- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] netfilter: nft_flow_offload: reset dst in route object after setting up flow
by Liu Jian 22 May '24

22 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8-rc6 commit 9e0f0430389be7696396c62f037be4bf72cf93e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LQ CVE: CVE-2024-27403 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow. Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_flow_table.h net/netfilter/nf_flow_table_core.c [This is because we did not backport fa502c865666, 8b9229d15877, 7a27f6ab4135] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/netfilter/nf_flow_table.h | 2 +- net/netfilter/nf_flow_table_core.c | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index b338638f2279..b49dfb415bad 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -207,7 +207,7 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, } int flow_offload_route_init(struct flow_offload *flow, - const struct nf_flow_route *route); + struct nf_flow_route *route); int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); void flow_offload_refresh(struct nf_flowtable *flow_table, diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index d091d51b5e19..5a5faefb181d 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -74,13 +74,23 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct) } EXPORT_SYMBOL_GPL(flow_offload_alloc); +static struct dst_entry *nft_route_dst_fetch(struct nf_flow_route *route, + enum flow_offload_tuple_dir dir) +{ + struct dst_entry *dst = route->tuple[dir].dst; + + route->tuple[dir].dst = NULL; + + return dst; +} + static int flow_offload_fill_route(struct flow_offload *flow, - const struct nf_flow_route *route, + struct nf_flow_route *route, enum flow_offload_tuple_dir dir) { struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple; struct dst_entry *other_dst = route->tuple[!dir].dst; - struct dst_entry *dst = route->tuple[dir].dst; + struct dst_entry *dst = nft_route_dst_fetch(route, dir); if (!dst_hold_safe(route->tuple[dir].dst)) return -1; @@ -101,7 +111,7 @@ static int flow_offload_fill_route(struct flow_offload *flow, } int flow_offload_route_init(struct flow_offload *flow, - const struct nf_flow_route *route) + struct nf_flow_route *route) { int err; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK5.10 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS V2 0/2] Fix CVE-2023-52656
by Zizhi Wo 22 May '24

22 May '24

V2: fix an undeclared error with io_uring_fops V1: fix main error Jens Axboe (2): io_uring/unix: drop usage of io_uring socket io_uring: drop any code related to SCM_RIGHTS fs/io_uring.c | 212 +-------------------------------------------- include/linux/fs.h | 6 +- net/core/scm.c | 2 +- net/unix/scm.c | 4 +- 4 files changed, 8 insertions(+), 216 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 13 ++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP2 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 13 ++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 13 ++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 13 ++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] i2c: smbus: fix NULL function pointer dereference
by Zhao Mengmeng 22 May '24

22 May '24

From: Wolfram Sang <wsa+renesas(a)sang-engineering.com> stable inclusion from stable-v4.19.313 commit 40f1d79f07b49c8a64a861706e5163f2db4bd95d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRRJ CVE: CVE-2024-35984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ] Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. Reported-by: Baruch Siach <baruch(a)tkos.co.il> Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.17127619… Fixes: 4b1acc43331d ("i2c: core changes for slave support") [wsa: dropped the simplification in core-smbus to avoid theoretical regressions] Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Tested-by: Baruch Siach <baruch(a)tkos.co.il> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- drivers/i2c/i2c-core-base.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index fdf644b53972..366bd86285d6 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -1911,13 +1911,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs, * Returns negative errno, else the number of messages executed. * * Adapter lock must be held when calling this function. No debug logging - * takes place. adap->algo->master_xfer existence isn't checked. + * takes place. */ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { unsigned long orig_jiffies; int ret, try; + if (!adap->algo->master_xfer) { + dev_dbg(&adap->dev, "I2C level transfers not supported\n"); + return -EOPNOTSUPP; + } + if (WARN_ON(!msgs || num < 1)) return -EINVAL; -- 2.33.0

2 1

[PATCH v2 OLK-5.10 0/2] Fix CVE-2024-35896 and CVE-2024-35962
by Zhao Mengmeng 22 May '24

22 May '24

Fix CVE-2024-35896 and CVE-2024-35962 Eric Dumazet (2): netfilter: validate user input for expected length netfilter: complete validation of user input net/bridge/netfilter/ebtables.c | 6 ++++++ net/ipv4/netfilter/arp_tables.c | 8 ++++++++ net/ipv4/netfilter/ip_tables.c | 8 ++++++++ net/ipv6/netfilter/ip6_tables.c | 8 ++++++++ 4 files changed, 30 insertions(+) -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] powerpc/powernv: Add a null pointer check in opal_event_init()
by Guo Mengqi 22 May '24

22 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v4.19.306 commit 8422d179cf46889c15ceff9ede48c5bfa4e7f0b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9IH CVE: CVE-2023-52686 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ] kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: 2717a33d6074 ("powerpc/opal-irqchip: Use interrupt names if present") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231127030755.1546750-1-chentao@kylinos.cn Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c index bc97770a67db..e71f2111c8c0 100644 --- a/arch/powerpc/platforms/powernv/opal-irqchip.c +++ b/arch/powerpc/platforms/powernv/opal-irqchip.c @@ -282,6 +282,8 @@ int __init opal_event_init(void) else name = kasprintf(GFP_KERNEL, "opal"); + if (!name) + continue; /* Install interrupt handler */ rc = request_irq(r->start, opal_interrupt, r->flags & IRQD_TRIGGER_MASK, name, NULL); -- 2.17.1

2 1

[PATCH OLK-5.10] i2c: smbus: fix NULL function pointer dereference
by Zhao Mengmeng 22 May '24

22 May '24

From: Wolfram Sang <wsa+renesas(a)sang-engineering.com> stable inclusion from stable-v5.10.216 commit 5fd72404587d7db4acb2d241fd8c387afb0a7aec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRRJ CVE: CVE-2024-35984 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f ] Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. Reported-by: Baruch Siach <baruch(a)tkos.co.il> Closes: https://lore.kernel.org/r/4269631780e5ba789cf1ae391eec1b959def7d99.17127619… Fixes: 4b1acc43331d ("i2c: core changes for slave support") [wsa: dropped the simplification in core-smbus to avoid theoretical regressions] Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Tested-by: Baruch Siach <baruch(a)tkos.co.il> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- drivers/i2c/i2c-core-base.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 40e05f762a1b..f86741ba8a00 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2060,13 +2060,18 @@ static int i2c_check_for_quirks(struct i2c_adapter *adap, struct i2c_msg *msgs, * Returns negative errno, else the number of messages executed. * * Adapter lock must be held when calling this function. No debug logging - * takes place. adap->algo->master_xfer existence isn't checked. + * takes place. */ int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { unsigned long orig_jiffies; int ret, try; + if (!adap->algo->master_xfer) { + dev_dbg(&adap->dev, "I2C level transfers not supported\n"); + return -EOPNOTSUPP; + } + if (WARN_ON(!msgs || num < 1)) return -EINVAL; @@ -2133,11 +2138,6 @@ int i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) { int ret; - if (!adap->algo->master_xfer) { - dev_dbg(&adap->dev, "I2C level transfers not supported\n"); - return -EOPNOTSUPP; - } - /* REVISIT the fault reporting model here is weak: * * - When we get an error after receiving N bytes from a slave, -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] selinux: avoid dereference of garbage after mount failure
by felix 22 May '24

22 May '24

From: Christian Göttsche <cgzones(a)googlemail.com> stable inclusion from stable-v6.6.26 commit 477ed6789eb9f3f4d3568bb977f90c863c12724e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG73 CVE: CVE-2024-35904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 37801a36b4d68892ce807264f784d818f8d0d39b upstream. In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount. Cc: stable(a)vger.kernel.org Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state") Signed-off-by: Christian Göttsche <cgzones(a)googlemail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: security/selinux/selinuxfs.c [commit cd2bb4cb0996 db478cd60d55 was not merged, but it only adjust the attr of selinuxfs_mount, finally we delete it, so it does not affect the patch] Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/selinux/selinuxfs.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 4f72d0998580..7edf19dbb58a 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -2028,7 +2028,6 @@ static struct file_system_type sel_fs_type = { .kill_sb = sel_kill_sb, }; -struct vfsmount *selinuxfs_mount; struct path selinux_null; static int __init init_sel_fs(void) @@ -2050,18 +2049,21 @@ static int __init init_sel_fs(void) return err; } - selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type); - if (IS_ERR(selinuxfs_mount)) { + selinux_null.mnt = kern_mount(&sel_fs_type); + if (IS_ERR(selinux_null.mnt)) { pr_err("selinuxfs: could not mount!\n"); - err = PTR_ERR(selinuxfs_mount); - selinuxfs_mount = NULL; + err = PTR_ERR(selinux_null.mnt); + selinux_null.mnt = NULL; + return err; } + selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root, &null_name); if (IS_ERR(selinux_null.dentry)) { pr_err("selinuxfs: could not lookup null!\n"); err = PTR_ERR(selinux_null.dentry); selinux_null.dentry = NULL; + return err; } return err; -- 2.34.1

2 1

[PATCH OLK-5.10] selinux: avoid dereference of garbage after mount failure
by felix 22 May '24

22 May '24

From: Christian Göttsche <cgzones(a)googlemail.com> stable inclusion from stable-v6.6.26 commit 477ed6789eb9f3f4d3568bb977f90c863c12724e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG73 CVE: CVE-2024-35904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 37801a36b4d68892ce807264f784d818f8d0d39b upstream. In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount. Cc: stable(a)vger.kernel.org Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state") Signed-off-by: Christian Göttsche <cgzones(a)googlemail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: security/selinux/selinuxfs.c [commit cd2bb4cb0996 db478cd60d55 was not merged, but it only adjust the attr of selinuxfs_mount, finally we delete it, so it does not affect the patch] Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/selinux/selinuxfs.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index d893c2280f59..b45fb2924476 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -2205,7 +2205,6 @@ static struct file_system_type sel_fs_type = { .kill_sb = sel_kill_sb, }; -struct vfsmount *selinuxfs_mount; struct path selinux_null; static int __init init_sel_fs(void) @@ -2227,18 +2226,21 @@ static int __init init_sel_fs(void) return err; } - selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type); - if (IS_ERR(selinuxfs_mount)) { + selinux_null.mnt = kern_mount(&sel_fs_type); + if (IS_ERR(selinux_null.mnt)) { pr_err("selinuxfs: could not mount!\n"); - err = PTR_ERR(selinuxfs_mount); - selinuxfs_mount = NULL; + err = PTR_ERR(selinux_null.mnt); + selinux_null.mnt = NULL; + return err; } + selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root, &null_name); if (IS_ERR(selinux_null.dentry)) { pr_err("selinuxfs: could not lookup null!\n"); err = PTR_ERR(selinux_null.dentry); selinux_null.dentry = NULL; + return err; } return err; -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: complete validation of user input
by Zhao Mengmeng 22 May '24

22 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.216 commit cf4bc359b76144a3dd55d7c09464ef4c5f2b2b05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRRU CVE: CVE-2024-35962 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 65acf6e0501ac8880a4f73980d01b5d27648b956 ] In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls. In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check: if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL; Fixes: 0c83842df40f ("netfilter: validate user input for expected length") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://lore.kernel.org/r/20240409120741.3538135-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/ipv4/netfilter/arp_tables.c | 4 ++++ net/ipv4/netfilter/ip_tables.c | 4 ++++ net/ipv6/netfilter/ip6_tables.c | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c index 48c6aa3d91ae..5823e89b8a73 100644 --- a/net/ipv4/netfilter/arp_tables.c +++ b/net/ipv4/netfilter/arp_tables.c @@ -965,6 +965,8 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len) return -ENOMEM; if (tmp.num_counters == 0) return -EINVAL; + if ((u64)len < (u64)tmp.size + sizeof(tmp)) + return -EINVAL; tmp.name[sizeof(tmp.name)-1] = 0; @@ -1265,6 +1267,8 @@ static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) return -ENOMEM; if (tmp.num_counters == 0) return -EINVAL; + if ((u64)len < (u64)tmp.size + sizeof(tmp)) + return -EINVAL; tmp.name[sizeof(tmp.name)-1] = 0; diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index b46d58b9f3fe..22e9ff592cd7 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1119,6 +1119,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len) return -ENOMEM; if (tmp.num_counters == 0) return -EINVAL; + if ((u64)len < (u64)tmp.size + sizeof(tmp)) + return -EINVAL; tmp.name[sizeof(tmp.name)-1] = 0; @@ -1505,6 +1507,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) return -ENOMEM; if (tmp.num_counters == 0) return -EINVAL; + if ((u64)len < (u64)tmp.size + sizeof(tmp)) + return -EINVAL; tmp.name[sizeof(tmp.name)-1] = 0; diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index d013395be05f..df7cd3d285e4 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1137,6 +1137,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len) return -ENOMEM; if (tmp.num_counters == 0) return -EINVAL; + if ((u64)len < (u64)tmp.size + sizeof(tmp)) + return -EINVAL; tmp.name[sizeof(tmp.name)-1] = 0; @@ -1515,6 +1517,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) return -ENOMEM; if (tmp.num_counters == 0) return -EINVAL; + if ((u64)len < (u64)tmp.size + sizeof(tmp)) + return -EINVAL; tmp.name[sizeof(tmp.name)-1] = 0; -- 2.33.0

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: iwlwifi: dbg-tlv: ensure NUL termination
by Zheng Yejian 22 May '24

22 May '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.10.214 commit fabe2db7de32a881e437ee69db32e0de785a6209 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9E2 CVE: CVE-2024-35845 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ] The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it. Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Gregory Greenman <gregory.greenman(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://msgid.link/20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c index 3c931b1b2a0b..304277376502 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c @@ -155,6 +155,12 @@ static int iwl_dbg_tlv_alloc_debug_info(struct iwl_trans *trans, if (le32_to_cpu(tlv->length) != sizeof(*debug_info)) return -EINVAL; + /* we use this as a string, ensure input was NUL terminated */ + if (strnlen(debug_info->debug_cfg_name, + sizeof(debug_info->debug_cfg_name)) == + sizeof(debug_info->debug_cfg_name)) + return -EINVAL; + IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n", debug_info->debug_cfg_name); -- 2.25.1

2 1

[PATCH OLK-5.10] LoongArch: Define the __io_aw() hook as mmiowb()
by Hui Tang 22 May '24

