- 2.39.2

2 1

[PATCH OLK-5.10] smb: client: fix UAF in async decryption
by Long Li 30 Oct '24

30 Oct '24

From: Enzo Matsumiya <ematsumiya(a)suse.de> mainline inclusion from mainline-v6.10-rc2 commit b0abcd65ec545701b8793e12bc27dc98042b151a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRE5 CVE: CVE-2024-50047 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ================================================================== [ 194.196844] BUG: KASAN: slab-use-after-free in gf128mul_4k_lle+0xc1/0x110 [ 194.197269] Read of size 8 at addr ffff888112bd0448 by task kworker/u77:2/899 [ 194.197707] [ 194.197818] CPU: 12 UID: 0 PID: 899 Comm: kworker/u77:2 Not tainted 6.11.0-lku-00028-gfca3ca14a17a-dirty #43 [ 194.198400] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-prebuilt.qemu.org 04/01/2014 [ 194.199046] Workqueue: smb3decryptd smb2_decrypt_offload [cifs] [ 194.200032] Call Trace: [ 194.200191] <TASK> [ 194.200327] dump_stack_lvl+0x4e/0x70 [ 194.200558] ? gf128mul_4k_lle+0xc1/0x110 [ 194.200809] print_report+0x174/0x505 [ 194.201040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 194.201352] ? srso_return_thunk+0x5/0x5f [ 194.201604] ? __virt_addr_valid+0xdf/0x1c0 [ 194.201868] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202128] kasan_report+0xc8/0x150 [ 194.202361] ? gf128mul_4k_lle+0xc1/0x110 [ 194.202616] gf128mul_4k_lle+0xc1/0x110 [ 194.202863] ghash_update+0x184/0x210 [ 194.203103] shash_ahash_update+0x184/0x2a0 [ 194.203377] ? __pfx_shash_ahash_update+0x10/0x10 [ 194.203651] ? srso_return_thunk+0x5/0x5f [ 194.203877] ? crypto_gcm_init_common+0x1ba/0x340 [ 194.204142] gcm_hash_assoc_remain_continue+0x10a/0x140 [ 194.204434] crypt_message+0xec1/0x10a0 [cifs] [ 194.206489] ? __pfx_crypt_message+0x10/0x10 [cifs] [ 194.208507] ? srso_return_thunk+0x5/0x5f [ 194.209205] ? srso_return_thunk+0x5/0x5f [ 194.209925] ? srso_return_thunk+0x5/0x5f [ 194.210443] ? srso_return_thunk+0x5/0x5f [ 194.211037] decrypt_raw_data+0x15f/0x250 [cifs] [ 194.212906] ? __pfx_decrypt_raw_data+0x10/0x10 [cifs] [ 194.214670] ? srso_return_thunk+0x5/0x5f [ 194.215193] smb2_decrypt_offload+0x12a/0x6c0 [cifs] This is because TFM is being used in parallel. Fix this by allocating a new AEAD TFM for async decryption, but keep the existing one for synchronous READ cases (similar to what is done in smb3_calc_signature()). Also remove the calls to aead_request_set_callback() and crypto_wait_req() since it's always going to be a synchronous operation. Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2ops.c fs/smb/client/smb2pdu.c fs/cifs/smb2ops.c fs/cifs/smb2pdu.c [Conflicts due to cifs rename to smb/clinet] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/smb2ops.c | 49 ++++++++++++++++++++++++++++------------------- fs/cifs/smb2pdu.c | 6 ++++++ 2 files changed, 35 insertions(+), 20 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 580c90a13ca8..1b60b32ed4f7 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -4287,7 +4287,7 @@ smb2_get_enc_key(struct TCP_Server_Info *server, __u64 ses_id, int enc, u8 *key) */ static int crypt_message(struct TCP_Server_Info *server, int num_rqst, - struct smb_rqst *rqst, int enc) + struct smb_rqst *rqst, int enc, struct crypto_aead *tfm) { struct smb2_transform_hdr *tr_hdr = (struct smb2_transform_hdr *)rqst[0].rq_iov[0].iov_base; @@ -4298,8 +4298,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, u8 key[SMB3_ENC_DEC_KEY_SIZE]; struct aead_request *req; u8 *iv; - DECLARE_CRYPTO_WAIT(wait); - struct crypto_aead *tfm; unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); void *creq; @@ -4310,15 +4308,6 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, return rc; } - rc = smb3_crypto_aead_allocate(server); - if (rc) { - cifs_server_dbg(VFS, "%s: crypto alloc failed\n", __func__); - return rc; - } - - tfm = enc ? server->secmech.ccmaesencrypt : - server->secmech.ccmaesdecrypt; - if ((server->cipher_type == SMB2_ENCRYPTION_AES256_CCM) || (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) rc = crypto_aead_setkey(tfm, key, SMB3_GCM256_CRYPTKEY_SIZE); @@ -4357,11 +4346,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, aead_request_set_crypt(req, sg, sg, crypt_len, iv); aead_request_set_ad(req, assoc_data_len); - aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, - crypto_req_done, &wait); - - rc = crypto_wait_req(enc ? crypto_aead_encrypt(req) - : crypto_aead_decrypt(req), &wait); + rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); if (!rc && enc) memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); @@ -4450,7 +4435,8 @@ smb3_init_transform_rq(struct TCP_Server_Info *server, int num_rqst, /* fill the 1st iov with a transform header */ fill_transform_hdr(tr_hdr, orig_len, old_rq, server->cipher_type); - rc = crypt_message(server, num_rqst, new_rq, 1); + rc = crypt_message(server, num_rqst, new_rq, 1, + server->secmech.ccmaesencrypt); cifs_dbg(FYI, "Encrypt message returned %d\n", rc); if (rc) goto err_free; @@ -4476,8 +4462,9 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, unsigned int npages, unsigned int page_data_size, bool is_offloaded) { - struct kvec iov[2]; + struct crypto_aead *tfm; struct smb_rqst rqst = {NULL}; + struct kvec iov[2]; int rc; iov[0].iov_base = buf; @@ -4492,9 +4479,31 @@ decrypt_raw_data(struct TCP_Server_Info *server, char *buf, rqst.rq_pagesz = PAGE_SIZE; rqst.rq_tailsz = (page_data_size % PAGE_SIZE) ? : PAGE_SIZE; - rc = crypt_message(server, 1, &rqst, 0); + if (is_offloaded) { + if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) || + (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM)) + tfm = crypto_alloc_aead("gcm(aes)", 0, 0); + else + tfm = crypto_alloc_aead("ccm(aes)", 0, 0); + if (IS_ERR(tfm)) { + rc = PTR_ERR(tfm); + cifs_server_dbg(VFS, "%s: Failed alloc decrypt TFM, rc=%d\n", __func__, rc); + + return rc; + } + } else { + if (unlikely(!server->secmech.ccmaesdecrypt)) + return -EIO; + + tfm = server->secmech.ccmaesdecrypt; + } + + rc = crypt_message(server, 1, &rqst, 0, tfm); cifs_dbg(FYI, "Decrypt message returned %d\n", rc); + if (is_offloaded) + crypto_free_aead(tfm); + if (rc) return rc; diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index aa3211d8cce3..d8e57bdabc88 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -998,6 +998,12 @@ SMB2_negotiate(const unsigned int xid, struct cifs_ses *ses) else cifs_server_dbg(VFS, "Missing expected negotiate contexts\n"); } + + if (server->cipher_type && !rc) { + rc = smb3_crypto_aead_allocate(server); + if (rc) + cifs_server_dbg(VFS, "%s: crypto alloc failed, rc=%d\n", __func__, rc); + } neg_exit: free_rsp_buf(resp_buftype, rsp); return rc; -- 2.39.2

