- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] drm/rockchip: vop: Fix a dereferenced before check warning
by Xiaomeng Zhang 12 Dec '24

12 Dec '24

From: Andy Yan <andy.yan(a)rock-chips.com> stable inclusion from stable-v6.6.63 commit 1e53059729691ca4d905118258b9fbd17d854174 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB956I CVE: CVE-2024-53129 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ab1c793f457f740ab7108cc0b1340a402dbf484d ] The 'state' can't be NULL, we should check crtc_state. Fix warning: drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1096 vop_plane_atomic_async_check() warn: variable dereferenced before check 'state' (see line 1077) Fixes: 5ddb0bd4ddc3 ("drm/atomic: Pass the full state to planes async atomic check and update") Signed-off-by: Andy Yan <andy.yan(a)rock-chips.com> Signed-off-by: Heiko Stuebner <heiko(a)sntech.de> Link: https://patchwork.freedesktop.org/patch/msgid/20241021072818.61621-1-andysh… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c index ee72e8c6ad69..a34d3fc66248 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -1076,10 +1076,10 @@ static int vop_plane_atomic_async_check(struct drm_plane *plane, if (!plane->state->fb) return -EINVAL; - if (state) - crtc_state = drm_atomic_get_existing_crtc_state(state, - new_plane_state->crtc); - else /* Special case for asynchronous cursor updates. */ + crtc_state = drm_atomic_get_existing_crtc_state(state, new_plane_state->crtc); + + /* Special case for asynchronous cursor updates. */ + if (!crtc_state) crtc_state = plane->crtc->state; return drm_atomic_helper_check_plane_state(plane->state, crtc_state, -- 2.34.1

2 1

[openeuler:OLK-6.6 1613/1613] drivers/pci/controller/pci-loongson.c:183:22: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 12 Dec '24

12 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 32b5a32c1bb75a6568def0d708b7c3ac5d99e695 commit: 668ae8b1a55a96a60303d36b81b112a709a324bb [1613/1613] PCI: LS7A2000: fix GPU card error config: loongarch-randconfig-r111-20241210 (https://download.01.org/0day-ci/archive/20241212/202412121706.euopGH6a-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241212/202412121706.euopGH6a-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412121706.euopGH6a-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/pci/controller/pci-loongson.c:183:22: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void volatile * @@ drivers/pci/controller/pci-loongson.c:183:22: sparse: expected void volatile [noderef] __iomem *addr drivers/pci/controller/pci-loongson.c:183:22: sparse: got void volatile * drivers/pci/controller/pci-loongson.c:184:29: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void volatile * @@ drivers/pci/controller/pci-loongson.c:184:29: sparse: expected void volatile [noderef] __iomem *addr drivers/pci/controller/pci-loongson.c:184:29: sparse: got void volatile * drivers/pci/controller/pci-loongson.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, ...): include/linux/page-flags.h:242:46: sparse: sparse: self-comparison always evaluates to false vim +183 drivers/pci/controller/pci-loongson.c 151 152 static void loongson_display_quirk(struct pci_dev *dev) 153 { 154 u32 val; 155 u64 mask, size; 156 u64 max_size = 0; 157 int i, num; 158 struct pci_bus *bus = dev->bus; 159 160 if (!dev->bus->number) { 161 if (!(dev->vendor == PCI_VENDOR_ID_LOONGSON && dev->device == 0x7a25)) 162 return; 163 } else { 164 while (!pci_is_root_bus(bus->parent)) 165 bus = bus->parent; 166 167 /* ensure slot is 7a2000 */ 168 if (bus->self->vendor != PCI_VENDOR_ID_LOONGSON || bus->self->device < 0x7a39) 169 return; 170 } 171 max_size = 0; 172 for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) { 173 if (dev->resource[i].flags & IORESOURCE_MEM) { 174 size = dev->resource[i].end - dev->resource[i].start; 175 if (size > max_size) { 176 max_size = size; 177 num = i; 178 } 179 } 180 } 181 mask = ~(dev->resource[num].end - dev->resource[num].start); 182 val = (dev->resource[num].start >> (24 - 16)) | ((mask >> 24) & 0xffff); > 183 writel(val, (volatile void *)0x80000efdfb000174UL); 184 writel(0x80000000, (volatile void *)0x80000efdfb000170UL); 185 } 186 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_LOONGSON, 0x7a25, loongson_display_quirk); 187 DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID, 188 PCI_BASE_CLASS_DISPLAY, 16, loongson_display_quirk); 189 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2566/2566] drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:545:5: warning: no previous prototype for function 'sss_adm_msg_write'
by kernel test robot 12 Dec '24