22 May '24

From: Huacai Chen <chenhuacai(a)loongson.cn> mainline inclusion from mainline-v6.9-rc1 commit 9c68ece8b2a5c5ff9b2fcaea923dd73efeb174cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q939 CVE: CVE-2024-35818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit fb24ea52f78e0d595852e ("drivers: Remove explicit invocations of mmiowb()") remove all mmiowb() in drivers, but it says: "NOTE: mmiowb() has only ever guaranteed ordering in conjunction with spin_unlock(). However, pairing each mmiowb() removal in this patch with the corresponding call to spin_unlock() is not at all trivial, so there is a small chance that this change may regress any drivers incorrectly relying on mmiowb() to order MMIO writes between CPUs using lock-free synchronisation." The mmio in radeon_ring_commit() is protected by a mutex rather than a spinlock, but in the mutex fastpath it behaves similar to spinlock. We can add mmiowb() calls in the radeon driver but the maintainer says he doesn't like such a workaround, and radeon is not the only example of mutex protected mmio. So we should extend the mmiowb tracking system from spinlock to mutex, and maybe other locking primitives. This is not easy and error prone, so we solve it in the architectural code, by simply defining the __io_aw() hook as mmiowb(). And we no longer need to override queued_spin_unlock() so use the generic definition. Without this, we get such an error when run 'glxgears' on weak ordering architectures such as LoongArch: radeon 0000:04:00.0: ring 0 stalled for more than 10324msec radeon 0000:04:00.0: ring 3 stalled for more than 10240msec radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000001f412 last fence id 0x000000000001f414 on ring 3) radeon 0000:04:00.0: GPU lockup (current fence id 0x000000000000f940 last fence id 0x000000000000f941 on ring 0) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) radeon 0000:04:00.0: scheduling IB failed (-35). [drm:radeon_gem_va_ioctl [radeon]] *ERROR* Couldn't update BO_VA (-35) Link: https://lore.kernel.org/dri-devel/29df7e26-d7a8-4f67-b988-44353c4270ac@amd.… Link: https://lore.kernel.org/linux-arch/20240301130532.3953167-1-chenhuacai@loon… Cc: stable(a)vger.kernel.org Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Conflicts: arch/loongarch/include/asm/qspinlock.h arch/loongarch/include/asm/Kbuild Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- arch/loongarch/include/asm/io.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/loongarch/include/asm/io.h b/arch/loongarch/include/asm/io.h index 5207da7c2a82..50cf485423a1 100644 --- a/arch/loongarch/include/asm/io.h +++ b/arch/loongarch/include/asm/io.h @@ -72,6 +72,8 @@ extern void __memcpy_fromio(void *to, const volatile void __iomem *from, size_t #define memcpy_fromio(a, c, l) __memcpy_fromio((a), (c), (l)) #define memcpy_toio(c, a, l) __memcpy_toio((c), (a), (l)) +#define __io_aw() mmiowb() + #include <asm-generic/io.h> #endif /* _ASM_IO_H */ -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: validate user input for expected length
by Zhao Mengmeng 22 May '24

22 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.215 commit 0f038242b77ddfc505bf4163d4904c1abd2e74d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG86 CVE: CVE-2024-35896 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c83842df40f86e529db6842231154772c20edcc upstream. I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 ("bpf: Try to avoid kzalloc in cgroup/{s,g}etsockopt") setsockopt() @optlen argument should be taken into account before copying data. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline] BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627 Read of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238 CPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline] do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627 nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x72/0x7a RIP: 0033:0x7fd22067dde9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9 RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000 R10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8 </TASK> Allocated by task 7238: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4069 [inline] __kmalloc_noprof+0x200/0x410 mm/slub.c:4082 kmalloc_noprof include/linux/slab.h:664 [inline] __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x72/0x7a The buggy address belongs to the object at ffff88802cd73da0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes inside of allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73 flags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff) page_type: 0xffffefff(slab) raw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122 raw: ffff88802cd73020 000000008080007f 00000001ffffefff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5103, tgid 2119833701 (syz-executor.4), ts 5103, free_ts 70804600828 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1490 prep_new_page mm/page_alloc.c:1498 [inline] get_page_from_freelist+0x2e7e/0x2f40 mm/page_alloc.c:3454 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4712 __alloc_pages_node_noprof include/linux/gfp.h:244 [inline] alloc_pages_node_noprof include/linux/gfp.h:271 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2249 allocate_slab+0x5a/0x2e0 mm/slub.c:2412 new_slab mm/slub.c:2465 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3615 __slab_alloc+0x58/0xa0 mm/slub.c:3705 __slab_alloc_node mm/slub.c:3758 [inline] slab_alloc_node mm/slub.c:3936 [inline] __do_kmalloc_node mm/slub.c:4068 [inline] kmalloc_node_track_caller_noprof+0x286/0x450 mm/slub.c:4089 kstrdup+0x3a/0x80 mm/util.c:62 device_rename+0xb5/0x1b0 drivers/base/core.c:4558 dev_change_name+0x275/0x860 net/core/dev.c:1232 do_setlink+0xa4b/0x41f0 net/core/rtnetlink.c:2864 __rtnl_newlink net/core/rtnetlink.c:3680 [inline] rtnl_newlink+0x180b/0x20a0 net/core/rtnetlink.c:3727 rtnetlink_rcv_msg+0x89b/0x10d0 net/core/rtnetlink.c:6594 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2559 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1361 page last free pid 5146 tgid 5146 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1110 [inline] free_unref_page+0xd3c/0xec0 mm/page_alloc.c:2617 discard_slab mm/slub.c:2511 [inline] __put_partials+0xeb/0x130 mm/slub.c:2980 put_cpu_partial+0x17c/0x250 mm/slub.c:3055 __slab_free+0x2ea/0x3d0 mm/slub.c:4254 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3888 [inline] slab_alloc_node mm/slub.c:3948 [inline] __do_kmalloc_node mm/slub.c:4068 [inline] __kmalloc_node_noprof+0x1d7/0x450 mm/slub.c:4076 kmalloc_node_noprof include/linux/slab.h:681 [inline] kvmalloc_node_noprof+0x72/0x190 mm/util.c:634 bucket_table_alloc lib/rhashtable.c:186 [inline] rhashtable_rehash_alloc+0x9e/0x290 lib/rhashtable.c:367 rht_deferred_worker+0x4e1/0x2440 lib/rhashtable.c:427 process_one_work kernel/workqueue.c:3218 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3299 worker_thread+0x86d/0xd70 kernel/workqueue.c:3380 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 Memory state around the buggy address: ffff88802cd73c80: 07 fc fc fc 05 fc fc fc 05 fc fc fc fa fc fc fc ffff88802cd73d00: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc >ffff88802cd73d80: fa fc fc fc 01 fc fc fc fa fc fc fc fa fc fc fc ^ ffff88802cd73e00: fa fc fc fc fa fc fc fc 05 fc fc fc 07 fc fc fc ffff88802cd73e80: 07 fc fc fc 07 fc fc fc 07 fc fc fc 07 fc fc fc Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://lore.kernel.org/r/20240404122051.2303764-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bridge/netfilter/ebtables.c | 6 ++++++ net/ipv4/netfilter/arp_tables.c | 4 ++++ net/ipv4/netfilter/ip_tables.c | 4 ++++ net/ipv6/netfilter/ip6_tables.c | 4 ++++ 4 files changed, 18 insertions(+) diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index bab14186f9ad..14a06d8b1a2d 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -1070,6 +1070,8 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len) struct ebt_table_info *newinfo; struct ebt_replace tmp; + if (len < sizeof(tmp)) + return -EINVAL; if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) return -EFAULT; @@ -1309,6 +1311,8 @@ static int update_counters(struct net *net, sockptr_t arg, unsigned int len) { struct ebt_replace hlp; + if (len < sizeof(hlp)) + return -EINVAL; if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) return -EFAULT; @@ -2238,6 +2242,8 @@ static int compat_update_counters(struct net *net, sockptr_t arg, { struct compat_ebt_replace hlp; + if (len < sizeof(hlp)) + return -EINVAL; if (copy_from_sockptr(&hlp, arg, sizeof(hlp))) return -EFAULT; diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c index d6d45d820d79..48c6aa3d91ae 100644 --- a/net/ipv4/netfilter/arp_tables.c +++ b/net/ipv4/netfilter/arp_tables.c @@ -955,6 +955,8 @@ static int do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct arpt_entry *iter; + if (len < sizeof(tmp)) + return -EINVAL; if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) return -EFAULT; @@ -1253,6 +1255,8 @@ static int compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct arpt_entry *iter; + if (len < sizeof(tmp)) + return -EINVAL; if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) return -EFAULT; diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index ec981618b7b2..b46d58b9f3fe 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1109,6 +1109,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct ipt_entry *iter; + if (len < sizeof(tmp)) + return -EINVAL; if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) return -EFAULT; @@ -1493,6 +1495,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct ipt_entry *iter; + if (len < sizeof(tmp)) + return -EINVAL; if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) return -EFAULT; diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 99bb11d16712..d013395be05f 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1127,6 +1127,8 @@ do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct ip6t_entry *iter; + if (len < sizeof(tmp)) + return -EINVAL; if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) return -EFAULT; @@ -1503,6 +1505,8 @@ compat_do_replace(struct net *net, sockptr_t arg, unsigned int len) void *loc_cpu_entry; struct ip6t_entry *iter; + if (len < sizeof(tmp)) + return -EINVAL; if (copy_from_sockptr(&tmp, arg, sizeof(tmp)) != 0) return -EFAULT; -- 2.33.0

2 1

[openeuler:OLK-5.10 29985/30000] versioncheck: ./drivers/ub/urma/uburma/uburma_mmap.c: 21 linux/version.h not needed.
by kernel test robot 22 May '24

22 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e06ea6c839743a0dde797fc884379b38cd2a0a62 commit: 5d130e2cfa3d2aaee4d10e18c075f6c3750600c5 [29985/30000] urma: upload kernel patch for 20240511_mig reproduce: (https://download.01.org/0day-ci/archive/20240522/202405221633.6nLER3R0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405221633.6nLER3R0-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang-18/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wtautological-compare -Wno-error=return-type -Wreturn-type -Wcast-function-type -funsigned-char -Wundef -fstrict-flex-arrays=3 -Wformat-overflow -Wformat-truncation -Wenum-conversion W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* $ -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git $ -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.c: 11 linux/version.h not needed. ./drivers/infiniband/hw/hiroce3/roce.h: 11 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c: 12 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h: 26 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 23 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_device.c: 33 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl_admin.c: 20 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_main.c: 28 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_tp.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_umem.c: 26 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_main.c: 29 linux/version.h not needed. >> ./drivers/ub/urma/uburma/uburma_mmap.c: 21 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 19 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2023-52656
by Zizhi Wo 22 May '24

22 May '24

Fix CVE-2023-52656 Jens Axboe (2): io_uring/unix: drop usage of io_uring socket io_uring: drop any code related to SCM_RIGHTS fs/io_uring.c | 214 +-------------------------------------------- include/linux/fs.h | 6 +- net/core/scm.c | 2 +- net/unix/scm.c | 4 +- 4 files changed, 8 insertions(+), 218 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/3] Fix CVE-2023-52698
by Zheng Yejian 22 May '24

22 May '24

Andrew Lunn (1): [Backport] net: netlabel: Fix kerneldoc warnings Gavrilov Ilia (1): [Backport] calipso: fix memory leak in netlbl_calipso_add_pass() Zheng Yejian (1): [Backport] netlabel: remove unused parameter in netlbl_netlink_auditinfo() net/netlabel/netlabel_calipso.c | 52 +++++++++++++++++-------------- net/netlabel/netlabel_cipso_v4.c | 4 +-- net/netlabel/netlabel_mgmt.c | 8 ++--- net/netlabel/netlabel_unlabeled.c | 10 +++--- net/netlabel/netlabel_user.h | 4 +-- 5 files changed, 40 insertions(+), 38 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 13 ++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[openeuler:OLK-6.6 9677/9701] arch/arm64/kernel/cpufeature.c:2129:13: warning: 'enable_pseudo_nmi' defined but not used
by kernel test robot 22 May '24

22 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a06dd08e9351e0389df4f63a9b400e134ed0c168 commit: c6ce2becb89528f83c1ad3c0607ad05baecebc0a [9677/9701] arm64/cpufeature: Fix pseudo nmi identifier undeclaration complilation error config: arm64-defconfig (https://download.01.org/0day-ci/archive/20240522/202405221540.3vBxARIZ-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240522/202405221540.3vBxARIZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405221540.3vBxARIZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/cpufeature.c:2129:13: warning: 'enable_pseudo_nmi' defined but not used [-Wunused-variable] 2129 | static bool enable_pseudo_nmi; | ^~~~~~~~~~~~~~~~~ vim +/enable_pseudo_nmi +2129 arch/arm64/kernel/cpufeature.c 3e6c69a058deaa Mark Brown 2019-12-09 2127 f72387e1f8bc99 Mark Brown 2022-11-03 2128 #if IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) || IS_ENABLED(CONFIG_ARM64_NMI) bc3c03ccb4641f Julien Thierry 2019-01-31 @2129 static bool enable_pseudo_nmi; f72387e1f8bc99 Mark Brown 2022-11-03 2130 #endif bc3c03ccb4641f Julien Thierry 2019-01-31 2131 :::::: The code at line 2129 was first introduced by commit :::::: bc3c03ccb4641fb940b27a0d369431876923a8fe arm64: Enable the support of pseudo-NMIs :::::: TO: Julien Thierry <julien.thierry(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ext4: default enable iomap for buffered IO and large folio
by Zhang Yi 22 May '24

22 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9PXA8 CVE: NA -------------------------------- Enable iomap path for buffered IO and large folio on 4k pagesize by default, and allow switching iomap path and buffered_head path through remount. The path switch doesn't take effect until the activing inodes destroyed. Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> --- fs/ext4/super.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 292143ce354c..0ef4b804e18e 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -1738,7 +1738,8 @@ enum { Opt_dioread_nolock, Opt_dioread_lock, Opt_discard, Opt_nodiscard, Opt_init_itable, Opt_noinit_itable, Opt_max_dir_size_kb, Opt_nojournal_checksum, Opt_nombcache, - Opt_no_prefetch_block_bitmaps, Opt_mb_optimize_scan, Opt_buffered_iomap, + Opt_no_prefetch_block_bitmaps, Opt_mb_optimize_scan, + Opt_buffered_iomap, Opt_nobuffered_iomap, Opt_errors, Opt_data, Opt_data_err, Opt_jqfmt, Opt_dax_type, #ifdef CONFIG_EXT4_DEBUG Opt_fc_debug_max_replay, Opt_fc_debug_force @@ -1882,6 +1883,7 @@ static const struct fs_parameter_spec ext4_param_specs[] = { Opt_no_prefetch_block_bitmaps), fsparam_s32 ("mb_optimize_scan", Opt_mb_optimize_scan), fsparam_flag ("buffered_iomap", Opt_buffered_iomap), + fsparam_flag ("nobuffered_iomap", Opt_nobuffered_iomap), fsparam_string ("check", Opt_removed), /* mount option from ext2/3 */ fsparam_flag ("nocheck", Opt_removed), /* mount option from ext2/3 */ fsparam_flag ("reservation", Opt_removed), /* mount option from ext2/3 */ @@ -1978,6 +1980,8 @@ static const struct mount_opts { MOPT_SET}, {Opt_buffered_iomap, EXT4_MOUNT2_BUFFERED_IOMAP, MOPT_SET | MOPT_2 | MOPT_EXT4_ONLY}, + {Opt_nobuffered_iomap, EXT4_MOUNT2_BUFFERED_IOMAP, + MOPT_CLEAR | MOPT_2 | MOPT_EXT4_ONLY}, #ifdef CONFIG_EXT4_DEBUG {Opt_fc_debug_force, EXT4_MOUNT2_JOURNAL_FAST_COMMIT, MOPT_SET | MOPT_2 | MOPT_EXT4_ONLY}, @@ -2464,11 +2468,6 @@ static int ext4_parse_param(struct fs_context *fc, struct fs_parameter *param) return -EINVAL; } return 0; - case Opt_buffered_iomap: - ext4_msg(NULL, KERN_WARNING, - "iomap for buffered enabled. Warning: EXPERIMENTAL, use at your own risk"); - ctx_set_mount_opt2(ctx, EXT4_MOUNT2_BUFFERED_IOMAP); - return 0; } /* @@ -2908,12 +2907,6 @@ static int ext4_check_opt_consistency(struct fs_context *fc, !(sbi->s_mount_opt2 & EXT4_MOUNT2_DAX_INODE))) { goto fail_dax_change_remount; } - - if (ctx_test_mount_opt2(ctx, EXT4_MOUNT2_BUFFERED_IOMAP) && - !test_opt2(sb, BUFFERED_IOMAP)) { - ext4_msg(NULL, KERN_ERR, "can't enable iomap for buffered IO on remount"); - return -EINVAL; - } } return ext4_check_quota_consistency(fc, sb); @@ -4481,6 +4474,10 @@ static void ext4_set_def_opts(struct super_block *sb, if (sb->s_blocksize == PAGE_SIZE) set_opt(sb, DIOREAD_NOLOCK); + + /* Use iomap for buffered IO path on 4k pagesize */ + if (PAGE_SIZE == SZ_4K) + set_opt2(sb, BUFFERED_IOMAP); } static int ext4_handle_clustersize(struct super_block *sb) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] drm/amd/pm: fix a double-free in si_dpm_init
by Xia Fukun 22 May '24