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 5b8789bdf0036a2c7127f6a0d942b4c2b6f8e42d
by kernel test robot 30 Oct '24

30 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 5b8789bdf0036a2c7127f6a0d942b4c2b6f8e42d !12632 ALSA: asihpi: Fix potential OOB array access Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410300643.xefa3uuI-lkp@intel.com arch/loongarch/include/asm/irq.h:47:23: error: 'NR_VECTORS' undeclared (first use in this function) arch/loongarch/include/asm/irq.h:47:23: error: 'NR_VECTORS' undeclared here (not in a function) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-arm64-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_dev_ttt_levels | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- loongarch-allmodconfig | |-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-(first-use-in-this-function) | `-- arch-loongarch-include-asm-irq.h:error:NR_VECTORS-undeclared-here-(not-in-a-function) |-- loongarch-allnoconfig | |-- arch-loongarch-kernel-efi.c:error:incompatible-types-when-assigning-to-type-pmd_t-from-type-int | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- x86_64-allnoconfig | |-- Warning:drivers-net-ethernet-nebula-matrix-Kconfig-references-a-file-that-doesn-t-exist:file:Documentation-networking-device_drivers-ethernet-nebula-matrix-m18110.rst | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_include-nbl_include.h:linux-pci.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_export | |-- clang:warning:no-such-include-directory:drivers-net-ethernet-nebula-matrix-nbl-nbl_include | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h-file-not-found | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h-file-not-found | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h-file-not-found |-- x86_64-buildonly-randconfig-002-20241030 | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-crypto-ccp-hygon-hct.c:error:struct-device-has-no-member-named-numa_node | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:warning:no-previous-prototype-for-hinic_netdev_event | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-kexec | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | `-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- x86_64-rhel-8.3 | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory |-- x86_64-rhel-8.3-func | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain | |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory | |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- x86_64-rhel-8.3-kselftests |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvf-description-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-kvm-description-in-cvm_vfio_add_kvm_to_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Excess-function-parameter-smmu_domain_group_list-description-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-data-not-described-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-dev-not-described-in-find_arm_smmu_domain |-- arch-x86-kvm-..-..-..-virt-kvm-vfio.c:warning:Function-parameter-or-member-kv-not-described-in-cvm_vfio_add_kvm_to_smmu_domain |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_export:No-such-file-or-directory |-- cc1:warning:drivers-net-ethernet-nebula-matrix-nbl-nbl_include:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.h:fatal-error:nbl_product_base.h:No-such-file-or-directory |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_resource_leonis.h:fatal-error:nbl_resource.h:No-such-file-or-directory elapsed time: 722m configs tested: 14 configs skipped: 65 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241030 clang-19 x86_64 buildonly-randconfig-002-20241030 gcc-12 x86_64 buildonly-randconfig-003-20241030 gcc-12 x86_64 buildonly-randconfig-004-20241030 gcc-12 x86_64 buildonly-randconfig-005-20241030 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION ffc5791ca9102a55d29c6dea26de38d32f052b01
by kernel test robot 30 Oct '24

30 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: ffc5791ca9102a55d29c6dea26de38d32f052b01 !12621 apparmor: fix policy_unpack_test on big endian systems Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410292243.lj3Xa1zr-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410300109.pSLkwgUF-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410300443.E0lKV9go-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410300700.74552znZ-lkp@intel.com drivers/net/dsa/mv88e6xxx/chip.c:2320:4: error: implicit declaration of function 'mv88e6xxx_g2_eeprom_wait' [-Werror,-Wimplicit-function-declaration] drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-003-20241029 | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_rearm_jfc | |-- drivers-ub-urma-uburma-uburma_cmd.c:warning:no-previous-prototype-for-uburma_jfr_event_cb | |-- drivers-ub-urma-uburma-uburma_cmd.c:warning:no-previous-prototype-for-uburma_jfs_event_cb | `-- drivers-ub-urma-uburma-uburma_dev_ops.c:warning:no-previous-prototype-for-uburma_mmap |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-001-20241030 | `-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() |-- x86_64-buildonly-randconfig-002-20241030 | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-005-20241030 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn `-- x86_64-randconfig-012-20241029 `-- drivers-net-dsa-mv88e6xxx-chip.c:error:implicit-declaration-of-function-mv88e6xxx_g2_eeprom_wait-Werror-Wimplicit-function-declaration elapsed time: 736m configs tested: 12 configs skipped: 67 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241030 clang-19 x86_64 buildonly-randconfig-002-20241030 gcc-12 x86_64 buildonly-randconfig-003-20241030 gcc-12 x86_64 buildonly-randconfig-004-20241030 gcc-12 x86_64 buildonly-randconfig-005-20241030 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 18718/30000] drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb'
by kernel test robot 30 Oct '24