12 Dec '24

Hi Steven, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: c17394e022a5504b2d967d70de4c226de003e990 commit: 0c4c3ee2e4947ad6ec346dc37fa133f4fecafd76 [2566/2566] Net: ethernet: Support management channel of the host tool in 3snic 3s9xx network driver config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241212/202412121710.BepF5y8C-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241212/202412121710.BepF5y8C-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412121710.BepF5y8C-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:11: In file included from include/linux/pci.h:1499: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:17: In file included from drivers/net/ethernet/3snic/sssnic/include/sss_kernel.h:7: In file included from drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h:140: include/net/devlink.h:28:19: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 28 | u32 reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:29:26: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 29 | u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:545:5: warning: no previous prototype for function 'sss_adm_msg_write' [-Wmissing-prototypes] 545 | int sss_adm_msg_write(struct sss_adm_msg *adm_msg, u8 node_id, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:545:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 545 | int sss_adm_msg_write(struct sss_adm_msg *adm_msg, u8 node_id, | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:551:5: warning: no previous prototype for function 'sss_adm_msg_read' [-Wmissing-prototypes] 551 | int sss_adm_msg_read(struct sss_adm_msg *adm_msg, u8 node_id, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:551:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 551 | int sss_adm_msg_read(struct sss_adm_msg *adm_msg, u8 node_id, | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:597:5: warning: no previous prototype for function 'sss_adm_msg_read_ack' [-Wmissing-prototypes] 597 | int sss_adm_msg_read_ack(void *hwdev, u8 dest, const void *cmd, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:597:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 597 | int sss_adm_msg_read_ack(void *hwdev, u8 dest, const void *cmd, | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:618:5: warning: no previous prototype for function 'sss_adm_msg_write_nack' [-Wmissing-prototypes] 618 | int sss_adm_msg_write_nack(void *hwdev, u8 dest, const void *cmd, u16 size) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:618:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 618 | int sss_adm_msg_write_nack(void *hwdev, u8 dest, const void *cmd, u16 size) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:682:5: warning: no previous prototype for function 'sss_sync_send_adm_msg' [-Wmissing-prototypes] 682 | int sss_sync_send_adm_msg(void *hwdev, u8 mod, u16 cmd, void *buf_in, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c:682:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 682 | int sss_sync_send_adm_msg(void *hwdev, u8 mod, u16 cmd, void *buf_in, | ^ | static 12 warnings generated. -- In file included from drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:11: In file included from include/linux/pci.h:1499: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:17: In file included from drivers/net/ethernet/3snic/sssnic/include/sss_kernel.h:7: In file included from drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h:140: include/net/devlink.h:28:19: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 28 | u32 reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:29:26: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 29 | u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:580:6: warning: no previous prototype for function 'sss_destroy_adm_msg' [-Wmissing-prototypes] 580 | void sss_destroy_adm_msg(struct sss_adm_msg *adm_msg) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:580:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 580 | void sss_destroy_adm_msg(struct sss_adm_msg *adm_msg) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:689:5: warning: no previous prototype for function 'sss_hwif_init_adm' [-Wmissing-prototypes] 689 | int sss_hwif_init_adm(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:689:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 689 | int sss_hwif_init_adm(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:738:6: warning: no previous prototype for function 'sss_hwif_deinit_adm' [-Wmissing-prototypes] 738 | void sss_hwif_deinit_adm(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:738:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 738 | void sss_hwif_deinit_adm(struct sss_hwdev *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:752:6: warning: no previous prototype for function 'sss_complete_adm_event' [-Wmissing-prototypes] 752 | void sss_complete_adm_event(struct sss_hwdev *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm_init.c:752:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 752 | void sss_complete_adm_event(struct sss_hwdev *hwdev) | ^ | static 11 warnings generated. -- In file included from include/net/ipv6.h:12: In file included from include/linux/ipv6.h:93: In file included from include/linux/tcp.h:17: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:14: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:9: In file included from drivers/net/ethernet/3snic/sssnic/include/sss_kernel.h:7: In file included from drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h:140: include/net/devlink.h:28:19: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 28 | u32 reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:29:26: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 29 | u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:15:5: warning: no previous prototype for function 'sss_alloc_db_addr' [-Wmissing-prototypes] 15 | int sss_alloc_db_addr(void *hwdev, void __iomem **db_base) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:15:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 15 | int sss_alloc_db_addr(void *hwdev, void __iomem **db_base) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:37:6: warning: no previous prototype for function 'sss_free_db_addr' [-Wmissing-prototypes] 37 | void sss_free_db_addr(void *hwdev, const void __iomem *db_base) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:37:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 37 | void sss_free_db_addr(void *hwdev, const void __iomem *db_base) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:52:6: warning: no previous prototype for function 'sss_chip_set_msix_auto_mask' [-Wmissing-prototypes] 52 | void sss_chip_set_msix_auto_mask(void *hwdev, u16 msix_id, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:52:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 52 | void sss_chip_set_msix_auto_mask(void *hwdev, u16 msix_id, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:70:6: warning: no previous prototype for function 'sss_chip_set_msix_state' [-Wmissing-prototypes] 70 | void sss_chip_set_msix_state(void *hwdev, u16 msix_id, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:70:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 70 | void sss_chip_set_msix_state(void *hwdev, u16 msix_id, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:86:5: warning: no previous prototype for function 'sss_get_global_func_id' [-Wmissing-prototypes] 86 | u16 sss_get_global_func_id(void *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:86:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 86 | u16 sss_get_global_func_id(void *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:95:4: warning: no previous prototype for function 'sss_get_pf_id_of_vf' [-Wmissing-prototypes] 95 | u8 sss_get_pf_id_of_vf(void *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:95:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 95 | u8 sss_get_pf_id_of_vf(void *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:104:4: warning: no previous prototype for function 'sss_get_pcie_itf_id' [-Wmissing-prototypes] 104 | u8 sss_get_pcie_itf_id(void *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:104:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 104 | u8 sss_get_pcie_itf_id(void *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:113:20: warning: no previous prototype for function 'sss_get_func_type' [-Wmissing-prototypes] 113 | enum sss_func_type sss_get_func_type(void *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:113:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 113 | enum sss_func_type sss_get_func_type(void *hwdev) | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:122:20: warning: no previous prototype for function 'sss_get_func_id' [-Wmissing-prototypes] 122 | enum sss_func_type sss_get_func_id(void *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:122:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 122 | enum sss_func_type sss_get_func_id(void *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:131:5: warning: no previous prototype for function 'sss_get_glb_pf_vf_offset' [-Wmissing-prototypes] 131 | u16 sss_get_glb_pf_vf_offset(void *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:131:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 131 | u16 sss_get_glb_pf_vf_offset(void *hwdev) | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:140:4: warning: no previous prototype for function 'sss_get_ppf_id' [-Wmissing-prototypes] 140 | u8 sss_get_ppf_id(void *hwdev) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_export.c:140:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 140 | u8 sss_get_ppf_id(void *hwdev) | ^ | static 18 warnings generated. -- In file included from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:6: In file included from include/net/sock.h:46: In file included from include/linux/netdevice.h:37: In file included from include/linux/ethtool.h:18: In file included from include/linux/netlink.h:7: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:14: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:14: In file included from drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h:140: include/net/devlink.h:28:19: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 28 | u32 reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:29:26: warning: arithmetic between different enumeration