22 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> stable inclusion from stable-v4.19.314 commit afe9f5b871f86d58ecdc45b217b662227d7890d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9IJ CVE: CVE-2023-52691 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ] When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered. Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/si_dpm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c index 1de96995e690..7c724d3de111 100644 --- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c +++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c @@ -7348,10 +7348,9 @@ static int si_dpm_init(struct amdgpu_device *adev) kcalloc(4, sizeof(struct amdgpu_clock_voltage_dependency_entry), GFP_KERNEL); - if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { - amdgpu_free_extended_power_table(adev); + if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) return -ENOMEM; - } + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: use timestamp to check for set element timeout
by Liu Jian 22 May '24

22 May '24

mainline inclusion from mainline-v6.8-rc4 commit 7395dfacfff65e9938ac0889dafa1ab01e987d15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9O0MR CVE: CVE-2024-27397 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area. Update set backend .insert, .deactivate and sync gc path to use the timestamp, this avoids that an element expires while control plane transaction is still unfinished. .lookup and .update, which are used from packet path, still use the current time to check if the element has expired. And .get path and dump also since this runs lockless under rcu read size lock. Then, there is async gc which also needs to check the current time since it runs asynchronously from a workqueue. Fixes: c3e1b005ed1c ("netfilter: nf_tables: add set element timeout support") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_tables.h net/netfilter/nf_tables_api.c net/netfilter/nft_set_pipapo.c net/netfilter/nft_set_rbtree.c [Do not backport nft_rbtree_gc() part, it is a async gc in our repository. Others caused by we did not backport commit ab482c6b66a4, b2d306542ff9, 8837ba3e58ea, 5f68718b34a5, d59d2f82f984.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/netfilter/nf_tables.h | 24 ++++++++++++++++++++++-- net/netfilter/nf_tables_api.c | 1 + net/netfilter/nft_set_hash.c | 8 +++++++- net/netfilter/nft_set_pipapo.c | 18 +++++++++++------- net/netfilter/nft_set_rbtree.c | 6 ++++-- 5 files changed, 45 insertions(+), 12 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 5e3529c73e61..11b619ceca7c 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -13,6 +13,7 @@ #include <net/netfilter/nf_flow_table.h> #include <net/netlink.h> #include <net/flow_offload.h> +#include <net/netns/generic.h> #define NFT_MAX_HOOKS (NF_INET_INGRESS + 1) @@ -695,10 +696,16 @@ static inline struct nft_expr *nft_set_ext_expr(const struct nft_set_ext *ext) return nft_set_ext(ext, NFT_SET_EXT_EXPR); } -static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) +static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext, + u64 tstamp) { return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) && - time_is_before_eq_jiffies64(*nft_set_ext_expiration(ext)); + time_after_eq64(tstamp, *nft_set_ext_expiration(ext)); +} + +static inline bool nft_set_elem_expired(const struct nft_set_ext *ext) +{ + return __nft_set_elem_expired(ext, get_jiffies_64()); } static inline struct nft_set_ext *nft_set_elem_ext(const struct nft_set *set, @@ -1587,9 +1594,22 @@ struct nftables_pernet { struct list_head module_list; struct list_head notify_list; struct mutex commit_mutex; + u64 tstamp; unsigned int base_seq; u8 validate_state; unsigned int gc_seq; }; +extern unsigned int nf_tables_net_id; + +static inline struct nftables_pernet *nft_pernet(const struct net *net) +{ + return net_generic(net, nf_tables_net_id); +} + +static inline u64 nft_net_tstamp(const struct net *net) +{ + return nft_pernet(net)->tstamp; +} + #endif /* _NET_NF_TABLES_H */ diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 7c102a4ce930..794c3fdac563 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -9014,6 +9014,7 @@ static bool nf_tables_valid_genid(struct net *net, u32 genid) bool genid_ok; mutex_lock(&nft_net->commit_mutex); + nft_net->tstamp = get_jiffies_64(); genid_ok = genid == 0 || nft_net->base_seq == genid; if (!genid_ok) diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c index f0a9ad1c4ea4..2499d25a5c85 100644 --- a/net/netfilter/nft_set_hash.c +++ b/net/netfilter/nft_set_hash.c @@ -38,6 +38,7 @@ struct nft_rhash_cmp_arg { const struct nft_set *set; const u32 *key; u8 genmask; + u64 tstamp; }; static inline u32 nft_rhash_key(const void *data, u32 len, u32 seed) @@ -64,7 +65,7 @@ static inline int nft_rhash_cmp(struct rhashtable_compare_arg *arg, return 1; if (nft_set_elem_is_dead(&he->ext)) return 1; - if (nft_set_elem_expired(&he->ext)) + if (__nft_set_elem_expired(&he->ext, x->tstamp)) return 1; if (!nft_set_elem_active(&he->ext, x->genmask)) return 1; @@ -88,6 +89,7 @@ static bool nft_rhash_lookup(const struct net *net, const struct nft_set *set, .genmask = nft_genmask_cur(net), .set = set, .key = key, + .tstamp = get_jiffies_64(), }; he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); @@ -106,6 +108,7 @@ static void *nft_rhash_get(const struct net *net, const struct nft_set *set, .genmask = nft_genmask_cur(net), .set = set, .key = elem->key.val.data, + .tstamp = get_jiffies_64(), }; he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); @@ -129,6 +132,7 @@ static bool nft_rhash_update(struct nft_set *set, const u32 *key, .genmask = NFT_GENMASK_ANY, .set = set, .key = key, + .tstamp = get_jiffies_64(), }; he = rhashtable_lookup(&priv->ht, &arg, nft_rhash_params); @@ -172,6 +176,7 @@ static int nft_rhash_insert(const struct net *net, const struct nft_set *set, .genmask = nft_genmask_next(net), .set = set, .key = elem->key.val.data, + .tstamp = nft_net_tstamp(net), }; struct nft_rhash_elem *prev; @@ -214,6 +219,7 @@ static void *nft_rhash_deactivate(const struct net *net, .genmask = nft_genmask_next(net), .set = set, .key = elem->key.val.data, + .tstamp = nft_net_tstamp(net), }; rcu_read_lock(); diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 9c311b6f37af..831cbff77773 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -504,6 +504,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, * @set: nftables API set representation * @data: Key data to be matched against existing elements * @genmask: If set, check that element is active in given genmask + * @tstamp: timestamp to check for expired elements * * This is essentially the same as the lookup function, except that it matches * key data against the uncommitted copy and doesn't use preallocated maps for @@ -513,7 +514,8 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, */ static struct nft_pipapo_elem *pipapo_get(const struct net *net, const struct nft_set *set, - const u8 *data, u8 genmask) + const u8 *data, u8 genmask, + u64 tstamp) { struct nft_pipapo_elem *ret = ERR_PTR(-ENOENT); struct nft_pipapo *priv = nft_set_priv(set); @@ -566,7 +568,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, goto out; if (last) { - if (nft_set_elem_expired(&f->mt[b].e->ext)) + if (__nft_set_elem_expired(&f->mt[b].e->ext, tstamp)) goto next_match; if ((genmask && !nft_set_elem_active(&f->mt[b].e->ext, genmask))) @@ -603,7 +605,7 @@ static void *nft_pipapo_get(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, unsigned int flags) { return pipapo_get(net, set, (const u8 *)elem->key.val.data, - nft_genmask_cur(net)); + nft_genmask_cur(net), get_jiffies_64()); } /** @@ -1197,6 +1199,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, struct nft_pipapo *priv = nft_set_priv(set); struct nft_pipapo_match *m = priv->clone; u8 genmask = nft_genmask_next(net); + u64 tstamp = nft_net_tstamp(net); struct nft_pipapo_field *f; const u8 *start_p, *end_p; int i, bsize_max, err = 0; @@ -1206,7 +1209,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, else end = start; - dup = pipapo_get(net, set, start, genmask); + dup = pipapo_get(net, set, start, genmask, tstamp); if (!IS_ERR(dup)) { /* Check if we already have the same exact entry */ const struct nft_data *dup_key, *dup_end; @@ -1228,7 +1231,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, if (PTR_ERR(dup) == -ENOENT) { /* Look for partially overlapping entries */ - dup = pipapo_get(net, set, end, nft_genmask_next(net)); + dup = pipapo_get(net, set, end, nft_genmask_next(net), tstamp); } if (PTR_ERR(dup) != -ENOENT) { @@ -1580,6 +1583,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) struct nft_set *set = (struct nft_set *) _set; struct nft_pipapo *priv = nft_set_priv(set); struct net *net = read_pnet(&set->net); + u64 tstamp = nft_net_tstamp(net); int rules_f0, first_rule = 0; struct nft_trans_gc *gc; @@ -1613,7 +1617,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) /* synchronous gc never fails, there is no need to set on * NFT_SET_ELEM_DEAD_BIT. */ - if (nft_set_elem_expired(&e->ext)) { + if (__nft_set_elem_expired(&e->ext, tstamp)) { priv->dirty = true; gc = nft_trans_gc_queue_sync(gc, GFP_ATOMIC); @@ -1772,7 +1776,7 @@ static void *pipapo_deactivate(const struct net *net, const struct nft_set *set, { struct nft_pipapo_elem *e; - e = pipapo_get(net, set, data, nft_genmask_next(net)); + e = pipapo_get(net, set, data, nft_genmask_next(net), nft_net_tstamp(net)); if (IS_ERR(e)) return NULL; diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 8b1daca932e0..3f2e39988ab2 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -314,6 +314,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, struct rb_node *node, *next, *parent, **p, *first = NULL; struct nft_rbtree *priv = nft_set_priv(set); u8 genmask = nft_genmask_next(net); + u64 tstamp = nft_net_tstamp(net); int d, err; /* Descend the tree to search for an existing element greater than the @@ -359,7 +360,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, continue; /* perform garbage collection to avoid bogus overlap reports. */ - if (nft_set_elem_expired(&rbe->ext)) { + if (__nft_set_elem_expired(&rbe->ext, tstamp)) { err = nft_rbtree_gc_elem(set, priv, rbe); if (err < 0) return err; @@ -533,6 +534,7 @@ static void *nft_rbtree_deactivate(const struct net *net, const struct rb_node *parent = priv->root.rb_node; struct nft_rbtree_elem *rbe, *this = elem->priv; u8 genmask = nft_genmask_next(net); + u64 tstamp = nft_net_tstamp(net); int d; while (parent != NULL) { @@ -553,7 +555,7 @@ static void *nft_rbtree_deactivate(const struct net *net, nft_rbtree_interval_end(this)) { parent = parent->rb_right; continue; - } else if (nft_set_elem_expired(&rbe->ext)) { + } else if (__nft_set_elem_expired(&rbe->ext, tstamp)) { break; } else if (!nft_set_elem_active(&rbe->ext, genmask)) { parent = parent->rb_left; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
by Zhengchao Shao 22 May '24

22 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.215 commit bc4d1ebca11b4f194e262326bd45938e857c59d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGJZ CVE: CVE-2024-35934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 00af2aa93b76b1bade471ad0d0525d4d29ca5cc0 ] Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1] This patch returns early from smc_pnet_net_init() if there is no netdevice yet. I am not even sure why smc_pnet_create_pnetids_list() even exists, because smc_pnet_netdev_event() is also calling smc_pnet_add_base_pnetid() when handling NETDEV_UP event. [1] extract of typical syzbot reports 2 locks held by syz-executor.3/12252: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Wenjia Zhang <wenjia(a)linux.ibm.com> Cc: Jan Karcher <jaka(a)linux.ibm.com> Cc: "D. Wythe" <alibuda(a)linux.alibaba.com> Cc: Tony Lu <tonylu(a)linux.alibaba.com> Cc: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240302100744.3868021-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/smc/smc_pnet.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c index 30bae60d626c..ed9cfa11b589 100644 --- a/net/smc/smc_pnet.c +++ b/net/smc/smc_pnet.c @@ -797,6 +797,16 @@ static void smc_pnet_create_pnetids_list(struct net *net) u8 ndev_pnetid[SMC_MAX_PNETID_LEN]; struct net_device *dev; + /* Newly created netns do not have devices. + * Do not even acquire rtnl. + */ + if (list_empty(&net->dev_base_head)) + return; + + /* Note: This might not be needed, because smc_pnet_netdev_event() + * is also calling smc_pnet_add_base_pnetid() when handling + * NETDEV_UP event. + */ rtnl_lock(); for_each_netdev(net, dev) smc_pnet_add_base_pnetid(net, dev, ndev_pnetid); -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/loongson-eiointc: fix gsi register error
by Hongchen Zhang 22 May '24