30 Oct '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ffc5791ca9102a55d29c6dea26de38d32f052b01 commit: 79b60243a9ff771b76add8e16cfe55cc4f5edef2 [18718/30000] ub: uburma add cmd create jfr implementation. config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241030/202410300700.74552znZ-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241030/202410300700.74552znZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410300700.74552znZ-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfr_event_cb +156 drivers/ub/urma/uburma/uburma_cmd.c 155 > 156 void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 157 { 158 struct uburma_jfr_uobj *jfr_uobj; 159 160 if (event->element.jfr == NULL) 161 return; 162 163 jfr_uobj = (struct uburma_jfr_uobj *)event->element.jfr->jfr_cfg.jfr_context; 164 uburma_write_async_event(ctx, event->element.jfr->urma_jfr, event->event_type, 165 &jfr_uobj->async_event_list, &jfr_uobj->async_events_reported); 166 } 167 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 15347/15883] arch/loongarch/include/asm/irq.h:47:23: error: 'NR_VECTORS' undeclared
by kernel test robot 30 Oct '24

30 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5b8789bdf0036a2c7127f6a0d942b4c2b6f8e42d commit: 375d7f74f7099abf22f2c7e7235ce45a33f78110 [15347/15883] acpi: mcfg quirk: Increased multi-chip support for the 3C6000 config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20241030/202410300643.xefa3uuI-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241030/202410300643.xefa3uuI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410300643.xefa3uuI-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/irq.h:24, from arch/loongarch/include/asm/hardirq.h:10, from include/linux/hardirq.h:11, from include/linux/interrupt.h:11, from include/linux/serial_core.h:13, from drivers/tty/serial/lantiq.c:23: drivers/tty/serial/lantiq.c: In function 'lqasc_verify_port': >> arch/loongarch/include/asm/irq.h:47:23: error: 'NR_VECTORS' undeclared (first use in this function) 47 | #define NR_IRQS (64 + NR_VECTORS * (NR_CPUS + MAX_IO_PICS)) | ^~~~~~~~~~ drivers/tty/serial/lantiq.c:554:41: note: in expansion of macro 'NR_IRQS' 554 | if (ser->irq < 0 || ser->irq >= NR_IRQS) | ^~~~~~~ arch/loongarch/include/asm/irq.h:47:23: note: each undeclared identifier is reported only once for each function it appears in 47 | #define NR_IRQS (64 + NR_VECTORS * (NR_CPUS + MAX_IO_PICS)) | ^~~~~~~~~~ drivers/tty/serial/lantiq.c:554:41: note: in expansion of macro 'NR_IRQS' 554 | if (ser->irq < 0 || ser->irq >= NR_IRQS) | ^~~~~~~ -- In file included from include/linux/irq.h:24, from kernel/irq/irqdesc.c:10: >> arch/loongarch/include/asm/irq.h:47:23: error: 'NR_VECTORS' undeclared here (not in a function) 47 | #define NR_IRQS (64 + NR_VECTORS * (NR_CPUS + MAX_IO_PICS)) | ^~~~~~~~~~ kernel/irq/irqdesc.c:129:15: note: in expansion of macro 'NR_IRQS' 129 | int nr_irqs = NR_IRQS; | ^~~~~~~ vim +/NR_VECTORS +47 arch/loongarch/include/asm/irq.h 41 42 #define arch_trigger_cpumask_backtrace arch_trigger_cpumask_backtrace 43 extern bool arch_trigger_cpumask_backtrace(const cpumask_t *mask, 44 int exclude_cpu); 45 46 #define MAX_IO_PICS 16 > 47 #define NR_IRQS (64 + NR_VECTORS * (NR_CPUS + MAX_IO_PICS)) 48 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 7b2baa68ab7f9f7fc4023e8121ddb050b2e45f30
by kernel test robot 30 Oct '24

30 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 7b2baa68ab7f9f7fc4023e8121ddb050b2e45f30 !12627 NFC: nci: Bounds check struct nfc_target arrays Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410291925.OMbLBBuG-lkp@intel.com fs/proc/etmem_scan.c:823: undefined reference to `kvm_flush_remote_tlbs' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-buildonly-randconfig-001-20241030 | |-- drivers-i2c-busses-.tmp_i2c-zhaoxin.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-platform-x86-.tmp_intel_atomisp2_pm.o:warning:objtool:missing-symbol-for-section-.init.text | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-002-20241030 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-003-20241030 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-004-20241030 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-005-20241030 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-buildonly-randconfig-006-20241030 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-001-20241030 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-004-20241030 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-005-20241030 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-randconfig-011-20241030 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-072-20241029 | `-- fs-proc-etmem_scan.c:undefined-reference-to-kvm_flush_remote_tlbs |-- x86_64-randconfig-161-20241030 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 735m configs tested: 22 configs skipped: 75 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241030 clang-19 x86_64 buildonly-randconfig-002-20241030 gcc-12 x86_64 buildonly-randconfig-003-20241030 gcc-12 x86_64 buildonly-randconfig-004-20241030 gcc-12 x86_64 buildonly-randconfig-005-20241030 gcc-12 x86_64 buildonly-randconfig-006-20241030 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241030 gcc-12 x86_64 randconfig-002-20241030 gcc-12 x86_64 randconfig-003-20241030 clang-19 x86_64 randconfig-004-20241030 clang-19 x86_64 randconfig-005-20241030 clang-19 x86_64 randconfig-006-20241030 gcc-12 x86_64 randconfig-011-20241030 gcc-12 x86_64 randconfig-012-20241030 clang-19 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-func gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 18717/30000] drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb'
by kernel test robot 30 Oct '24

30 Oct '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ffc5791ca9102a55d29c6dea26de38d32f052b01 commit: dd9641804ad19402838975c28003465d0b42042a [18717/30000] ub: uburma add cmd create/delete jfs implementation. config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241030/202410300443.E0lKV9go-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241030/202410300443.E0lKV9go-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410300443.E0lKV9go-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ vim +/uburma_jfs_event_cb +144 drivers/ub/urma/uburma/uburma_cmd.c 143 > 144 void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 145 { 146 struct uburma_jfs_uobj *jfs_uobj; 147 148 if (event->element.jfs == NULL) 149 return; 150 151 jfs_uobj = (struct uburma_jfs_uobj *)event->element.jfs->jfs_cfg.jfs_context; 152 uburma_write_async_event(ctx, event->element.jfs->urma_jfs, event->event_type, 153 &jfs_uobj->async_event_list, &jfs_uobj->async_events_reported); 154 } 155 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 18707/30000] drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc'
by kernel test robot 30 Oct '24