types ('enum devlink_reload_limit' and 'enum devlink_reload_action') [-Wenum-enum-conversion] 29 | u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE]; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/devlink.h:25:30: note: expanded from macro 'DEVLINK_RELOAD_STATS_ARRAY_SIZE' 25 | (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) | ~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:80:6: warning: no previous prototype for function 'sss_tool_free_in_buf' [-Wmissing-prototypes] 80 | void sss_tool_free_in_buf(void *hwdev, const struct sss_tool_msg *tool_msg, void *in_buf) | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:80:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 80 | void sss_tool_free_in_buf(void *hwdev, const struct sss_tool_msg *tool_msg, void *in_buf) | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:91:6: warning: no previous prototype for function 'sss_tool_free_out_buf' [-Wmissing-prototypes] 91 | void sss_tool_free_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:91:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 91 | void sss_tool_free_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:104:5: warning: no previous prototype for function 'sss_tool_alloc_in_buf' [-Wmissing-prototypes] 104 | int sss_tool_alloc_in_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:104:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 104 | int sss_tool_alloc_in_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:146:5: warning: no previous prototype for function 'sss_tool_alloc_out_buf' [-Wmissing-prototypes] 146 | int sss_tool_alloc_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:146:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 146 | int sss_tool_alloc_out_buf(void *hwdev, struct sss_tool_msg *tool_msg, | ^ | static >> drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:182:5: warning: no previous prototype for function 'sss_tool_copy_to_user' [-Wmissing-prototypes] 182 | int sss_tool_copy_to_user(struct sss_tool_msg *tool_msg, | ^ drivers/net/ethernet/3snic/sssnic/hw/./tool/sss_tool_main.c:182:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 182 | int sss_tool_copy_to_user(struct sss_tool_msg *tool_msg, | ^ | static 12 warnings generated. .. vim +/sss_adm_msg_write +545 drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_adm.c 544 > 545 int sss_adm_msg_write(struct sss_adm_msg *adm_msg, u8 node_id, 546 const void *cmd, u16 cmd_size) 547 { 548 return sss_adm_msg_io(adm_msg, node_id, cmd, cmd_size, NULL, 0); 549 } 550 > 551 int sss_adm_msg_read(struct sss_adm_msg *adm_msg, u8 node_id, 552 const void *cmd, u16 size, void *ack, u16 ack_size) 553 { 554 return sss_adm_msg_io(adm_msg, node_id, cmd, size, ack, ack_size); 555 } 556 557 static void sss_set_adm_event_flag(struct sss_msg_pf_to_mgmt *pf_to_mgmt, 558 int event_flag) 559 { 560 spin_lock(&pf_to_mgmt->sync_event_lock); 561 pf_to_mgmt->event_state = event_flag; 562 spin_unlock(&pf_to_mgmt->sync_event_lock); 563 } 564 565 static u16 sss_align_adm_msg_len(u16 msg_data_len) 566 { 567 /* u64 - the size of the header */ 568 u16 msg_size; 569 570 msg_size = (u16)(SSS_MGMT_MSG_RSVD_FOR_DEV + sizeof(u64) + msg_data_len); 571 572 if (msg_size > SSS_MGMT_MSG_SIZE_MIN) 573 msg_size = SSS_MGMT_MSG_SIZE_MIN + 574 ALIGN((msg_size - SSS_MGMT_MSG_SIZE_MIN), SSS_MGMT_MSG_SIZE_STEP); 575 else 576 msg_size = SSS_MGMT_MSG_SIZE_MIN; 577 578 return msg_size; 579 } 580 581 static void sss_encapsulate_adm_msg(u8 *adm_msg, u64 *header, 582 const void *body, int body_len) 583 { 584 u8 *adm_msg_new = adm_msg; 585 586 memset(adm_msg_new, 0, SSS_MGMT_MSG_RSVD_FOR_DEV); 587 588 adm_msg_new += SSS_MGMT_MSG_RSVD_FOR_DEV; 589 memcpy(adm_msg_new, header, sizeof(*header)); 590 591 adm_msg_new += sizeof(*header); 592 memcpy(adm_msg_new, body, (size_t)(u32)body_len); 593 } 594 595 #define SSS_MAX_PF_MGMT_BUF_MAX 2048L 596 > 597 int sss_adm_msg_read_ack(void *hwdev, u8 dest, const void *cmd, 598 u16 size, void *ack, u16 ack_size) 599 { 600 struct sss_msg_pf_to_mgmt *pf_to_mgmt = NULL; 601 struct sss_adm_msg *adm_mag = NULL; 602 603 if (!hwdev || !cmd || (ack_size && !ack) || size > SSS_MAX_PF_MGMT_BUF_MAX) 604 return -EINVAL; 605 606 if (!SSS_SUPPORT_ADM_MSG((struct sss_hwdev *)hwdev)) 607 return -EPERM; 608 609 pf_to_mgmt = ((struct sss_hwdev *)hwdev)->pf_to_mgmt; 610 adm_mag = pf_to_mgmt->adm_msg[SSS_ADM_MSG_POLL_READ]; 611 612 if (!(((struct sss_hwdev *)hwdev)->chip_present_flag)) 613 return -EPERM; 614 615 return sss_adm_msg_read(adm_mag, dest, cmd, size, ack, ack_size); 616 } 617 > 618 int sss_adm_msg_write_nack(void *hwdev, u8 dest, const void *cmd, u16 size) 619 { 620 struct sss_msg_pf_to_mgmt *pf_to_mgmt = NULL; 621 struct sss_adm_msg *adm_mag = NULL; 622 623 if (!hwdev || !size || !cmd || size > SSS_MAX_PF_MGMT_BUF_MAX) 624 return -EINVAL; 625 626 if (!SSS_SUPPORT_ADM_MSG((struct sss_hwdev *)hwdev)) 627 return -EPERM; 628 629 pf_to_mgmt = ((struct sss_hwdev *)hwdev)->pf_to_mgmt; 630 adm_mag = pf_to_mgmt->adm_msg[SSS_ADM_MSG_POLL_WRITE]; 631 632 if (!