22 May '24

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9RAP5 ------------------------------------------ When we boot a 3C5000-7A2000 2Node server using "nr_cpus=1 maxcpus=1", we get the following Call Trace: 4.807397] ------------[ cut here ]------------ [ 4.811996] WARNING: CPU: 0 PID: 1 at drivers/acpi/irq.c:63 acpi_register_gsi+0xe0/0x100 [ 4.820048] Modules linked in: [ 4.823082] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc7-next-20240509+ #26 [ 4.830604] Hardware name: LOONGSON Dabieshan/Loongson-LS2C50C2, BIOS Loongson UEFI (3C50007A2000_Ls2c5lc2) V4.0.13-Dual 12/06/23 17:33:54 [ 4.842964] pc 9000000000bdc6e0 ra 9000000000bdc66c tp 90000002051d4000 sp 90000002051d7ae0 [ 4.851269] a0 0000000000000000 a1 00000000000000a0 a2 0000000000000000 a3 0000000000000000 [ 4.859567] a4 9000000200014518 a5 000000000000003c a6 90000000018876b0 a7 00302e39303a3030 [ 4.867866] t0 0000000000000000 t1 0000000000000080 t2 0000000000000040 t3 0000000000036800 [ 4.876165] t4 0000000000036800 t5 0000000000000004 t6 0000000000000000 t7 0000000000000000 [ 4.884464] t8 900000000800d910 u0 0000000000000000 s9 90000000014bf9e8 s0 00000000000000a0 [ 4.892763] s1 0000000000000000 s2 0000000000000000 s3 9000000001985000 s4 90000002051d7b88 [ 4.901063] s5 0000000000000001 s6 90000002055470b8 s7 90000000014400ac s8 0000000000000008 [ 4.909362] ra: 9000000000bdc66c acpi_register_gsi+0x6c/0x100 [ 4.915330] ERA: 9000000000bdc6e0 acpi_register_gsi+0xe0/0x100 [ 4.921297] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 4.927446] PRMD: 00000004 (PPLV0 +PIE -PWE) [ 4.931777] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 4.936538] ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) [ 4.941301] ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0) [ 4.946838] PRID: 0014c011 (Loongson-64bit, Loongson-3C5000) [ 4.952545] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.9.0-rc7-next-20240509+ #26 [ 4.960066] Hardware name: LOONGSON Dabieshan/Loongson-LS2C50C2, BIOS Loongson UEFI (3C50007A2000_Ls2c5lc2) V4.0.13-Dual 12/06/23 17:33:54 [ 4.972425] Stack : 9000000001985000 0000000000000000 9000000000223524 90000002051d4000 [ 4.980382] 90000002051d7740 90000002051d7748 0000000000000000 90000002051d7888 [ 4.988338] 90000002051d7880 90000002051d7880 90000002051d7690 0000000000000001 [ 4.996294] 0000000000000001 90000002051d7748 420a070366b7e75d 90000002054f4500 [ 5.004251] 0000000000000001 0000000000000000 4137303030354333 c0000000ffffdfff [ 5.012206] 0000000000000003 00000000000ea642 0000000006b3c000 90000000014bf9e8 [ 5.020163] 0000000000000000 0000000000000000 90000000017f7e80 9000000001985000 [ 5.028119] 0000000000000001 0000000000000000 ffffffffffd7f549 90000000014400ac [ 5.036075] 0000000000000008 0000000000000000 900000000022353c 00007ffff1354000 [ 5.044031] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d [ 5.051987] ... [ 5.054410] Call Trace: [ 5.054412] [<900000000022353c>] show_stack+0x5c/0x1a0 [ 5.061940] [<900000000141e86c>] dump_stack_lvl+0x9c/0xc4 [ 5.067305] [<900000000140170c>] __warn+0x94/0xcc [ 5.071977] [<90000000013cd900>] report_bug+0x160/0x220 [ 5.077170] [<900000000141facc>] do_bp+0x26c/0x2e0 [ 5.081929] [<0000000000000000>] 0x0 [ 5.085475] [<9000000000bdc6e0>] acpi_register_gsi+0xe0/0x100 [ 5.091182] [<9000000000bd5350>] acpi_pci_irq_enable+0xd0/0x220 [ 5.097061] [<9000000000b5e8d4>] pci_device_probe+0x54/0x260 [ 5.102683] [<9000000000d1fefc>] really_probe+0xbc/0x320 [ 5.107960] [<9000000000d201f0>] __driver_probe_device+0x90/0x160 [ 5.114012] [<9000000000d202f8>] driver_probe_device+0x38/0x120 [ 5.119892] [<9000000000d205d4>] __driver_attach+0x94/0x1c0 [ 5.125426] [<9000000000d1d7ac>] bus_for_each_dev+0x8c/0x100 [ 5.131046] [<9000000000d1ee30>] bus_add_driver+0xf0/0x240 [ 5.136494] [<9000000000d21688>] driver_register+0x68/0x140 [ 5.142028] [<9000000000220158>] do_one_initcall+0x78/0x200 [ 5.147561] [<9000000001440fcc>] kernel_init_freeable+0x23c/0x2b0 [ 5.153614] [<900000000142123c>] kernel_init+0x1c/0x120 [ 5.158802] [<9000000000221348>] ret_from_kernel_thread+0xc/0xa4 [ 5.166244] ---[ end trace 0000000000000000 ]--- [ 5.170998] GSI: No registered irqchip, giving up The root cause is that when the CPU boot from flat mode, it is unreliable to use cpu_to node to calculate the node number. Therefore, we use NODES_PER_FLATMODE_NODE to calculate the physical node number. According to the 3C5000 user manual, the value of NODES_PER_FLATMODE_NODE should be 4. Cc: <stable(a)vger.kernel.org> Signed-off-by: Ming Wang <wangming01(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/include/asm/numa.h | 1 + drivers/irqchip/irq-loongson-eiointc.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/loongarch/include/asm/numa.h b/arch/loongarch/include/asm/numa.h index 27f319b49862..564c27d2de72 100644 --- a/arch/loongarch/include/asm/numa.h +++ b/arch/loongarch/include/asm/numa.h @@ -12,6 +12,7 @@ #include <linux/nodemask.h> #define NODE_ADDRSPACE_SHIFT 44 +#define NODES_PER_FLATMODE_NODE 4 #define pa_to_nid(addr) (((addr) & 0xf00000000000) >> NODE_ADDRSPACE_SHIFT) #define nid_to_addrbase(nid) (_ULCAST_(nid) << NODE_ADDRSPACE_SHIFT) diff --git a/drivers/irqchip/irq-loongson-eiointc.c b/drivers/irqchip/irq-loongson-eiointc.c index c5c26b8e8d0c..488951a740cd 100644 --- a/drivers/irqchip/irq-loongson-eiointc.c +++ b/drivers/irqchip/irq-loongson-eiointc.c @@ -375,7 +375,7 @@ int __init pch_msi_parse_madt(union acpi_subtable_headers *header, int node; if (cpu_has_flatmode) - node = cpu_to_node(eiointc_priv[nr_pics - 1]->node * CORES_PER_EIO_NODE); + node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; else node = eiointc_priv[nr_pics - 1]->node; @@ -478,7 +478,7 @@ int __init eiointc_acpi_init(struct irq_domain *parent, goto out_free_handle; if (cpu_has_flatmode) - node = cpu_to_node(acpi_eiointc->node * CORES_PER_EIO_NODE); + node = acpi_eiointc->node / NODES_PER_FLATMODE_NODE; else node = acpi_eiointc->node; acpi_set_vec_parent(node, priv->eiointc_domain, pch_group); -- 2.33.0

2 1

[PATCH OLK-6.6 v2 00/37] mm: Some bugfix and optimization
by Liu Shixin 22 May '24

22 May '24

Patch [1-21] is series "Rearrange batched folio freeing" and three bugfix. Patch [22-26] is series "Clean up __folio_put()". Patch [27] add trace of alloc_contig_migrate_range. Patch [28-30] is three bugfix about hugetlb. Patch [31] is an performance optimization of pcp draining. Patch [32] is a minor improve of _deferred_list which benefit from debug. This patch is from series "Various significant MM patches". Other patches are not related to this patch, so don't backport together. Patch "mm: Free up PG_slab" may also benefit for us, but have compile problem need to fix, so not in this series. Patch [33-36] is part of series "Improve anon_vma scalability for anon VMAs". Patch "mm: Fix some minor per-VMA lock issues in userfaultfd" is not in backport because it depends on patch "userfaultfd: use per-vma locks in userfaultfd operations" Patch [37] fix a bug introduced by patch "mm: turn folio_test_hugetlb into a PageType" which is from the previous backport. v1->v2: Add patch [37]. Liu Shixin (1): mm/dynamic_pool: clear PG_hugetlb when demote hugepages Lucas Stach (1): mm: page_alloc: control latency caused by zone PCP draining Matthew Wilcox (Oracle) (30): mm: make folios_put() the basis of release_pages() mm: convert free_unref_page_list() to use folios mm: add free_unref_folios() mm: use folios_put() in __folio_batch_release() memcg: add mem_cgroup_uncharge_folios() mm: remove use of folio list from folios_put() mm: use free_unref_folios() in put_pages_list() mm: use __page_cache_release() in folios_put() mm: handle large folios in free_unref_folios() mm: allow non-hugetlb large folios to be batch processed mm: free folios in a batch in shrink_folio_list() mm: free folios directly in move_folios_to_lru() memcg: remove mem_cgroup_uncharge_list() mm: remove free_unref_page_list() mm: remove lru_to_page() mm: convert free_pages_and_swap_cache() to use folios_put() mm: use a folio in __collapse_huge_page_copy_succeeded() mm: convert free_swap_cache() to take a folio mm: remove folio from deferred split list before uncharging it mm: fix list corruption in put_pages_list mm: increase folio batch size mm: free non-hugetlb large folios in a batch mm: combine free_the_page() and free_unref_page() mm: inline destroy_large_folio() into __folio_put_large() mm: combine __folio_put_small, __folio_put_large and __folio_put mm: convert free_zone_device_page to free_zone_device_folio mm: always initialise folio->_deferred_list mm: assert the mmap_lock is held in __anon_vma_prepare() mm: delay the check for a NULL anon_vma mm: optimise vmf_anon_prepare() for VMAs without an anon_vma Miaohe Lin (1): mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() Mike Kravetz (2): hugetlb: set hugetlb page flag before optimizing vmemmap hugetlb: check for hugetlb folio before vmemmap_restore Richard Chang (1): mm: add alloc_contig_migrate_range allocation statistics Vishal Moola (Oracle) (1): mm/memory: change vmf_anon_prepare() to be non-static include/linux/memcontrol.h | 26 ++-- include/linux/mm.h | 19 +-- include/linux/pagevec.h | 4 +- include/linux/swap.h | 8 +- include/trace/events/kmem.h | 38 ++++++ mm/dynamic_pool.c | 1 + mm/huge_memory.c | 8 +- mm/hugetlb.c | 60 ++++++---- mm/hugetlb_vmemmap.c | 3 + mm/internal.h | 12 +- mm/khugepaged.c | 30 +++-- mm/memcontrol.c | 19 ++- mm/memory.c | 46 +++++--- mm/memremap.c | 30 ++--- mm/mlock.c | 3 +- mm/page_alloc.c | 169 ++++++++++++++------------ mm/page_isolation.c | 2 +- mm/rmap.c | 3 +- mm/swap.c | 230 +++++++++++++++++++----------------- mm/swap_state.c | 31 +++-- mm/vmscan.c | 58 +++++---- 21 files changed, 449 insertions(+), 351 deletions(-) -- 2.25.1

2 38

[PATCH OLK-5.10 00/10] Introduce NUMA isolation and consolidation
by Hui Tang 22 May '24

22 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH OLK-5.10] netfilter: nf_tables: discard table flag update with pending basechain deletion
by Liu Jian 22 May '24

22 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.215 commit b58d0ac35f6d75ec1db8650a29dfd6f292c11362 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG9F CVE: CVE-2024-35897 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit 1bc83a019bbe268be3526406245ec28c2458a518 upstream. Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its hook still registered in the core. Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_tables_api.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 2fd0ecb2e89f..7c102a4ce930 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1084,6 +1084,24 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table) #define __NFT_TABLE_F_UPDATE (__NFT_TABLE_F_WAS_DORMANT | \ __NFT_TABLE_F_WAS_AWAKEN) +static bool nft_table_pending_update(const struct nft_ctx *ctx) +{ + struct nftables_pernet *nft_net = net_generic(ctx->net, nf_tables_net_id); + struct nft_trans *trans; + + if (ctx->table->flags & __NFT_TABLE_F_UPDATE) + return true; + + list_for_each_entry(trans, &nft_net->commit_list, list) { + if (trans->ctx.table == ctx->table && + trans->msg_type == NFT_MSG_DELCHAIN && + nft_is_base_chain(trans->ctx.chain)) + return true; + } + + return false; +} + static int nf_tables_updtable(struct nft_ctx *ctx) { struct nft_trans *trans; @@ -1101,7 +1119,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) return 0; /* No dormant off/on/off/on games in single transaction */ - if (ctx->table->flags & __NFT_TABLE_F_UPDATE) + if (nft_table_pending_update(ctx)) return -EINVAL; trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE, -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2023-52656
by Zizhi Wo 22 May '24

22 May '24

Fix CVE-2023-52656 Jens Axboe (2): io_uring/unix: drop usage of io_uring socket io_uring: drop any code related to SCM_RIGHTS include/linux/io_uring.h | 10 +- io_uring/io_uring.c | 229 ++------------------------------------- net/core/scm.c | 2 +- net/unix/scm.c | 4 +- 4 files changed, 15 insertions(+), 230 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-5.10 29989/30000] versioncheck: ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 23 linux/version.h not needed.
by kernel test robot 22 May '24

22 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f89b6bb5c2dfdd5f654f24013bb96834abe2c7a1 commit: f1753f8b17480bdb750cbd33fbaa358aef5dbb23 [29989/30000] urma: upload kernel patch for 20240219_Spring reproduce: (https://download.01.org/0day-ci/archive/20240522/202405221416.ngL8AmHM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405221416.ngL8AmHM-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang-18/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -Wtautological-compare -Wno-error=return-type -Wreturn-type -Wcast-function-type -funsigned-char -Wundef -fstrict-flex-arrays=3 -Wformat-overflow -Wformat-truncation -Wenum-conversion W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* $ -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git $ -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/infiniband/hw/hiroce3/host/hmm/hmm_umem.c: 11 linux/version.h not needed. ./drivers/infiniband/hw/hiroce3/roce.h: 11 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c: 12 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h: 26 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. >> ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 23 linux/version.h not needed. >> ./drivers/ub/urma/ubcore/ubcore_device.c: 33 linux/version.h not needed. >> ./drivers/ub/urma/ubcore/ubcore_genl.c: 26 linux/version.h not needed. >> ./drivers/ub/urma/ubcore/ubcore_genl_admin.c: 20 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_main.c: 28 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_tp.c: 26 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_umem.c: 26 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_main.c: 29 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 19 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

openEuler Kernel SIG双周例会
by openEuler conference 22 May '24

22 May '24

您好！ Kernel 邀请您参加 2024-05-24 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填写至会议看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/969333120 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-05-24 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填写至会议看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/969333120. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-22.03-LTS-SP2 0/1] wifi: ath11k: decrease MHI channel buffer length to 8KB
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Baochen Qiang (1): wifi: ath11k: decrease MHI channel buffer length to 8KB drivers/net/wireless/ath/ath11k/mhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] wifi: ath11k: decrease MHI channel buffer length to 8KB
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Baochen Qiang (1): wifi: ath11k: decrease MHI channel buffer length to 8KB drivers/net/wireless/ath/ath11k/mhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS 0/1] wifi: ath11k: decrease MHI channel buffer length to 8KB
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Baochen Qiang (1): wifi: ath11k: decrease MHI channel buffer length to 8KB drivers/net/wireless/ath/ath11k/mhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] wifi: ath11k: decrease MHI channel buffer length to 8KB
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Baochen Qiang (1): wifi: ath11k: decrease MHI channel buffer length to 8KB drivers/net/wireless/ath/ath11k/mhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 22 May '24

22 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2023-52698
by Zheng Yejian 22 May '24

22 May '24

Andrew Lunn (1): net: netlabel: Fix kerneldoc warnings Gavrilov Ilia (1): calipso: fix memory leak in netlbl_calipso_add_pass() Zheng Yejian (1): netlabel: remove unused parameter in netlbl_netlink_auditinfo() net/netlabel/netlabel_calipso.c | 52 +++++++++++++++++-------------- net/netlabel/netlabel_cipso_v4.c | 4 +-- net/netlabel/netlabel_mgmt.c | 8 ++--- net/netlabel/netlabel_unlabeled.c | 10 +++--- net/netlabel/netlabel_user.h | 4 +-- 5 files changed, 40 insertions(+), 38 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors
by Hongchen Zhang 22 May '24