30 Oct '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ffc5791ca9102a55d29c6dea26de38d32f052b01 commit: ad84f0a92e3fe282d8280d8c45f8d5b8aab1a2b4 [18707/30000] ub: ubcore add event api and add jetty and event api impls to compile config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241030/202410300109.pSLkwgUF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241030/202410300109.pSLkwgUF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410300109.pSLkwgUF-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_dp.c:26:5: warning: no previous prototype for 'ubcore_rearm_jfc' [-Wmissing-prototypes] 26 | int ubcore_rearm_jfc(struct ubcore_jfc *jfc, bool solicited_only) | ^~~~~~~~~~~~~~~~ vim +/ubcore_rearm_jfc +26 drivers/ub/urma/ubcore/ubcore_dp.c 25 > 26 int ubcore_rearm_jfc(struct ubcore_jfc *jfc, bool solicited_only) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 18678/30000] drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap'
by kernel test robot 29 Oct '24

29 Oct '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ffc5791ca9102a55d29c6dea26de38d32f052b01 commit: 7d130c6018dbfd09c6e1c5d91b347fdbf3924321 [18678/30000] ub: add mmap ops support in ubcore and uburma config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241029/202410292243.lj3Xa1zr-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410292243.lj3Xa1zr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410292243.lj3Xa1zr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_dev_ops.c:32:5: warning: no previous prototype for 'uburma_mmap' [-Wmissing-prototypes] 32 | int uburma_mmap(struct file *filp, struct vm_area_struct *vma) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c:64:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] 64 | void uburma_release_file(struct kref *ref) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c:81:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] 81 | int uburma_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: In function 'uburma_open': drivers/ub/urma/uburma/uburma_dev_ops.c:98:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] 98 | if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { | ^~ In file included from drivers/ub/urma/uburma/uburma_dev_ops.c:25: include/urma/ubcore_types.h:1589:14: note: 'dev_name' declared here 1589 | char dev_name[UBCORE_MAX_DEV_NAME]; | ^~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: At top level: drivers/ub/urma/uburma/uburma_dev_ops.c:134:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] 134 | int uburma_close(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~ vim +/uburma_mmap +32 drivers/ub/urma/uburma/uburma_dev_ops.c 31 > 32 int uburma_mmap(struct file *filp, struct vm_area_struct *vma) 33 { 34 struct uburma_file *file = filp->private_data; 35 struct uburma_device *ubu_dev; 36 struct ubcore_device *ubc_dev; 37 int srcu_idx; 38 int ret; 39 40 if (file == NULL || file->ucontext == NULL) { 41 uburma_log_err("can not find ucontext.\n"); 42 return -EINVAL; 43 } 44 45 ubu_dev = file->ubu_dev; 46 uburma_cmd_inc(ubu_dev); 47 48 srcu_idx = srcu_read_lock(&ubu_dev->ubc_dev_srcu); 49 ubc_dev = srcu_dereference(ubu_dev->ubc_dev, &ubu_dev->ubc_dev_srcu); 50 if (ubc_dev == NULL || ubc_dev->ops == NULL || ubc_dev->ops->mmap == NULL) { 51 uburma_log_err("can not find ubcore device.\n"); 52 ret = -ENODEV; 53 goto out; 54 } 55 56 ret = ubc_dev->ops->mmap(file->ucontext, vma); 57 58 out: 59 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 60 uburma_cmd_dec(ubu_dev); 61 return ret; 62 } 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] CVE-2024-47673
by Zhang Changzhong 29 Oct '24

29 Oct '24

Emmanuel Grumbach (1): wifi: iwlwifi: mvm: pause TCM when the firmware is stopped Johannes Berg (1): iwlwifi: mvm: move iwl_mvm_stop_device() out of line drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 11 +---------- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 10 deletions(-) -- 2.9.5

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-47673
by Zhang Changzhong 29 Oct '24

29 Oct '24

Emmanuel Grumbach (1): wifi: iwlwifi: mvm: pause TCM when the firmware is stopped Johannes Berg (1): iwlwifi: mvm: move iwl_mvm_stop_device() out of line drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 11 +---------- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 10 deletions(-) -- 2.9.5

2 3

[PATCH OLK-5.10] IB/core: Fix ib_cache_setup_one error flow cleanup
by Zhang Changzhong 29 Oct '24