(((struct sss_hwdev *)hwdev)->chip_present_flag)) 633 return -EPERM; 634 635 return sss_adm_msg_write(adm_mag, dest, cmd, size); 636 } 637 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Pedro Tammela <pctammela(a)mojatatu.com> stable inclusion from stable-v4.19.323 commit e7f9a6f97eb067599a74f3bcb6761976b0ed303e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KR7 CVE: CVE-2024-53057 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e95c4384438adeaa772caa560244b1a2efef816 ] In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. Fixes: 066a3b5b2346 ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Suggested-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Tested-by: Victor Nogueira <victor(a)mojatatu.com> Signed-off-by: Pedro Tammela <pctammela(a)mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20241024165547.418570-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Zhang Changzhong <zhangchangzhong(a)huaiwei.com> --- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 458f9e733cf0..36a5d3ceead2 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -783,7 +783,7 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, unsigned int n, drops = max_t(int, n, 0); rcu_read_lock(); while ((parentid = sch->parent)) { - if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS)) + if (parentid == TC_H_ROOT) break; if (sch->flags & TCQ_F_NOPARENT) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v4.19.323 commit a661ed364ae6ae88c2fafa9ddc27df1af2a73701 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AM CVE: CVE-2024-50251 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d5953d680f7e96208c29ce4139a0e38de87a57fe ] If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed. Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support") Reported-by: Slavin Liu <slavin-ayu(a)qq.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_payload.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c index fd87216bc0a9..904652b226a7 100644 --- a/net/netfilter/nft_payload.c +++ b/net/netfilter/nft_payload.c @@ -306,6 +306,9 @@ static void nft_payload_set_eval(const struct nft_expr *expr, if ((priv->csum_type == NFT_PAYLOAD_CSUM_INET || priv->csum_flags) && (priv->base != NFT_PAYLOAD_TRANSPORT_HEADER || skb->ip_summed != CHECKSUM_PARTIAL)) { + if (offset + priv->len > skb->len) + goto err; + fsum = skb_checksum(skb, offset, priv->len, 0); tsum = csum_partial(src, priv->len, 0); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] be2net: fix potential memory leak in be_xmit()
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Wang Hai <wanghai38(a)huawei.com> stable inclusion from stable-v4.19.323 commit 941026023c256939943a47d1c66671526befbb26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2STK CVE: CVE-2024-50167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4dd8bfe0f6a23acd305f9b892c00899089bd621 ] The be_xmit() returns NETDEV_TX_OK without freeing skb in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it. Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Message-ID: <20241015144802.12150-1-wanghai38(a)huawei.com> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/emulex/benet/be_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c index 3fe6a28027fe..63a0156922b4 100644 --- a/drivers/net/ethernet/emulex/benet/be_main.c +++ b/drivers/net/ethernet/emulex/benet/be_main.c @@ -1385,10 +1385,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) be_get_wrb_params_from_skb(adapter, skb, &wrb_params); wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); - if (unlikely(!wrb_cnt)) { - dev_kfree_skb_any(skb); - goto drop; - } + if (unlikely(!wrb_cnt)) + goto drop_skb; /* if os2bmc is enabled and if the pkt is destined to bmc, * enqueue the pkt a 2nd time with mgmt bit set. @@ -1397,7 +1395,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) BE_WRB_F_SET(wrb_params.features, OS2BMC, 1); wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); if (unlikely(!wrb_cnt)) - goto drop; + goto drop_skb; else skb_get(skb); } @@ -1411,6 +1409,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) be_xmit_flush(adapter, txo); return NETDEV_TX_OK; +drop_skb: + dev_kfree_skb_any(skb); drop: tx_stats(txo)->tx_drv_drops++; /* Flush the already enqueued tx requests */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Wang Hai <wanghai38(a)huawei.com> stable inclusion from stable-v4.19.323 commit 137010d26dc5cd47cd62fef77cbe952d31951b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SUF CVE: CVE-2024-50168 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8 ] The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb in case of skb->len being too long, add dev_kfree_skb() to fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Message-ID: <20241015144148.7918-1-wanghai38(a)huawei.com> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/i825xx/sun3_82586.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c index 1a86184d44c0..0f0304043070 100644 --- a/drivers/net/ethernet/i825xx/sun3_82586.c +++ b/drivers/net/ethernet/i825xx/sun3_82586.c @@ -1015,6 +1015,7 @@ sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev) if(skb->len > XMIT_BUFF_SIZE) { printk("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n",dev->name,XMIT_BUFF_SIZE,skb->len); + dev_kfree_skb(skb); return NETDEV_TX_OK; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Bluetooth: Fix CVE-2024-50125
by Dong Chenchen 12 Dec '24