22 May '24

From: Juxin Gao <gaojuxin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7M9 ------------------------------------------ Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- drivers/pci/msi/msi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index cde8c4e264b7..7078200be11f 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -424,8 +424,10 @@ int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, int rc; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { maxvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (!pci_msi_supported(dev, minvec) || dev->current_state != PCI_D0) @@ -810,8 +812,10 @@ int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int int hwsize, rc, nvec = maxvec; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { nvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (maxvec < minvec) -- 2.33.0

2 1

[PATCH OLK-5.10 v2] wifi: iwlwifi: dbg-tlv: ensure NUL termination
by Zheng Yejian 22 May '24

22 May '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.10.214 commit fabe2db7de32a881e437ee69db32e0de785a6209 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9E2 CVE: CVE-2024-35845 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ] The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it. Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Gregory Greenman <gregory.greenman(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://msgid.link/20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c index bcaec8a184cd..299819d2d190 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c @@ -155,6 +155,12 @@ static int iwl_dbg_tlv_alloc_debug_info(struct iwl_trans *trans, if (le32_to_cpu(tlv->length) != sizeof(*debug_info)) return -EINVAL; + /* we use this as a string, ensure input was NUL terminated */ + if (strnlen(debug_info->debug_cfg_name, + sizeof(debug_info->debug_cfg_name)) == + sizeof(debug_info->debug_cfg_name)) + return -EINVAL; + IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n", debug_info->debug_cfg_name); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/radeon: possible buffer overflow
by Luo Gengkun 22 May '24

22 May '24

From: Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> mainline inclusion from mainline-v6.7-rc1 commit dd05484f99d16715a88eedfca363828ef9a4c2d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R7JN CVE: CVE-2023-52867 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Buffer 'afmt_status' of size 6 could overflow, since index 'afmt_idx' is checked after access. Fixes: 5cc4e5fc293b ("drm/radeon: Cleanup HDMI audio interrupt handling for evergreen") Co-developed-by: Ivanov Mikhail <ivanov.mikhail1(a)huawei-partners.com> Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze(a)huawei.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> --- drivers/gpu/drm/radeon/evergreen.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c index 5712d63dca20..da728f7fc42b 100644 --- a/drivers/gpu/drm/radeon/evergreen.c +++ b/drivers/gpu/drm/radeon/evergreen.c @@ -4815,14 +4815,15 @@ int evergreen_irq_process(struct radeon_device *rdev) break; case 44: /* hdmi */ afmt_idx = src_data; - if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG)) - DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); - if (afmt_idx > 5) { DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data); break; } + + if (!(afmt_status[afmt_idx] & AFMT_AZ_FORMAT_WTRIG)) + DRM_DEBUG("IH: IH event w/o asserted irq bit?\n"); + afmt_status[afmt_idx] &= ~AFMT_AZ_FORMAT_WTRIG; queue_hdmi = true; DRM_DEBUG("IH: HDMI%d\n", afmt_idx + 1); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
by Yang Yingliang 22 May '24

22 May '24

From: Adamos Ttofari <attofari(a)amazon.de> mainline inclusion from mainline-v6.9-rc1 commit 10e4b5166df9ff7a2d5316138ca668b42d004422 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9Q992 CVE: CVE-2024-35801 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfd_state to keep the MSR_IA32_XFD value cached, in order to avoid unnecessary writes to the MSR. On CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync. As a consequence a subsequent xfd_update_state() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel. To fix this, introduce xfd_set_state() to write xfd_state together with MSR_IA32_XFD, and use it in all places that set MSR_IA32_XFD. Fixes: 672365477ae8 ("x86/fpu: Update XFD state where required") Signed-off-by: Adamos Ttofari <attofari(a)amazon.de> Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20240322230439.456571-1-chang.seok.bae@intel.com Closes: https://lore.kernel.org/lkml/20230511152818.13839-1-attofari@amazon.de Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kernel/fpu/xstate.c | 5 +++-- arch/x86/kernel/fpu/xstate.h | 14 ++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index 6ceb0996e23a..78dcdf348218 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -176,10 +176,11 @@ void fpu__init_cpu_xstate(void) * Must happen after CR4 setup and before xsetbv() to allow KVM * lazy passthrough. Write independent of the dynamic state static * key as that does not work on the boot CPU. This also ensures - * that any stale state is wiped out from XFD. + * that any stale state is wiped out from XFD. Reset the per CPU + * xfd cache too. */ if (cpu_feature_enabled(X86_FEATURE_XFD)) - wrmsrl(MSR_IA32_XFD, init_fpstate.xfd); + xfd_set_state(init_fpstate.xfd); /* * XCR_XFEATURE_ENABLED_MASK (aka. XCR0) sets user features diff --git a/arch/x86/kernel/fpu/xstate.h b/arch/x86/kernel/fpu/xstate.h index 8707ba0f1a8b..6536c416ba2e 100644 --- a/arch/x86/kernel/fpu/xstate.h +++ b/arch/x86/kernel/fpu/xstate.h @@ -151,20 +151,26 @@ static inline void xfd_validate_state(struct fpstate *fpstate, u64 mask, bool rs #endif #ifdef CONFIG_X86_64 +static inline void xfd_set_state(u64 xfd) +{ + wrmsrl(MSR_IA32_XFD, xfd); + __this_cpu_write(xfd_state, xfd); +} + static inline void xfd_update_state(struct fpstate *fpstate) { if (fpu_state_size_dynamic()) { u64 xfd = fpstate->xfd; - if (__this_cpu_read(xfd_state) != xfd) { - wrmsrl(MSR_IA32_XFD, xfd); - __this_cpu_write(xfd_state, xfd); - } + if (__this_cpu_read(xfd_state) != xfd) + xfd_set_state(xfd); } } extern int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu); #else +static inline void xfd_set_state(u64 xfd) { } + static inline void xfd_update_state(struct fpstate *fpstate) { } static inline int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu) { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
by Yang Yingliang 22 May '24

22 May '24

From: Adamos Ttofari <attofari(a)amazon.de> mainline inclusion from mainline-v6.9-rc1 commit 10e4b5166df9ff7a2d5316138ca668b42d004422 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9Q992 CVE: CVE-2024-35801 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfd_state to keep the MSR_IA32_XFD value cached, in order to avoid unnecessary writes to the MSR. On CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync. As a consequence a subsequent xfd_update_state() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel. To fix this, introduce xfd_set_state() to write xfd_state together with MSR_IA32_XFD, and use it in all places that set MSR_IA32_XFD. Fixes: 672365477ae8 ("x86/fpu: Update XFD state where required") Signed-off-by: Adamos Ttofari <attofari(a)amazon.de> Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20240322230439.456571-1-chang.seok.bae@intel.com Closes: https://lore.kernel.org/lkml/20230511152818.13839-1-attofari@amazon.de Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kernel/fpu/xstate.c | 5 +++-- arch/x86/kernel/fpu/xstate.h | 14 ++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index 6ceb0996e23a..78dcdf348218 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -176,10 +176,11 @@ void fpu__init_cpu_xstate(void) * Must happen after CR4 setup and before xsetbv() to allow KVM * lazy passthrough. Write independent of the dynamic state static * key as that does not work on the boot CPU. This also ensures - * that any stale state is wiped out from XFD. + * that any stale state is wiped out from XFD. Reset the per CPU + * xfd cache too. */ if (cpu_feature_enabled(X86_FEATURE_XFD)) - wrmsrl(MSR_IA32_XFD, init_fpstate.xfd); + xfd_set_state(init_fpstate.xfd); /* * XCR_XFEATURE_ENABLED_MASK (aka. XCR0) sets user features diff --git a/arch/x86/kernel/fpu/xstate.h b/arch/x86/kernel/fpu/xstate.h index 8707ba0f1a8b..6536c416ba2e 100644 --- a/arch/x86/kernel/fpu/xstate.h +++ b/arch/x86/kernel/fpu/xstate.h @@ -151,20 +151,26 @@ static inline void xfd_validate_state(struct fpstate *fpstate, u64 mask, bool rs #endif #ifdef CONFIG_X86_64 +static inline void xfd_set_state(u64 xfd) +{ + wrmsrl(MSR_IA32_XFD, xfd); + __this_cpu_write(xfd_state, xfd); +} + static inline void xfd_update_state(struct fpstate *fpstate) { if (fpu_state_size_dynamic()) { u64 xfd = fpstate->xfd; - if (__this_cpu_read(xfd_state) != xfd) { - wrmsrl(MSR_IA32_XFD, xfd); - __this_cpu_write(xfd_state, xfd); - } + if (__this_cpu_read(xfd_state) != xfd) + xfd_set_state(xfd); } } extern int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu); #else +static inline void xfd_set_state(u64 xfd) { } + static inline void xfd_update_state(struct fpstate *fpstate) { } static inline int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu) { -- 2.25.1

2 1

[PATCH OLK-6.6 00/36] mm: Backport some patch from mainline
by Liu Shixin 22 May '24

22 May '24

1. Patch series "Rearrange batched folio freeing" and bugfix 2. Patch series "Clean up __folio_put()" 2. Some bugfix. 3. Part of patch series "Improve anon_vma scalability for anon VMAs." Lucas Stach (1): mm: page_alloc: control latency caused by zone PCP draining Matthew Wilcox (Oracle) (30): mm: make folios_put() the basis of release_pages() mm: convert free_unref_page_list() to use folios mm: add free_unref_folios() mm: use folios_put() in __folio_batch_release() memcg: add mem_cgroup_uncharge_folios() mm: remove use of folio list from folios_put() mm: use free_unref_folios() in put_pages_list() mm: use __page_cache_release() in folios_put() mm: handle large folios in free_unref_folios() mm: allow non-hugetlb large folios to be batch processed mm: free folios in a batch in shrink_folio_list() mm: free folios directly in move_folios_to_lru() memcg: remove mem_cgroup_uncharge_list() mm: remove free_unref_page_list() mm: remove lru_to_page() mm: convert free_pages_and_swap_cache() to use folios_put() mm: use a folio in __collapse_huge_page_copy_succeeded() mm: convert free_swap_cache() to take a folio mm: remove folio from deferred split list before uncharging it mm: fix list corruption in put_pages_list mm: increase folio batch size mm: free non-hugetlb large folios in a batch mm: combine free_the_page() and free_unref_page() mm: inline destroy_large_folio() into __folio_put_large() mm: combine __folio_put_small, __folio_put_large and __folio_put mm: convert free_zone_device_page to free_zone_device_folio mm: always initialise folio->_deferred_list mm: assert the mmap_lock is held in __anon_vma_prepare() mm: delay the check for a NULL anon_vma mm: optimise vmf_anon_prepare() for VMAs without an anon_vma Miaohe Lin (1): mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() Mike Kravetz (2): hugetlb: set hugetlb page flag before optimizing vmemmap hugetlb: check for hugetlb folio before vmemmap_restore Richard Chang (1): mm: add alloc_contig_migrate_range allocation statistics Vishal Moola (Oracle) (1): mm/memory: change vmf_anon_prepare() to be non-static include/linux/memcontrol.h | 26 ++-- include/linux/mm.h | 19 +-- include/linux/pagevec.h | 4 +- include/linux/swap.h | 8 +- include/trace/events/kmem.h | 38 ++++++ mm/huge_memory.c | 8 +- mm/hugetlb.c | 60 ++++++---- mm/hugetlb_vmemmap.c | 3 + mm/internal.h | 12 +- mm/khugepaged.c | 30 +++-- mm/memcontrol.c | 19 ++- mm/memory.c | 46 +++++--- mm/memremap.c | 30 ++--- mm/mlock.c | 3 +- mm/page_alloc.c | 169 ++++++++++++++------------ mm/page_isolation.c | 2 +- mm/rmap.c | 3 +- mm/swap.c | 230 +++++++++++++++++++----------------- mm/swap_state.c | 31 +++-- mm/vmscan.c | 58 +++++---- 20 files changed, 448 insertions(+), 351 deletions(-) -- 2.25.1

2 37

[PATCH OLK-5.10 v3 00/33] Port livepatch related patches
by Zheng Yejian 22 May '24

22 May '24

Link: https://gitee.com/openeuler/kernel/issues/I9R2TB v2->v3: - Explicitly disable CONFIG_LIVEPATCH_BREAKPOINT_NO_STOP_MACHINE to fix checkdefconfig fail. Link: https://openeulerjenkins.osinfra.cn/job/multiarch/job/openeuler/job/x86-64/… v1->v2: - Fix format warning and a bug in check_task_calltrace() of ppc32 & ppc64 Masami Hiramatsu (3): x86/unwind: Recover kretprobe trampoline entry x86/unwind: Compile kretprobe fixup code only if CONFIG_KRETPROBES=y arm64: Recover kretprobe modified return address in stacktrace Zheng Yejian (30): livepatch: Move 'struct klp_func_list' out of arch livepatch/x86: Move 'struct klp_func_list' related codes out of arch livepatch/arm: Remove duplicate 'struct klp_func_list' related codes livepatch/arm64: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc32: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc64: Remove duplicate 'struct klp_func_list' related codes livepatch/x86: Implement arch_klp_check_task_calltrace() livepatch/arm: Implement arch_klp_check_task_calltrace() livepatch/arm64: Implement arch_klp_check_task_calltrace() livepatch/ppc32: Implement arch_klp_check_task_calltrace() livepatch/ppc64: Implement arch_klp_check_task_calltrace() livepatch/x86: Ajust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc32: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/core: No stop machine in KLP_STACK_OPTIMIZE mode livepatch: Complete check calltrace for running tasks livepatch: Check calltrace of idle tasks livepatch: Organize active functions with struct 'list_head' livepatch: Fix huge_depth in arch_klp_check_activeness_func() livepatch: Use func->func_node directly livepatch/core: Make several functions to be static livepatch: Fix warning C_RULE_ID_SINGLE_BRANCH_IF_AND_LOOP_BRACKET livepatch: Reduce duplicate definition of 'struct walk_stackframe_args' ftrace: Fix possible use-after-free issue in ftrace_location() kprobes: Fix possible use-after-free issue on kprobe registration livepatch: Avoid patching conflicts with kprobes kprobes: Add kretprobe_find_ret_addr() for searching return address livepatch: Update related configs in openeuler_defconfig arch/arm/include/asm/livepatch.h | 6 - arch/arm/kernel/livepatch.c | 334 +++++------------ arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/include/asm/livepatch.h | 4 - arch/arm64/kernel/livepatch.c | 360 ++++++------------- arch/arm64/kernel/stacktrace.c | 4 + arch/powerpc/include/asm/livepatch.h | 6 +- arch/powerpc/kernel/livepatch.c | 22 ++ arch/powerpc/kernel/livepatch_32.c | 366 +++++-------------- arch/powerpc/kernel/livepatch_64.c | 434 ++++++++++------------- arch/powerpc/kernel/module_64.c | 29 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/include/asm/livepatch.h | 5 - arch/x86/include/asm/unwind.h | 26 ++ arch/x86/kernel/livepatch.c | 320 ++++------------- arch/x86/kernel/unwind_frame.c | 3 +- arch/x86/kernel/unwind_guess.c | 3 +- arch/x86/kernel/unwind_orc.c | 21 +- include/linux/kprobes.h | 24 ++ include/linux/livepatch.h | 30 +- kernel/kprobes.c | 66 +++- kernel/livepatch/Kconfig | 25 ++ kernel/livepatch/core.c | 473 ++++++++++++++++++++++++- kernel/trace/ftrace.c | 39 +- 24 files changed, 1243 insertions(+), 1361 deletions(-) -- 2.25.1