29 Oct '24

From: Patrisious Haddad <phaddad(a)nvidia.com> mainline inclusion from mainline-v6.12-rc1 commit 1403c8b14765eab805377dd3b75e96ace8747aed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKR CVE: CVE-2024-47693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ib_cache_update return an error, we exit ib_cache_setup_one instantly with no proper cleanup, even though before this we had already successfully done gid_table_setup_one, that results in the kernel WARN below. Do proper cleanup using gid_table_cleanup_one before returning the err in order to fix the issue. WARNING: CPU: 4 PID: 922 at drivers/infiniband/core/cache.c:806 gid_table_release_one+0x181/0x1a0 Modules linked in: CPU: 4 UID: 0 PID: 922 Comm: c_repro Not tainted 6.11.0-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:gid_table_release_one+0x181/0x1a0 Code: 44 8b 38 75 0c e8 2f cb 34 ff 4d 8b b5 28 05 00 00 e8 23 cb 34 ff 44 89 f9 89 da 4c 89 f6 48 c7 c7 d0 58 14 83 e8 4f de 21 ff <0f> 0b 4c 8b 75 30 e9 54 ff ff ff 48 8 3 c4 10 5b 5d 41 5c 41 5d 41 RSP: 0018:ffffc90002b835b0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c8527 RDX: 0000000000000000 RSI: ffffffff811c8534 RDI: 0000000000000001 RBP: ffff8881011b3d00 R08: ffff88810b3abe00 R09: 205d303839303631 R10: 666572207972746e R11: 72746e6520444947 R12: 0000000000000001 R13: ffff888106390000 R14: ffff8881011f2110 R15: 0000000000000001 FS: 00007fecc3b70800(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000340 CR3: 000000010435a001 CR4: 00000000003706b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x94/0xa0 ? __warn+0x9e/0x1c0 ? gid_table_release_one+0x181/0x1a0 ? report_bug+0x1f9/0x340 ? gid_table_release_one+0x181/0x1a0 ? handle_bug+0xa2/0x110 ? exc_invalid_op+0x31/0xa0 ? asm_exc_invalid_op+0x16/0x20 ? __warn_printk+0xc7/0x180 ? __warn_printk+0xd4/0x180 ? gid_table_release_one+0x181/0x1a0 ib_device_release+0x71/0xe0 ? __pfx_ib_device_release+0x10/0x10 device_release+0x44/0xd0 kobject_put+0x135/0x3d0 put_device+0x20/0x30 rxe_net_add+0x7d/0xa0 rxe_newlink+0xd7/0x190 nldev_newlink+0x1b0/0x2a0 ? __pfx_nldev_newlink+0x10/0x10 rdma_nl_rcv_msg+0x1ad/0x2e0 rdma_nl_rcv_skb.constprop.0+0x176/0x210 netlink_unicast+0x2de/0x400 netlink_sendmsg+0x306/0x660 __sock_sendmsg+0x110/0x120 ____sys_sendmsg+0x30e/0x390 ___sys_sendmsg+0x9b/0xf0 ? kstrtouint+0x6e/0xa0 ? kstrtouint_from_user+0x7c/0xb0 ? get_pid_task+0xb0/0xd0 ? proc_fail_nth_write+0x5b/0x140 ? __fget_light+0x9a/0x200 ? preempt_count_add+0x47/0xa0 __sys_sendmsg+0x61/0xd0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 1901b91f9982 ("IB/core: Fix potential NULL pointer dereference in pkey cache") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Maher Sanalla <msanalla(a)nvidia.com> Link: https://patch.msgid.link/79137687d829899b0b1c9835fcb4b258004c439a.172527335… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/core/cache.c [d58c23c92548 ("IB/core: Only update PKEY and GID caches on respective events") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/infiniband/core/cache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c index 7989b7e..21b405a 100644 --- a/drivers/infiniband/core/cache.c +++ b/drivers/infiniband/core/cache.c @@ -1633,8 +1633,10 @@ int ib_cache_setup_one(struct ib_device *device) rdma_for_each_port (device, p) { err = ib_cache_update(device, p, true); - if (err) + if (err) { + gid_table_cleanup_one(device); return err; + } } return 0; -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] IB/core: Fix ib_cache_setup_one error flow cleanup
by Zhang Changzhong 29 Oct '24

29 Oct '24

From: Patrisious Haddad <phaddad(a)nvidia.com> mainline inclusion from mainline-v6.12-rc1 commit 1403c8b14765eab805377dd3b75e96ace8747aed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPKR CVE: CVE-2024-47693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When ib_cache_update return an error, we exit ib_cache_setup_one instantly with no proper cleanup, even though before this we had already successfully done gid_table_setup_one, that results in the kernel WARN below. Do proper cleanup using gid_table_cleanup_one before returning the err in order to fix the issue. WARNING: CPU: 4 PID: 922 at drivers/infiniband/core/cache.c:806 gid_table_release_one+0x181/0x1a0 Modules linked in: CPU: 4 UID: 0 PID: 922 Comm: c_repro Not tainted 6.11.0-rc1+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:gid_table_release_one+0x181/0x1a0 Code: 44 8b 38 75 0c e8 2f cb 34 ff 4d 8b b5 28 05 00 00 e8 23 cb 34 ff 44 89 f9 89 da 4c 89 f6 48 c7 c7 d0 58 14 83 e8 4f de 21 ff <0f> 0b 4c 8b 75 30 e9 54 ff ff ff 48 8 3 c4 10 5b 5d 41 5c 41 5d 41 RSP: 0018:ffffc90002b835b0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c8527 RDX: 0000000000000000 RSI: ffffffff811c8534 RDI: 0000000000000001 RBP: ffff8881011b3d00 R08: ffff88810b3abe00 R09: 205d303839303631 R10: 666572207972746e R11: 72746e6520444947 R12: 0000000000000001 R13: ffff888106390000 R14: ffff8881011f2110 R15: 0000000000000001 FS: 00007fecc3b70800(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000340 CR3: 000000010435a001 CR4: 00000000003706b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x94/0xa0 ? __warn+0x9e/0x1c0 ? gid_table_release_one+0x181/0x1a0 ? report_bug+0x1f9/0x340 ? gid_table_release_one+0x181/0x1a0 ? handle_bug+0xa2/0x110 ? exc_invalid_op+0x31/0xa0 ? asm_exc_invalid_op+0x16/0x20 ? __warn_printk+0xc7/0x180 ? __warn_printk+0xd4/0x180 ? gid_table_release_one+0x181/0x1a0 ib_device_release+0x71/0xe0 ? __pfx_ib_device_release+0x10/0x10 device_release+0x44/0xd0 kobject_put+0x135/0x3d0 put_device+0x20/0x30 rxe_net_add+0x7d/0xa0 rxe_newlink+0xd7/0x190 nldev_newlink+0x1b0/0x2a0 ? __pfx_nldev_newlink+0x10/0x10 rdma_nl_rcv_msg+0x1ad/0x2e0 rdma_nl_rcv_skb.constprop.0+0x176/0x210 netlink_unicast+0x2de/0x400 netlink_sendmsg+0x306/0x660 __sock_sendmsg+0x110/0x120 ____sys_sendmsg+0x30e/0x390 ___sys_sendmsg+0x9b/0xf0 ? kstrtouint+0x6e/0xa0 ? kstrtouint_from_user+0x7c/0xb0 ? get_pid_task+0xb0/0xd0 ? proc_fail_nth_write+0x5b/0x140 ? __fget_light+0x9a/0x200 ? preempt_count_add+0x47/0xa0 __sys_sendmsg+0x61/0xd0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 1901b91f9982 ("IB/core: Fix potential NULL pointer dereference in pkey cache") Signed-off-by: Patrisious Haddad <phaddad(a)nvidia.com> Reviewed-by: Maher Sanalla <msanalla(a)nvidia.com> Link: https://patch.msgid.link/79137687d829899b0b1c9835fcb4b258004c439a.172527335… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/core/cache.c [d58c23c92548 ("IB/core: Only update PKEY and GID caches on respective events") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/infiniband/core/cache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c index 7989b7e..21b405a 100644 --- a/drivers/infiniband/core/cache.c +++ b/drivers/infiniband/core/cache.c @@ -1633,8 +1633,10 @@ int ib_cache_setup_one(struct ib_device *device) rdma_for_each_port (device, p) { err = ib_cache_update(device, p, true); - if (err) + if (err) { + gid_table_cleanup_one(device); return err; + } } return 0; -- 2.9.5