12 Dec '24

Fix CVE-2024-50125 Desmond Cheong Zhi Xi (1): Bluetooth: call sock_hold earlier in sco_conn_del Luiz Augusto von Dentz (1): Bluetooth: SCO: Fix UAF on sco_sock_timeout include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 22 ++++++++++++++++++++++ net/bluetooth/sco.c | 17 ++++++++++++----- 3 files changed, 35 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] drm/amd/display: Adjust VSDB parser for replay feature
by Yuan Can 12 Dec '24

12 Dec '24

From: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> mainline inclusion from mainline-v6.12 commit 16dd2825c23530f2259fc671960a3a65d2af69bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB8IUF CVE: CVE-2024-53108 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At some point, the IEEE ID identification for the replay check in the AMD EDID was added. However, this check causes the following out-of-bounds issues when using KASAN: [ 27.804016] BUG: KASAN: slab-out-of-bounds in amdgpu_dm_update_freesync_caps+0xefa/0x17a0 [amdgpu] [ 27.804788] Read of size 1 at addr ffff8881647fdb00 by task systemd-udevd/383 ... [ 27.821207] Memory state around the buggy address: [ 27.821215] ffff8881647fda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821224] ffff8881647fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821234] >ffff8881647fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821243] ^ [ 27.821250] ffff8881647fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821259] ffff8881647fdc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821268] ================================================================== This is caused because the ID extraction happens outside of the range of the edid lenght. This commit addresses this issue by considering the amd_vsdb_block size. Cc: ChiaHsuan Chung <chiahsuan.chung(a)amd.com> Reviewed-by: Leo Li <sunpeng.li(a)amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit b7e381b1ccd5e778e3d9c44c669ad38439a861d8) Cc: stable(a)vger.kernel.org Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 1b7b92000e6e..f729acc5ea35 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -10729,7 +10729,7 @@ static int parse_amd_vsdb(struct amdgpu_dm_connector *aconnector, break; } - while (j < EDID_LENGTH) { + while (j < EDID_LENGTH - sizeof(struct amd_vsdb_block)) { struct amd_vsdb_block *amd_vsdb = (struct amd_vsdb_block *)&edid_ext[j]; unsigned int ieeeId = (amd_vsdb->ieee_id[2] << 16) | (amd_vsdb->ieee_id[1] << 8) | (amd_vsdb->ieee_id[0]); -- 2.22.0

2 1

[PATCH OLK-6.6 0/4] crypto: hisilicon/sec2 - the aead algorithm of sec2 is fixed.
by Weili Qian 12 Dec '24

12 Dec '24

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (2): crypto: hisilicon/qm - disable error report before flr crypto: hisilicon/trng - support to obtain random numbers from soft algorithm Wenkai Lin (2): crypto: hisilicon/sec2 - fix for aead icv error crypto: hisilicon/sec2 - fix for aead invalid authsize drivers/crypto/hisilicon/Kconfig | 1 + drivers/crypto/hisilicon/qm.c | 49 ++++--- drivers/crypto/hisilicon/sec2/sec.h | 3 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 161 ++++++++++----------- drivers/crypto/hisilicon/sec2/sec_crypto.h | 11 -- drivers/crypto/hisilicon/trng/trng.c | 52 ++++++- 6 files changed, 156 insertions(+), 121 deletions(-) -- 2.43.0

2 5