2 34

[PATCH OLK-5.10] netrom: Fix data-races around sysctl_net_busy_read
by Hongbo Li 22 May '24

22 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit bbf950a6e96a91cf8cf0c71117b94ed3fafc9dd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94D CVE: CVE-2024-27419 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d380ce70058a4ccddc3e5f5c2063165dc07672c6 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- net/netrom/nr_in.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 24747163122b..7ff5940f5b96 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -954,7 +954,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) * G8PZT's Xrouter which is sending packets with command type 7 * as an extension of the protocol. */ - if (sysctl_netrom_reset_circuit && + if (READ_ONCE(sysctl_netrom_reset_circuit) && (frametype != NR_RESET || flags != 0)) nr_transmit_reset(skb, 1); diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c index 69e58906c32b..034f79d11ae1 100644 --- a/net/netrom/nr_in.c +++ b/net/netrom/nr_in.c @@ -97,7 +97,7 @@ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb, break; case NR_RESET: - if (sysctl_netrom_reset_circuit) + if (READ_ONCE(sysctl_netrom_reset_circuit)) nr_disconnect(sk, ECONNRESET); break; @@ -128,7 +128,7 @@ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb, break; case NR_RESET: - if (sysctl_netrom_reset_circuit) + if (READ_ONCE(sysctl_netrom_reset_circuit)) nr_disconnect(sk, ECONNRESET); break; @@ -263,7 +263,7 @@ static int nr_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype break; case NR_RESET: - if (sysctl_netrom_reset_circuit) + if (READ_ONCE(sysctl_netrom_reset_circuit)) nr_disconnect(sk, ECONNRESET); break; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netrom: Fix data-races around sysctl_net_busy_read
by Hongbo Li 22 May '24

22 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit bbf950a6e96a91cf8cf0c71117b94ed3fafc9dd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94D CVE: CVE-2024-27419 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d380ce70058a4ccddc3e5f5c2063165dc07672c6 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hongbo Li <lihongbo22(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- net/netrom/nr_in.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index a5d819fa7c89..8f18fea17cfc 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -952,7 +952,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) * G8PZT's Xrouter which is sending packets with command type 7 * as an extension of the protocol. */ - if (sysctl_netrom_reset_circuit && + if (READ_ONCE(sysctl_netrom_reset_circuit) && (frametype != NR_RESET || flags != 0)) nr_transmit_reset(skb, 1); diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c index fbfdae452ff9..01ccd00d1c00 100644 --- a/net/netrom/nr_in.c +++ b/net/netrom/nr_in.c @@ -100,7 +100,7 @@ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb, break; case NR_RESET: - if (sysctl_netrom_reset_circuit) + if (READ_ONCE(sysctl_netrom_reset_circuit)) nr_disconnect(sk, ECONNRESET); break; @@ -131,7 +131,7 @@ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb, break; case NR_RESET: - if (sysctl_netrom_reset_circuit) + if (READ_ONCE(sysctl_netrom_reset_circuit)) nr_disconnect(sk, ECONNRESET); break; @@ -266,7 +266,7 @@ static int nr_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype break; case NR_RESET: - if (sysctl_netrom_reset_circuit) + if (READ_ONCE(sysctl_netrom_reset_circuit)) nr_disconnect(sk, ECONNRESET); break; -- 2.34.1

2 1

[PATCH OLK-5.10] ipv4: check for NULL idev in ip_route_use_hint()
by Zhengchao Shao 22 May '24

22 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.216 commit 7da0f91681c4902bc5c210356fdd963b04d5d1d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRDG CVE: CVE-2024-36008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 58a4c9b1e5a3e53c9148e80b90e1e43897ce77d1 ] syzbot was able to trigger a NULL deref in fib_validate_source() in an old tree [1]. It appears the bug exists in latest trees. All calls to __in_dev_get_rcu() must be checked for a NULL result. [1] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 2 PID: 3257 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425 Code: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 <42> 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf RSP: 0018:ffffc900015fee40 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0 RDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0 RBP: ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000 R10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000 FS: 00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231 ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327 ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline] ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638 ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673 __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline] __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620 __netif_receive_skb_list net/core/dev.c:5672 [inline] netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764 netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816 xdp_recv_frames net/bpf/test_run.c:257 [inline] xdp_test_run_batch net/bpf/test_run.c:335 [inline] bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363 bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376 bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736 __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115 __do_sys_bpf kernel/bpf/syscall.c:5201 [inline] __se_sys_bpf kernel/bpf/syscall.c:5199 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199 Fixes: 02b24941619f ("ipv4: use dst hint for ipv4 list receive") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/20240421184326.1704930-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/route.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 6260963775d5..81ccad22a904 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -2081,6 +2081,9 @@ int ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr, int err = -EINVAL; u32 tag = 0; + if (!in_dev) + return -EINVAL; + if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr)) goto martian_source; -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: iwlwifi: dbg-tlv: ensure NUL termination
by Zheng Yejian 22 May '24

22 May '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.10.214 commit fabe2db7de32a881e437ee69db32e0de785a6209 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9E2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ] The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it. Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Gregory Greenman <gregory.greenman(a)intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Link: https://msgid.link/20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c index bcaec8a184cd..299819d2d190 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c @@ -155,6 +155,12 @@ static int iwl_dbg_tlv_alloc_debug_info(struct iwl_trans *trans, if (le32_to_cpu(tlv->length) != sizeof(*debug_info)) return -EINVAL; + /* we use this as a string, ensure input was NUL terminated */ + if (strnlen(debug_info->debug_cfg_name, + sizeof(debug_info->debug_cfg_name)) == + sizeof(debug_info->debug_cfg_name)) + return -EINVAL; + IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n", debug_info->debug_cfg_name); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2] x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
by Yang Yingliang 22 May '24

22 May '24

From: Adamos Ttofari <attofari(a)amazon.de> mainline inclusion from mainline-v6.9-rc1 commit 10e4b5166df9ff7a2d5316138ca668b42d004422 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NZ3E Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfd_state to keep the MSR_IA32_XFD value cached, in order to avoid unnecessary writes to the MSR. On CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync. As a consequence a subsequent xfd_update_state() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel. To fix this, introduce xfd_set_state() to write xfd_state together with MSR_IA32_XFD, and use it in all places that set MSR_IA32_XFD. Fixes: 672365477ae8 ("x86/fpu: Update XFD state where required") Signed-off-by: Adamos Ttofari <attofari(a)amazon.de> Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20240322230439.456571-1-chang.seok.bae@intel.com Closes: https://lore.kernel.org/lkml/20230511152818.13839-1-attofari@amazon.de Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kernel/fpu/xstate.c | 5 +++-- arch/x86/kernel/fpu/xstate.h | 14 ++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index 6ceb0996e23a..78dcdf348218 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -176,10 +176,11 @@ void fpu__init_cpu_xstate(void) * Must happen after CR4 setup and before xsetbv() to allow KVM * lazy passthrough. Write independent of the dynamic state static * key as that does not work on the boot CPU. This also ensures - * that any stale state is wiped out from XFD. + * that any stale state is wiped out from XFD. Reset the per CPU + * xfd cache too. */ if (cpu_feature_enabled(X86_FEATURE_XFD)) - wrmsrl(MSR_IA32_XFD, init_fpstate.xfd); + xfd_set_state(init_fpstate.xfd); /* * XCR_XFEATURE_ENABLED_MASK (aka. XCR0) sets user features diff --git a/arch/x86/kernel/fpu/xstate.h b/arch/x86/kernel/fpu/xstate.h index 8707ba0f1a8b..6536c416ba2e 100644 --- a/arch/x86/kernel/fpu/xstate.h +++ b/arch/x86/kernel/fpu/xstate.h @@ -151,20 +151,26 @@ static inline void xfd_validate_state(struct fpstate *fpstate, u64 mask, bool rs #endif #ifdef CONFIG_X86_64 +static inline void xfd_set_state(u64 xfd) +{ + wrmsrl(MSR_IA32_XFD, xfd); + __this_cpu_write(xfd_state, xfd); +} + static inline void xfd_update_state(struct fpstate *fpstate) { if (fpu_state_size_dynamic()) { u64 xfd = fpstate->xfd; - if (__this_cpu_read(xfd_state) != xfd) { - wrmsrl(MSR_IA32_XFD, xfd); - __this_cpu_write(xfd_state, xfd); - } + if (__this_cpu_read(xfd_state) != xfd) + xfd_set_state(xfd); } } extern int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu); #else +static inline void xfd_set_state(u64 xfd) { } + static inline void xfd_update_state(struct fpstate *fpstate) { } static inline int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu) { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
by Yang Yingliang 22 May '24

22 May '24

From: Adamos Ttofari <attofari(a)amazon.de> mainline inclusion from mainline-v6.9-rc1 commit 10e4b5166df9ff7a2d5316138ca668b42d004422 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NZ3E Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfd_state to keep the MSR_IA32_XFD value cached, in order to avoid unnecessary writes to the MSR. On CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync. As a consequence a subsequent xfd_update_state() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel. To fix this, introduce xfd_set_state() to write xfd_state together with MSR_IA32_XFD, and use it in all places that set MSR_IA32_XFD. Fixes: 672365477ae8 ("x86/fpu: Update XFD state where required") Signed-off-by: Adamos Ttofari <attofari(a)amazon.de> Signed-off-by: Chang S. Bae <chang.seok.bae(a)intel.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20240322230439.456571-1-chang.seok.bae@intel.com Closes: https://lore.kernel.org/lkml/20230511152818.13839-1-attofari@amazon.de Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/x86/kernel/fpu/xstate.c | 5 +++-- arch/x86/kernel/fpu/xstate.h | 14 ++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c index 6ceb0996e23a..78dcdf348218 100644 --- a/arch/x86/kernel/fpu/xstate.c +++ b/arch/x86/kernel/fpu/xstate.c @@ -176,10 +176,11 @@ void fpu__init_cpu_xstate(void) * Must happen after CR4 setup and before xsetbv() to allow KVM * lazy passthrough. Write independent of the dynamic state static * key as that does not work on the boot CPU. This also ensures - * that any stale state is wiped out from XFD. + * that any stale state is wiped out from XFD. Reset the per CPU + * xfd cache too. */ if (cpu_feature_enabled(X86_FEATURE_XFD)) - wrmsrl(MSR_IA32_XFD, init_fpstate.xfd); + xfd_set_state(init_fpstate.xfd); /* * XCR_XFEATURE_ENABLED_MASK (aka. XCR0) sets user features diff --git a/arch/x86/kernel/fpu/xstate.h b/arch/x86/kernel/fpu/xstate.h index 8707ba0f1a8b..6536c416ba2e 100644 --- a/arch/x86/kernel/fpu/xstate.h +++ b/arch/x86/kernel/fpu/xstate.h @@ -151,20 +151,26 @@ static inline void xfd_validate_state(struct fpstate *fpstate, u64 mask, bool rs #endif #ifdef CONFIG_X86_64 +static inline void xfd_set_state(u64 xfd) +{ + wrmsrl(MSR_IA32_XFD, xfd); + __this_cpu_write(xfd_state, xfd); +} + static inline void xfd_update_state(struct fpstate *fpstate) { if (fpu_state_size_dynamic()) { u64 xfd = fpstate->xfd; - if (__this_cpu_read(xfd_state) != xfd) { - wrmsrl(MSR_IA32_XFD, xfd); - __this_cpu_write(xfd_state, xfd); - } + if (__this_cpu_read(xfd_state) != xfd) + xfd_set_state(xfd); } } extern int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu); #else +static inline void xfd_set_state(u64 xfd) { } + static inline void xfd_update_state(struct fpstate *fpstate) { } static inline int __xfd_enable_feature(u64 which, struct fpu_guest *guest_fpu) { -- 2.25.1

2 1

[PATCH OLK-5.10] mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
by Zhengchao Shao 22 May '24

22 May '24

From: Ido Schimmel <idosch(a)nvidia.com> stable inclusion from stable-v5.10.216 commit 09846c2309b150b8ce4e0ce96f058197598fc530 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRA8 CVE: CVE-2024-36006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b377add0f0117409c418ddd6504bd682ebe0bf79 ] Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1]. Fix by returning if the lists are empty as there is nothing to migrate in this case. [1] WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Fixes: 6f9579d4e302 ("mlxsw: spectrum_acl: Remember where to continue rehash migration") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Tested-by: Alexander Zubkov <green(a)qrator.net> Reviewed-by: Petr Machata <petrm(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/4628e9a22d1d84818e28310abbbc498e7bc31bc9.17137971… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index d3f99c6b3cae..6f3e82675cc2 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -1263,6 +1263,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, return 0; } + if (list_empty(&vchunk->ventry_list)) + goto out; + /* If the migration got interrupted, we have the ventry to start from * stored in context. */ @@ -1312,6 +1315,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, } } +out: mlxsw_sp_acl_tcam_vchunk_migrate_end(mlxsw_sp, vchunk, ctx); return 0; } @@ -1325,6 +1329,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_all(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_vchunk *vchunk; int err; + if (list_empty(&vregion->vchunk_list)) + return 0; + /* If the migration got interrupted, we have the vchunk * we are working on stored in context. */ -- 2.34.1

2 1

[openeuler:OLK-6.6 7647/9681] kernel/livepatch/core.c:216:13: warning: no previous prototype for function 'arch_klp_skip_resolve'
by kernel test robot 22 May '24

22 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f3f9407325616af0ea4e2399d86d31f8571fa55f commit: b8f3220637be1736c165c289c634f27841ac4e01 [7647/9681] livepatch: add arch hook before doing klp_resolve_symbols config: x86_64-randconfig-073-20240521 (https://download.01.org/0day-ci/archive/20240522/202405220709.iFr8nwBK-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240522/202405220709.iFr8nwBK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405220709.iFr8nwBK-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/livepatch/core.c:97:12: warning: no previous prototype for function 'arch_klp_init_func' [-Wmissing-prototypes] 97 | int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) | ^ kernel/livepatch/core.c:97:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 97 | int __weak arch_klp_init_func(struct klp_object *obj, struct klp_func *func) | ^ | static >> kernel/livepatch/core.c:216:13: warning: no previous prototype for function 'arch_klp_skip_resolve' [-Wmissing-prototypes] 216 | bool __weak arch_klp_skip_resolve(unsigned int type) | ^ kernel/livepatch/core.c:216:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 216 | bool __weak arch_klp_skip_resolve(unsigned int type) | ^ | static kernel/livepatch/core.c:1767:12: warning: no previous prototype for function 'arch_klp_check_activeness_func' [-Wmissing-prototypes] 1767 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^ kernel/livepatch/core.c:1767:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1767 | int __weak arch_klp_check_activeness_func(struct klp_func *func, int enable, | ^ | static kernel/livepatch/core.c:2022:14: warning: no previous prototype for function 'arch_klp_mem_alloc' [-Wmissing-prototypes] 2022 | void __weak *arch_klp_mem_alloc(size_t size) | ^ kernel/livepatch/core.c:2022:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2022 | void __weak *arch_klp_mem_alloc(size_t size) | ^ | static kernel/livepatch/core.c:2027:13: warning: no previous prototype for function 'arch_klp_mem_free' [-Wmissing-prototypes] 2027 | void __weak arch_klp_mem_free(void *mem) | ^ kernel/livepatch/core.c:2027:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2027 | void __weak arch_klp_mem_free(void *mem) | ^ | static kernel/livepatch/core.c:2063:13: warning: no previous prototype for function 'arch_klp_set_brk_func' [-Wmissing-prototypes] 2063 | void __weak arch_klp_set_brk_func(struct klp_func_node *func_node, void *new_func) | ^ kernel/livepatch/core.c:2063:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2063 | void __weak arch_klp_set_brk_func(struct klp_func_node *func_node, void *new_func) | ^ | static 6 warnings generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for DRM_I915_DEBUG_GEM Depends on [n]: HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && DRM_I915_WERROR [=n] Selected by [m]: - DRM_I915_DEBUG [=y] && HAS_IOMEM [=y] && DRM_I915 [=m] && EXPERT [=y] && !COMPILE_TEST [=n] vim +/arch_klp_skip_resolve +216 kernel/livepatch/core.c 214 215 #ifdef CONFIG_LIVEPATCH_WO_FTRACE > 216 bool __weak arch_klp_skip_resolve(unsigned int type) 217 { 218 return false; 219 } 220 #endif 221 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9639/9681] iommu.c:undefined reference to `iova_reserve_domain_addr'
by kernel test robot 22 May '24