2 1

[openeuler:openEuler-1.0-LTS 15383/23901] fs/proc/etmem_scan.c:823: undefined reference to `kvm_flush_remote_tlbs'
by kernel test robot 29 Oct '24

29 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7b2baa68ab7f9f7fc4023e8121ddb050b2e45f30 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [15383/23901] etmem: add etmem-scan feature config: x86_64-randconfig-072-20241029 (https://download.01.org/0day-ci/archive/20241029/202410291925.OMbLBBuG-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410291925.OMbLBBuG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410291925.OMbLBBuG-lkp@intel.com/ All errors (new ones prefixed by >>): ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions ld: fs/proc/etmem_scan.o: in function `page_scan_release': >> fs/proc/etmem_scan.c:823: undefined reference to `kvm_flush_remote_tlbs' vim +823 fs/proc/etmem_scan.c 804 805 static int page_scan_release(struct inode *inode, struct file *file) 806 { 807 struct mm_struct *mm = file->private_data; 808 struct kvm *kvm; 809 int ret = 0; 810 811 if (!mm) { 812 ret = -EBADF; 813 goto out; 814 } 815 816 kvm = mm_kvm(mm); 817 if (!kvm) { 818 ret = -EINVAL; 819 goto out; 820 } 821 #ifdef CONFIG_X86_64 822 spin_lock(&kvm->mmu_lock); > 823 kvm_flush_remote_tlbs(kvm); 824 spin_unlock(&kvm->mmu_lock); 825 #endif 826 827 out: 828 module_put(THIS_MODULE); 829 return ret; 830 } 831 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
by Li Huafei 29 Oct '24

29 Oct '24

From: Elena Salomatkina <esalomatkina(a)ispras.ru> stable inclusion from stable-v6.6.55 commit 0168ab6fbd9e50d20b97486168b604b2ab28a2ca category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRB1 CVE: CVE-2024-50000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f25389e779500cf4a59ef9804534237841bce536 ] In mlx5e_tir_builder_alloc() kvzalloc() may return NULL which is dereferenced on the next line in a reference to the modify field. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: a6696735d694 ("net/mlx5e: Convert TIR to a dedicated object") Signed-off-by: Elena Salomatkina <esalomatkina(a)ispras.ru> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Reviewed-by: Tariq Toukan <tariqt(a)nvidia.com> Reviewed-by: Gal Pressman <gal(a)nvidia.com> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en/tir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c index d4239e3b3c88..11f724ad90db 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c @@ -23,6 +23,9 @@ struct mlx5e_tir_builder *mlx5e_tir_builder_alloc(bool modify) struct mlx5e_tir_builder *builder; builder = kvzalloc(sizeof(*builder), GFP_KERNEL); + if (!builder) + return NULL; + builder->modify = modify; return builder; -- 2.25.1

2 1

[PATCH OLK-6.6] ocfs2: remove unreasonable unlock in ocfs2_read_blocks
by Tong Tiangen 29 Oct '24

29 Oct '24

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v6.6.55 commit 84543da867c967edffd5065fa910ebf56aaae49d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCH CVE: CVE-2024-49965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c03a82b4a0c935774afa01fd6d128b444fd930a1 upstream. Patch series "Misc fixes for ocfs2_read_blocks", v5. This series contains 2 fixes for ocfs2_read_blocks(). The first patch fix the issue reported by syzbot, which detects bad unlock balance in ocfs2_read_blocks(). The second patch fixes an issue reported by Heming Zhao when reviewing above fix. This patch (of 2): There was a lock release before exiting, so remove the unreasonable unlock. Link: https://lkml.kernel.org/r/20240902023636.1843422-1-joseph.qi@linux.alibaba.… Link: https://lkml.kernel.org/r/20240902023636.1843422-2-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Heming Zhao <heming.zhao(a)suse.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: syzbot+ab134185af9ef88dfed5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab134185af9ef88dfed5 Tested-by: syzbot+ab134185af9ef88dfed5(a)syzkaller.appspotmail.com Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> [4.20+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- fs/ocfs2/buffer_head_io.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c index 196638a22b48..a71b40065e8b 100644 --- a/fs/ocfs2/buffer_head_io.c +++ b/fs/ocfs2/buffer_head_io.c @@ -235,7 +235,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, if (bhs[i] == NULL) { bhs[i] = sb_getblk(sb, block++); if (bhs[i] == NULL) { - ocfs2_metadata_cache_io_unlock(ci); status = -ENOMEM; mlog_errno(status); /* Don't forget to put previous bh! */ -- 2.25.1

2 1

[PATCH OLK-5.10] ocfs2: remove unreasonable unlock in ocfs2_read_blocks
by Tong Tiangen 29 Oct '24

29 Oct '24

From: Lizhi Xu <lizhi.xu(a)windriver.com> stable inclusion from stable-v5.10.227 commit 3f1ca6ba5452d53c598a45d21267a2c0c221eef3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCH CVE: CVE-2024-49965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c03a82b4a0c935774afa01fd6d128b444fd930a1 upstream. Patch series "Misc fixes for ocfs2_read_blocks", v5. This series contains 2 fixes for ocfs2_read_blocks(). The first patch fix the issue reported by syzbot, which detects bad unlock balance in ocfs2_read_blocks(). The second patch fixes an issue reported by Heming Zhao when reviewing above fix. This patch (of 2): There was a lock release before exiting, so remove the unreasonable unlock. Link: https://lkml.kernel.org/r/20240902023636.1843422-1-joseph.qi@linux.alibaba.… Link: https://lkml.kernel.org/r/20240902023636.1843422-2-joseph.qi@linux.alibaba.… Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside") Signed-off-by: Lizhi Xu <lizhi.xu(a)windriver.com> Signed-off-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reviewed-by: Heming Zhao <heming.zhao(a)suse.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Reported-by: syzbot+ab134185af9ef88dfed5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab134185af9ef88dfed5 Tested-by: syzbot+ab134185af9ef88dfed5(a)syzkaller.appspotmail.com Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> [4.20+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- fs/ocfs2/buffer_head_io.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c index f0b104e483d8..da24e8449f24 100644 --- a/fs/ocfs2/buffer_head_io.c +++ b/fs/ocfs2/buffer_head_io.c @@ -237,7 +237,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, if (bhs[i] == NULL) { bhs[i] = sb_getblk(sb, block++); if (bhs[i] == NULL) { - ocfs2_metadata_cache_io_unlock(ci); status = -ENOMEM; mlog_errno(status); /* Don't forget to put previous bh! */ -- 2.25.1

2 1

[openeuler:OLK-5.10 18685/30000] drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file'
by kernel test robot 29 Oct '24

29 Oct '24

Hi Yizhen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2d902497d466f0e7c448a2c6ad00878b549c2192 commit: cd637a6dded9c0dce5f8d79898bb25be2edb927a [18685/30000] ub: uburma support open/release file ops config: arm64-randconfig-003-20241029 (https://download.01.org/0day-ci/archive/20241029/202410291823.s7QZPUJc-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410291823.s7QZPUJc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410291823.s7QZPUJc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/uburma/uburma_dev_ops.c:32:6: warning: no previous prototype for 'uburma_release_file' [-Wmissing-prototypes] 32 | void uburma_release_file(struct kref *ref) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_dev_ops.c:49:5: warning: no previous prototype for 'uburma_open' [-Wmissing-prototypes] 49 | int uburma_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: In function 'uburma_open': >> drivers/ub/urma/uburma/uburma_dev_ops.c:66:50: warning: the comparison will always evaluate as 'false' for the address of 'dev_name' will never be NULL [-Waddress] 66 | if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { | ^~ In file included from drivers/ub/urma/uburma/uburma_dev_ops.c:25: include/urma/ubcore_types.h:1589:14: note: 'dev_name' declared here 1589 | char dev_name[UBCORE_MAX_DEV_NAME]; | ^~~~~~~~ drivers/ub/urma/uburma/uburma_dev_ops.c: At top level: >> drivers/ub/urma/uburma/uburma_dev_ops.c:102:5: warning: no previous prototype for 'uburma_close' [-Wmissing-prototypes] 102 | int uburma_close(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~ vim +/uburma_release_file +32 drivers/ub/urma/uburma/uburma_dev_ops.c 31 > 32 void uburma_release_file(struct kref *ref) 33 { 34 struct uburma_file *file = container_of(ref, struct uburma_file, ref); 35 int srcu_idx; 36 37 srcu_idx = srcu_read_lock(&file->ubu_dev->ubc_dev_srcu); 38 srcu_dereference(file->ubu_dev->ubc_dev, &file->ubu_dev->ubc_dev_srcu); 39 40 srcu_read_unlock(&file->ubu_dev->ubc_dev_srcu, srcu_idx); 41 42 if (atomic_dec_and_test(&file->ubu_dev->refcnt)) 43 complete(&file->ubu_dev->comp); 44 45 kobject_put(&file->ubu_dev->kobj); 46 kfree(file); 47 } 48 > 49 int uburma_open(struct inode *inode, struct file *filp) 50 { 51 struct uburma_device *ubu_dev; 52 struct ubcore_device *ubc_dev; 53 struct uburma_file *file; 54 int srcu_idx; 55 int ret; 56 57 ubu_dev = container_of(inode->i_cdev, struct uburma_device, cdev); 58 if (!atomic_inc_not_zero(&ubu_dev->refcnt)) { 59 uburma_log_err("device was not ready.\n"); 60 return -ENXIO; 61 } 62 63 srcu_idx = srcu_read_lock(&ubu_dev->ubc_dev_srcu); 64 mutex_lock(&ubu_dev->lists_mutex); 65 ubc_dev = srcu_dereference(ubu_dev->ubc_dev, &ubu_dev->ubc_dev_srcu); > 66 if (ubc_dev == NULL || ubc_dev->dev_name == NULL) { 67 uburma_log_err("can not find ubcore device.\n"); 68 ret = EIO; 69 goto err; 70 } 71 72 file = kzalloc(sizeof(struct uburma_file), GFP_KERNEL); 73 if (!file) { 74 ret = -ENOMEM; 75 uburma_log_err("can not alloc memory.\n"); 76 goto err; 77 } 78 79 file->ubu_dev = ubu_dev; 80 file->ucontext = NULL; 81 kref_init(&file->ref); 82 mutex_init(&file->mutex); 83 filp->private_data = file; 84 85 list_add_tail(&file->list, &ubu_dev->uburma_file_list); 86 kobject_get(&ubu_dev->kobj); // Increase reference count for file. 87 88 mutex_unlock(&ubu_dev->lists_mutex); 89 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 90 91 uburma_log_info("device: %s open succeed.\n", ubc_dev->dev_name); 92 return nonseekable_open(inode, filp); 93 94 err: 95 mutex_unlock(&ubu_dev->lists_mutex); 96 srcu_read_unlock(&ubu_dev->ubc_dev_srcu, srcu_idx); 97 if (atomic_dec_and_test(&ubu_dev->refcnt)) 98 complete(&ubu_dev->comp); 99 return ret; 100 } 101 > 102 int uburma_close(struct inode *inode, struct file *filp) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Fix index out of bounds in degamma hardware format translation
by Liu Chuang 29 Oct '24

29 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.227 commit c130a3c09e3746c1a09ce26c20d21d449d039b1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9A CVE: CVE-2024-49894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b7e99058eb2e86aabd7a10761e76cae33d22b49f ] Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c index bd9bc51983fe..da7aeb9c4632 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c @@ -560,6 +560,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) { if (j == hw_points - 1) break; + if (i >= TRANSFER_FUNC_POINTS) + return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Fix index out of bounds in degamma hardware format translation
by Liu Chuang 29 Oct '24