22 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f3f9407325616af0ea4e2399d86d31f8571fa55f commit: 40c9fc02b0564bbcbc3fc6e14f3aea3639f0afa6 [9639/9681] iommu/vt-d: Add support for detecting ACPI namespace device in RMRR config: x86_64-buildonly-randconfig-006-20240521 (https://download.01.org/0day-ci/archive/20240522/202405220526.7luJhPRs-lkp@…) compiler: gcc-12 (Ubuntu 12.3.0-9ubuntu2) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240522/202405220526.7luJhPRs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405220526.7luJhPRs-lkp@intel.com/ All errors (new ones prefixed by >>): ld: vmlinux.o: in function `iommu_create_device_direct_mappings': >> iommu.c:(.text+0x668a92): undefined reference to `iova_reserve_domain_addr' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9619/9677] arch/x86/kernel/zhaoxin_kh40000.c:87:33: warning: initialization of 'struct iommu_domain *' from 'int' makes pointer from integer without a cast
by kernel test robot 22 May '24

22 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f3f9407325616af0ea4e2399d86d31f8571fa55f commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9619/9677] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-randconfig-102-20240521 (https://download.01.org/0day-ci/archive/20240522/202405220034.VMppwRxc-lkp@…) compiler: gcc-10 (Ubuntu 10.5.0-1ubuntu1) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240522/202405220034.VMppwRxc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405220034.VMppwRxc-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/zhaoxin_kh40000.c: In function 'kh40000_sync_single_dma_for_cpu': arch/x86/kernel/zhaoxin_kh40000.c:87:33: error: implicit declaration of function 'iommu_get_dma_domain'; did you mean 'iommu_is_dma_domain'? [-Werror=implicit-function-declaration] 87 | struct iommu_domain *domain = iommu_get_dma_domain(dev); | ^~~~~~~~~~~~~~~~~~~~ | iommu_is_dma_domain >> arch/x86/kernel/zhaoxin_kh40000.c:87:33: warning: initialization of 'struct iommu_domain *' from 'int' makes pointer from integer without a cast [-Wint-conversion] cc1: some warnings being treated as errors vim +87 arch/x86/kernel/zhaoxin_kh40000.c 64 65 static void kh40000_sync_single_dma_for_cpu(struct device *dev, dma_addr_t paddr, 66 enum dma_data_direction dir, bool is_iommu) 67 { 68 u8 vid; 69 struct pci_dev *pci; 70 u64 dma_mask = *dev->dma_mask; 71 72 /* check direction */ 73 if ((dir != DMA_FROM_DEVICE) && (dir != DMA_BIDIRECTIONAL)) 74 return; 75 76 /* check dma capability */ 77 if (dma_mask <= DMA_BIT_MASK(32)) 78 return; 79 80 /* check device type */ 81 pci = kh40000_get_pci_dev(dev); 82 if (pci == NULL) 83 return; 84 85 /* get real physical address */ 86 if (is_iommu) { > 87 struct iommu_domain *domain = iommu_get_dma_domain(dev); 88 89 paddr = iommu_iova_to_phys(domain, paddr); 90 if (!paddr) 91 return; 92 } 93 94 /* check node or not */ 95 if ((zhaoxin_patch_code & ZHAOXIN_P2CW_NODE_CHECK) 96 && pfn_to_nid(PFN_DOWN(paddr)) == dev_to_node(dev)) 97 return; 98 99 /* flush data by one pci read cycle */ 100 pci_read_config_byte(pci, PCI_VENDOR_ID, &vid); 101 } 102 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
by Yipeng Zou 21 May '24

21 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R3F8 CVE: NA -------------------------------- There are many link error when QOS_SCHED_DYNAMIC_AFFINITY = y && FAIR_CGROUP_SCHED=n. The QOS_SCHED_DYNAMIC_AFFINITY feature need FAIR_CGROUP_SCHED has been selected first. Fixes: 229f5c1f3868 ("sched: Introduce dynamic affinity for cfs scheduler") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- init/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig b/init/Kconfig index 69bd400daeb3..d6422dc138d8 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1069,6 +1069,7 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" depends on CPUSETS + depends on FAIR_CGROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.34.1

2 1

[PATCH OLK-6.6 v2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
by Yipeng Zou 21 May '24

21 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R3F8 CVE: NA -------------------------------- There are many link error when QOS_SCHED_DYNAMIC_AFFINITY = y && FAIR_CGROUP_SCHED=n. The QOS_SCHED_DYNAMIC_AFFINITY feature need FAIR_CGROUP_SCHED has been selected first. Fixes: 890af1b1e1d5 ("sched: Introduce dynamic affinity for cfs scheduler") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- init/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig b/init/Kconfig index 4b16ac2efda8..dc49f231294a 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1128,6 +1128,7 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" depends on CPUSETS + depends on FAIR_CGROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.34.1

2 1

[PATCH OLK-5.10] loop: use lo->lo_disk for kobject_uevent
by Li Nan 21 May '24

21 May '24

hulk inclusion category: bugfix bugzilla: 189922, https://gitee.com/openeuler/kernel/issues/I9PXKA CVE: NA -------------------------------- The current implimentation of partitions for loop has several issues. 'loop_device' is at the gendisk level, but it uses 'lo_device' to store block_device. A gendisk can have multiple block_devices, and 'lo_device' can be set to anyone of them through loop_configure(). This usage can lead to a null-ptr-deref issue. If 'lo_device' is set to a block_device of partition, this partition is closed and 'bd_openers' is dec to 0, the 'bd_disk' of that block_device will be set to NULL in __blkdev_put(). In this case, Accessing 'lo_device->bd_disk' will trigger the issue. The problem can be reproduced as follows: 1. create loop device loop0 and create a partition loop0p1. 2. submit the ioctl LOOP_CLR_FD by loop0. 3. submit the ioctl LOOP_SET_FD by loop0p1. 4. submit ioctl such as LOOP_SET_STATUS by loop0. Fix it by using 'lo->lo_disk' instead of 'lo->lo_device->bd_disk' for kobject_uevent(). Fixes: c01a21b77722 ("loop: Fix occasional uevent drop") Fixes: c3473c63542d ("generate "change" uevent for loop device") Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/loop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index c64b22ce2bec..8eefd1462c3f 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -243,7 +243,7 @@ static void loop_set_size(struct loop_device *lo, loff_t size) bd_set_nr_sectors(bdev, size); if (!set_capacity_revalidate_and_notify(lo->lo_disk, size, false)) - kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); + kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE); } static inline int @@ -1250,7 +1250,7 @@ static int __loop_clr_fd(struct loop_device *lo, bool release) if (bdev) { bd_set_nr_sectors(bdev, 0); /* let user-space know about this change */ - kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE); + kobject_uevent(&disk_to_dev(lo->lo_disk)->kobj, KOBJ_CHANGE); } mapping_set_gfp_mask(filp->f_mapping, gfp); /* This is safe: open() is still holding a reference. */ -- 2.39.2

2 1

[PATCH OLK-5.10 v2 00/33] Port livepatch related patches
by Zheng Yejian 21 May '24

21 May '24

Link: https://gitee.com/openeuler/kernel/issues/I9R2TB v1->v2: Fix format warning and a bug in check_task_calltrace() of ppc32 & ppc64 Masami Hiramatsu (3): x86/unwind: Recover kretprobe trampoline entry x86/unwind: Compile kretprobe fixup code only if CONFIG_KRETPROBES=y arm64: Recover kretprobe modified return address in stacktrace Zheng Yejian (30): livepatch: Move 'struct klp_func_list' out of arch livepatch/x86: Move 'struct klp_func_list' related codes out of arch livepatch/arm: Remove duplicate 'struct klp_func_list' related codes livepatch/arm64: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc32: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc64: Remove duplicate 'struct klp_func_list' related codes livepatch/x86: Implement arch_klp_check_task_calltrace() livepatch/arm: Implement arch_klp_check_task_calltrace() livepatch/arm64: Implement arch_klp_check_task_calltrace() livepatch/ppc32: Implement arch_klp_check_task_calltrace() livepatch/ppc64: Implement arch_klp_check_task_calltrace() livepatch/x86: Ajust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc32: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/core: No stop machine in KLP_STACK_OPTIMIZE mode livepatch: Complete check calltrace for running tasks livepatch: Check calltrace of idle tasks livepatch: Organize active functions with struct 'list_head' livepatch: Fix huge_depth in arch_klp_check_activeness_func() livepatch: Use func->func_node directly livepatch/core: Make several functions to be static livepatch: Fix warning C_RULE_ID_SINGLE_BRANCH_IF_AND_LOOP_BRACKET livepatch: Reduce duplicate definition of 'struct walk_stackframe_args' ftrace: Fix possible use-after-free issue in ftrace_location() kprobes: Fix possible use-after-free issue on kprobe registration livepatch: Avoid patching conflicts with kprobes kprobes: Add kretprobe_find_ret_addr() for searching return address livepatch: Enable CONFIG_LIVEPATCH_ISOLATE_KPROBE in openeuler_defconfig arch/arm/include/asm/livepatch.h | 6 - arch/arm/kernel/livepatch.c | 334 +++++------------ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/livepatch.h | 4 - arch/arm64/kernel/livepatch.c | 360 ++++++------------- arch/arm64/kernel/stacktrace.c | 4 + arch/powerpc/include/asm/livepatch.h | 6 +- arch/powerpc/kernel/livepatch.c | 22 ++ arch/powerpc/kernel/livepatch_32.c | 366 +++++-------------- arch/powerpc/kernel/livepatch_64.c | 434 ++++++++++------------- arch/powerpc/kernel/module_64.c | 29 +- arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/livepatch.h | 5 - arch/x86/include/asm/unwind.h | 26 ++ arch/x86/kernel/livepatch.c | 320 ++++------------- arch/x86/kernel/unwind_frame.c | 3 +- arch/x86/kernel/unwind_guess.c | 3 +- arch/x86/kernel/unwind_orc.c | 21 +- include/linux/kprobes.h | 24 ++ include/linux/livepatch.h | 30 +- kernel/kprobes.c | 66 +++- kernel/livepatch/Kconfig | 25 ++ kernel/livepatch/core.c | 473 ++++++++++++++++++++++++- kernel/trace/ftrace.c | 39 +- 24 files changed, 1241 insertions(+), 1361 deletions(-) -- 2.25.1

2 34

[PATCH OLK-5.10] Revert "[Backport] lib/vdso: Mark do_hres_timens() and do_coarse_timens() __always_inline()"
by Xiongfeng Wang 21 May '24

21 May '24

Offering: HULK hulk inclusion category: bugfix bugzilla: 188007 -------------------------------- The following commit cause libMicro-0.4.0 testcase 'times' performance regression both on X86 and ARM64. Let's revert it. This reverts commit 3e6288e7a73db88cea3ccbbf8610cc1cf0db4479. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- lib/vdso/gettimeofday.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/lib/vdso/gettimeofday.c b/lib/vdso/gettimeofday.c index c6f6dee08746..2919f1698140 100644 --- a/lib/vdso/gettimeofday.c +++ b/lib/vdso/gettimeofday.c @@ -46,8 +46,8 @@ static inline bool vdso_cycles_ok(u64 cycles) #endif #ifdef CONFIG_TIME_NS -static __always_inline int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, - struct __kernel_timespec *ts) +static int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, + struct __kernel_timespec *ts) { const struct vdso_data *vd = __arch_get_timens_vdso_data(); const struct timens_offset *offs = &vdns->offset[clk]; @@ -97,8 +97,8 @@ static __always_inline const struct vdso_data *__arch_get_timens_vdso_data(void) return NULL; } -static __always_inline int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, - struct __kernel_timespec *ts) +static int do_hres_timens(const struct vdso_data *vdns, clockid_t clk, + struct __kernel_timespec *ts) { return -EINVAL; } @@ -159,8 +159,8 @@ static __always_inline int do_hres(const struct vdso_data *vd, clockid_t clk, } #ifdef CONFIG_TIME_NS -static __always_inline int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, - struct __kernel_timespec *ts) +static int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, + struct __kernel_timespec *ts) { const struct vdso_data *vd = __arch_get_timens_vdso_data(); const struct vdso_timestamp *vdso_ts = &vd->basetime[clk]; @@ -188,8 +188,8 @@ static __always_inline int do_coarse_timens(const struct vdso_data *vdns, clocki return 0; } #else -static __always_inline int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, - struct __kernel_timespec *ts) +static int do_coarse_timens(const struct vdso_data *vdns, clockid_t clk, + struct __kernel_timespec *ts) { return -1; } -- 2.20.1

2 1

[PATCH OLK-6.6] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
by Yipeng Zou 21 May '24

21 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R3F8 CVE: NA -------------------------------- There are many link error when QOS_SCHED_DYNAMIC_AFFINITY = y && FAIR_CGROUP_SCHED=n. The QOS_SCHED_DYNAMIC_AFFINITY feature need FAIR_CGROUP_SCHED has been selected first. Fixes: 229f5c1f3868 ("sched: Introduce dynamic affinity for cfs scheduler") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- init/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig b/init/Kconfig index 4b16ac2efda8..dc49f231294a 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1128,6 +1128,7 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" depends on CPUSETS + depends on FAIR_CGROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.34.1

2 1

[OLK-5.10] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED
by Yipeng Zou 21 May '24

21 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R3F8 CVE: NA -------------------------------- There are many link error when QOS_SCHED_DYNAMIC_AFFINITY = y && FAIR_CGROUP_SCHED=n. The QOS_SCHED_DYNAMIC_AFFINITY feature need FAIR_CGROUP_SCHED has been selected first. Fixes: 229f5c1f3868 ("sched: Introduce dynamic affinity for cfs scheduler") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- init/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig b/init/Kconfig index 69bd400daeb3..d6422dc138d8 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1069,6 +1069,7 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" depends on CPUSETS + depends on FAIR_CGROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.34.1

1 0

[PATCH OLK-5.10 0/4] adjusting the interface to adapt to the cca community
by Ju Fu 21 May '24