29 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.227 commit c130a3c09e3746c1a09ce26c20d21d449d039b1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9A CVE: CVE-2024-49894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b7e99058eb2e86aabd7a10761e76cae33d22b49f ] Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c index bd9bc51983fe..da7aeb9c4632 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c @@ -560,6 +560,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) { if (j == hw_points - 1) break; + if (i >= TRANSFER_FUNC_POINTS) + return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/amd/display: Fix index out of bounds in degamma hardware format translation
by Liu Chuang 29 Oct '24

29 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit b7e99058eb2e86aabd7a10761e76cae33d22b49f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9A CVE: CVE-2024-49894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c index 67a3ba49234e..ad4247061344 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c @@ -482,6 +482,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) { if (j == hw_points - 1) break; + if (i >= TRANSFER_FUNC_POINTS) + return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; -- 2.34.1

2 1

[PATCH OLK-5.10] selinux: fix potential counting error in avc_add_xperms_decision()
by Gu Bowen 29 Oct '24

29 Oct '24

From: Zhen Lei <thunder.leizhen(a)huawei.com> stable inclusion from stable-v5.10.225 commit bbcdda4b0d041fc1302d508321720d6d2c42d083 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0J6P Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 379d9af3f3da2da1bbfa67baf1820c72a080d1f1 upstream. The count increases only when a node is successfully added to the linked list. Cc: stable(a)vger.kernel.org Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") Signed-off-by: Zhen Lei <thunder.leizhen(a)huawei.com> Acked-by: Stephen Smalley <stephen.smalley.work(a)gmail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- security/selinux/avc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/selinux/avc.c b/security/selinux/avc.c index 884a014ce2b8..ab71d0948205 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -332,12 +332,12 @@ static int avc_add_xperms_decision(struct avc_node *node, { struct avc_xperms_decision_node *dest_xpd; - node->ae.xp_node->xp.len++; dest_xpd = avc_xperms_decision_alloc(src->used); if (!dest_xpd) return -ENOMEM; avc_copy_xperms_decision(&dest_xpd->xpd, src); list_add(&dest_xpd->xpd_list, &node->ae.xp_node->xpd_head); + node->ae.xp_node->xp.len++; return 0; } -- 2.25.1

2 1

[PATCH OLK-5.10] randomize_kstack: Improve entropy diffusion
by Gu Bowen 29 Oct '24

29 Oct '24

From: Kees Cook <keescook(a)chromium.org> stable inclusion from stable-v6.6.27 commit 300a2b9c2b28282974ee300bb5d5025cbbb1f64c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0K55 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9c573cd313433f6c1f7236fe64b9b743500c1628 ] The kstack_offset variable was really only ever using the low bits for kernel stack offset entropy. Add a ror32() to increase bit diffusion. Suggested-by: Arnd Bergmann <arnd(a)arndb.de> Fixes: 39218ff4c625 ("stack: Optionally randomize kernel stack offset each syscall") Link: https://lore.kernel.org/r/20240309202445.work.165-kees@kernel.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- include/linux/randomize_kstack.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/randomize_kstack.h b/include/linux/randomize_kstack.h index 91f1b990a3c3..2cfdc53f01f7 100644 --- a/include/linux/randomize_kstack.h +++ b/include/linux/randomize_kstack.h @@ -47,7 +47,7 @@ void *__builtin_alloca(size_t size); if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \ &randomize_kstack_offset)) { \ u32 offset = raw_cpu_read(kstack_offset); \ - offset ^= (rand); \ + offset = ror32(offset, 5) ^ (rand); \ raw_cpu_write(kstack_offset, offset); \ } \ } while (0) -- 2.25.1

2 1

[PATCH OLK-6.6] block: fix integer overflow in BLKSECDISCARD
by Zheng Qixing 29 Oct '24

29 Oct '24

From: Alexey Dobriyan <adobriyan(a)gmail.com> mainline inclusion from mainline-v6.12-rc1 commit 697ba0b6ec4ae04afb67d3911799b5e2043b4455 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAS CVE: CVE-2024-49994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I independently rediscovered commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 block: fix overflow in blk_ioctl_discard() but for secure erase. Same problem: uint64_t r[2] = {512, 18446744073709551104ULL}; ioctl(fd, BLKSECDISCARD, r); will enter near infinite loop inside blkdev_issue_secure_erase(): a.out: attempt to access beyond end of device loop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048 bio_check_eod: 3286214 callbacks suppressed Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> Link: https://lore.kernel.org/r/9e64057f-650a-46d1-b9f7-34af391536ef@p183 Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/ioctl.c [The conflict occurs because commit 881494ed031f ("blk_ioctl_{ discard,zeroout}(): we only want ->bd_inode->i_mapping here...") is not introduced.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/ioctl.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index 9b1ad8b60923..71b1a185c226 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -115,7 +115,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, return -EINVAL; filemap_invalidate_lock(inode->i_mapping); - err = truncate_bdev_range(bdev, mode, start, start + len - 1); + err = truncate_bdev_range(bdev, mode, start, end - 1); if (err) goto fail; err = blkdev_issue_discard(bdev, start >> 9, len >> 9, GFP_KERNEL); @@ -127,7 +127,7 @@ static int blk_ioctl_discard(struct block_device *bdev, blk_mode_t mode, static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode, void __user *argp) { - uint64_t start, len; + uint64_t start, len, end; uint64_t range[2]; int err; @@ -142,11 +142,12 @@ static int blk_ioctl_secure_erase(struct block_device *bdev, blk_mode_t mode, len = range[1]; if ((start & 511) || (len & 511)) return -EINVAL; - if (start + len > bdev_nr_bytes(bdev)) + if (check_add_overflow(start, len, &end) || + end > bdev_nr_bytes(bdev)) return -EINVAL; filemap_invalidate_lock(bdev->bd_inode->i_mapping); - err = truncate_bdev_range(bdev, mode, start, start + len - 1); + err = truncate_bdev_range(bdev, mode, start, end - 1); if (!err) err = blkdev_issue_secure_erase(bdev, start >> 9, len >> 9, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-5.10 v2 0/2] CVE-2024-49955
by liwei 29 Oct '24

29 Oct '24

Armin Wolf (2): ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook drivers/acpi/battery.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1 v2 0/2] CVE-2024-49955
by liwei 29 Oct '24

29 Oct '24

Armin Wolf (2): ACPI: battery: Simplify battery hook locking ACPI: battery: Fix possible crash when unregistering a battery hook drivers/acpi/battery.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) -- 2.25.1

2 3