21 May '24

adjusting the interface to adapt to the cca community: cvm: enable secure memory alloc on multiple numa nodes cvm: support observable usage of secure memory cvm: adjusting the interface to adapt to the cca community cvm: fix data_create ram region arch/arm64/include/asm/kvm_pgtable.h | 3 + arch/arm64/include/asm/kvm_tmi.h | 44 +- arch/arm64/include/asm/kvm_tmm.h | 4 +- arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/include/uapi/asm/kvm.h | 4 + arch/arm64/kvm/arm.c | 11 +- arch/arm64/kvm/cvm.c | 441 ++++++++++++-------- arch/arm64/kvm/reset.c | 6 + arch/arm64/kvm/tmi.c | 23 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 + include/uapi/linux/kvm.h | 6 +- 11 files changed, 354 insertions(+), 194 deletions(-) -- 2.25.1.windows.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-27002
by Yongqiang Liu 21 May '24

21 May '24

Yongqiang Liu (1): clk: mediatek: Do a runtime PM get on controllers during probe drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.34.1

2 2

[PATCH v4 OLK-5.10 00/11] sync hulk-5.10 patches
by Yu Kuai 21 May '24

21 May '24

Changes in v4: - just resend Changes in v3: - modify openeuler_defconfig for disabled new config in patch 1,2 Changes in v2: - fix head in commit message Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (9): block: add a switch to enable hungtask check for io block: disable BLK_IO_HUNG_TASK_CHECK by default blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue block: support to disable debugfs by default arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 31 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 87 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 12 ++++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 ++++++++++++++++++---- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 8 ++- kernel/trace/blktrace.c | 3 - 18 files changed, 249 insertions(+), 42 deletions(-) -- 2.39.2

2 12

[PATCH OLK-5.10 0/3] fix CVE-2024-35839
by Zhengchao Shao 21 May '24

21 May '24

Fix CVE-2024-35839. Pavel Tikhomirov (3): netfilter: nfnetlink_log: use proper helper for fetching physinif netfilter: propagate net to nf_bridge_get_physindev netfilter: bridge: replace physindev with physinif in nf_bridge_info include/linux/netfilter_bridge.h | 6 ++-- include/linux/skbuff.h | 2 +- include/net/netfilter/nf_log.h | 2 +- net/bridge/br_netfilter_hooks.c | 41 +++++++++++++++++----- net/bridge/br_netfilter_ipv6.c | 14 +++++--- net/ipv4/netfilter/nf_log_arp.c | 2 +- net/ipv4/netfilter/nf_log_ipv4.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 9 +++-- net/ipv6/netfilter/nf_log_ipv6.c | 2 +- net/ipv6/netfilter/nf_reject_ipv6.c | 11 ++++-- net/netfilter/ipset/ip_set_hash_netiface.c | 8 ++--- net/netfilter/nf_log_common.c | 5 +-- net/netfilter/nf_queue.c | 2 +- net/netfilter/nfnetlink_log.c | 8 ++--- net/netfilter/xt_physdev.c | 2 +- 15 files changed, 78 insertions(+), 38 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/3] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 21 May '24

21 May '24

Xiongfeng Wang (3): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arch/arm64/Kconfig | 3 +++ include/linux/cpu.h | 3 ++- include/linux/sched/isolation.h | 5 +++++ kernel/sched/isolation.c | 39 +++++++++++++++++++++++++++++---- kernel/smp.c | 4 ++++ kernel/time/tick-sched.c | 3 ++- 6 files changed, 51 insertions(+), 6 deletions(-) -- 2.30.0

2 4

[PATCH v3 RESEND OLK-5.10 00/11] sync hulk-5.10 patches
by Yu Kuai 21 May '24

21 May '24

Changes in v3: - modify openeuler_defconfig for disabled new config Changes in v2: - fix head in commit message Three features related: - add a switch to enable hungtask check for io, patch 1-2 - add a config to control hierarchical throttle, patch 3-4 - support enable/disable blk-mq debugfs dynamically, patch 5-11 Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (9): block: add a switch to enable hungtask check for io block: disable BLK_IO_HUNG_TASK_CHECK by default blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue block: support to disable debugfs by default arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 31 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 87 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 12 ++++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 ++++++++++++++++++---- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 8 ++- kernel/trace/blktrace.c | 3 - 18 files changed, 249 insertions(+), 42 deletions(-) -- 2.39.2

2 12

[PATCH openEuler-22.03-LTS 0/1] CVE-2023-52655
by Yongqiang Liu 21 May '24

21 May '24

Oliver Neukum (1): usb: aqc111: check packet for fixup for true limit drivers/net/usb/aqc111.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 00/33] Port livepatch related patches
by Zheng Yejian 21 May '24

21 May '24

Link: https://gitee.com/openeuler/kernel/issues/I9R2TB Masami Hiramatsu (3): x86/unwind: Recover kretprobe trampoline entry x86/unwind: Compile kretprobe fixup code only if CONFIG_KRETPROBES=y arm64: Recover kretprobe modified return address in stacktrace Zheng Yejian (30): livepatch: Move 'struct klp_func_list' out of arch livepatch/x86: Move 'struct klp_func_list' related codes out of arch livepatch/arm: Remove duplicate 'struct klp_func_list' related codes livepatch/arm64: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc32: Remove duplicate 'struct klp_func_list' related codes livepatch/ppc64: Remove duplicate 'struct klp_func_list' related codes livepatch/x86: Implement arch_klp_check_task_calltrace() livepatch/arm: Implement arch_klp_check_task_calltrace() livepatch/arm64: Implement arch_klp_check_task_calltrace() livepatch/ppc32: Implement arch_klp_check_task_calltrace() livepatch/ppc64: Implement arch_klp_check_task_calltrace() livepatch/x86: Ajust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/arm64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc32: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/ppc64: Adjust instruction replace order for KLP_STACK_OPTIMIZE mode livepatch/core: No stop machine in KLP_STACK_OPTIMIZE mode livepatch: Complete check calltrace for running tasks livepatch: Check calltrace of idle tasks livepatch: Organize active functions with struct 'list_head' [Huawei] livepatch: Fix huge_depth in arch_klp_check_activeness_func() livepatch: Use func->func_node directly livepatch/core: Make several functions to be static livepatch: Fix warning C_RULE_ID_SINGLE_BRANCH_IF_AND_LOOP_BRACKET livepatch: Reduce duplicate definition of 'struct walk_stackframe_args' ftrace: Fix possible use-after-free issue in ftrace_location() kprobes: Fix possible use-after-free issue on kprobe registration livepatch: Avoid patching conflicts with kprobes kprobes: Add kretprobe_find_ret_addr() for searching return address livepatch: Enable CONFIG_LIVEPATCH_ISOLATE_KPROBE in openeuler_defconfig arch/arm/include/asm/livepatch.h | 6 - arch/arm/kernel/livepatch.c | 334 +++++------------ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/livepatch.h | 4 - arch/arm64/kernel/livepatch.c | 360 ++++++------------- arch/arm64/kernel/stacktrace.c | 4 + arch/powerpc/include/asm/livepatch.h | 6 +- arch/powerpc/kernel/livepatch.c | 22 ++ arch/powerpc/kernel/livepatch_32.c | 367 +++++-------------- arch/powerpc/kernel/livepatch_64.c | 435 ++++++++++------------- arch/powerpc/kernel/module_64.c | 29 +- arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/livepatch.h | 5 - arch/x86/include/asm/unwind.h | 26 ++ arch/x86/kernel/livepatch.c | 320 ++++------------- arch/x86/kernel/unwind_frame.c | 3 +- arch/x86/kernel/unwind_guess.c | 3 +- arch/x86/kernel/unwind_orc.c | 21 +- include/linux/kprobes.h | 24 ++ include/linux/livepatch.h | 30 +- kernel/kprobes.c | 66 +++- kernel/livepatch/Kconfig | 25 ++ kernel/livepatch/core.c | 473 ++++++++++++++++++++++++- kernel/trace/ftrace.c | 39 +- 24 files changed, 1243 insertions(+), 1361 deletions(-) -- 2.25.1

2 34

[PATCH v3 OLK-5.10 00/11] sync hulk-5.10 patches
by Yu Kuai 21 May '24

21 May '24

Changes in v3: - modify openeuler_defconfig for disabled new config Changes in v2: - fix head in commit message Three features related: - add a switch to enable hungtask check for io, patch 1-2 - add a config to control hierarchical throttle, patch 3-4 - support enable/disable blk-mq debugfs dynamically, patch 5-11 Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (9): block: add a switch to enable hungtask check for io block: disable BLK_IO_HUNG_TASK_CHECK by default blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue block: support to disable debugfs by default arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 31 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 87 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 12 ++++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 ++++++++++++++++++---- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 8 ++- kernel/trace/blktrace.c | 3 - 18 files changed, 249 insertions(+), 42 deletions(-) -- 2.39.2

2 12

[PATCH OLK-5.10 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[openeuler:openEuler-1.0-LTS 21291/22450] drivers/spi/spi-phytium-plat.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 May '24

21 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5708160127a606e51a136509cfe0a9448a09849a commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [21291/22450] spi: add phytium spi support config: x86_64-buildonly-randconfig-004-20240521 (https://download.01.org/0day-ci/archive/20240521/202405211804.T84TVKIc-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240521/202405211804.T84TVKIc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405211804.T84TVKIc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/spi/spi-phytium-plat.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP2] bpf: Guard stack limits against 32bit overflow
by Pu Lehui 21 May '24

21 May '24

From: Andrei Matei <andreimatei1(a)gmail.com> mainline inclusion from mainline-v6.8-rc1 commit 1d38a9ee81570c4bd61f557832dead4d6f816760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EW CVE: CVE-2023-52676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… Reported-by: Andrii Nakryiko <andrii.nakryiko(a)gmail.com> Signed-off-by: Andrei Matei <andreimatei1(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com Conflicts: kernel/bpf/verifier.c [The conflict is because some modifications were merged by the commit 8f5863d230fed ("bpf: Fix accesses to uninit stack slots")] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c781e753e9a9..b74fd334a2ca 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3770,7 +3770,7 @@ static int check_stack_access_within_bounds( struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; struct bpf_func_state *state = func(env, reg); - int min_off, max_off; + s64 min_off, max_off; int err; char *err_extra; @@ -3783,7 +3783,7 @@ static int check_stack_access_within_bounds( err_extra = " write to"; if (tnum_is_const(reg->var_off)) { - min_off = reg->var_off.value + off; + min_off = (s64)reg->var_off.value + off; max_off = min_off + access_size; } else { if (reg->smax_value >= BPF_MAX_VAR_OFF || -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Guard stack limits against 32bit overflow
by Pu Lehui 21 May '24

21 May '24

From: Andrei Matei <andreimatei1(a)gmail.com> mainline inclusion from mainline-v6.8-rc1 commit 1d38a9ee81570c4bd61f557832dead4d6f816760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EW CVE: CVE-2023-52676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… Reported-by: Andrii Nakryiko <andrii.nakryiko(a)gmail.com> Signed-off-by: Andrei Matei <andreimatei1(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com Conflicts: kernel/bpf/verifier.c [The conflict is because some modifications were merged by the commit db2a27bb5398e ("bpf: Fix accesses to uninit stack slots")] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d5706782be14..946e485a102c 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3697,7 +3697,7 @@ static int check_stack_access_within_bounds( struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; struct bpf_func_state *state = func(env, reg); - int min_off, max_off; + s64 min_off, max_off; int err; char *err_extra; @@ -3710,7 +3710,7 @@ static int check_stack_access_within_bounds( err_extra = " write to"; if (tnum_is_const(reg->var_off)) { - min_off = reg->var_off.value + off; + min_off = (s64)reg->var_off.value + off; max_off = min_off + access_size; } else { if (reg->smax_value >= BPF_MAX_VAR_OFF || -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] bpf: Guard stack limits against 32bit overflow
by Pu Lehui 21 May '24

21 May '24

From: Andrei Matei <andreimatei1(a)gmail.com> mainline inclusion from mainline-v6.8-rc1 commit 1d38a9ee81570c4bd61f557832dead4d6f816760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EW CVE: CVE-2023-52676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… Reported-by: Andrii Nakryiko <andrii.nakryiko(a)gmail.com> Signed-off-by: Andrei Matei <andreimatei1(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com Conflicts: kernel/bpf/verifier.c [The conflict is because some modifications were merged by the commit f18a791ef88ed ("bpf: Fix accesses to uninit stack slots")] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1b7e855962b8..222aa218f826 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3696,7 +3696,7 @@ static int check_stack_access_within_bounds( struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; struct bpf_func_state *state = func(env, reg); - int min_off, max_off; + s64 min_off, max_off; int err; char *err_extra; @@ -3709,7 +3709,7 @@ static int check_stack_access_within_bounds( err_extra = " write to"; if (tnum_is_const(reg->var_off)) { - min_off = reg->var_off.value + off; + min_off = (s64)reg->var_off.value + off; max_off = min_off + access_size; } else { if (reg->smax_value >= BPF_MAX_VAR_OFF || -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
by Cheng Yu 21 May '24

21 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.9-rc1 commit 5d7f58ee08434a33340f75ac7ac5071eea9673b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGK5 CVE: CVE-2024-35943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Link: https://lore.kernel.org/r/20240118054257.200814-1-chentao@kylinos.cn Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Conflicts: drivers/soc/ti/omap_prm.c drivers/pmdomain/ti/omap_prm.c [This is a conflict caused by commit e2ad626f8f40("pmdomain: Rename the genpd subsystem to pmdomain") which is not merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/soc/ti/omap_prm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c index 4a782bfd753c..2ce8a8f4f005 100644 --- a/drivers/soc/ti/omap_prm.c +++ b/drivers/soc/ti/omap_prm.c @@ -381,6 +381,8 @@ static int omap_prm_domain_init(struct device *dev, struct omap_prm *prm) data = prm->data; name = devm_kasprintf(dev, GFP_KERNEL, "prm_%s", data->name); + if (!name) + return -ENOMEM; prmd->dev = dev; prmd->prm = prm; -- 2.25.1

2 1

[PATCH OLK-5.10 V1] pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
by Cheng Yu 21 May '24

21 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.9-rc1 commit 5d7f58ee08434a33340f75ac7ac5071eea9673b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGK5 CVE: CVE-2024-35943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Link: https://lore.kernel.org/r/20240118054257.200814-1-chentao@kylinos.cn Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Conflicts: drivers/soc/ti/omap_prm.c drivers/pmdomain/ti/omap_prm.c [This is a conflict caused by commit e2ad626f8f40("pmdomain: Rename the genpd subsystem to pmdomain") which is not merged.] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/soc/ti/omap_prm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c index 4a782bfd753c..2ce8a8f4f005 100644 --- a/drivers/soc/ti/omap_prm.c +++ b/drivers/soc/ti/omap_prm.c @@ -381,6 +381,8 @@ static int omap_prm_domain_init(struct device *dev, struct omap_prm *prm) data = prm->data; name = devm_kasprintf(dev, GFP_KERNEL, "prm_%s", data->name); + if (!name) + return -ENOMEM; prmd->dev = dev; prmd->prm = prm; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
by Yang Yingliang 21 May '24

21 May '24

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> mainline inclusion from mainline-v6.7-rc2 commit 86222a8fc16ec517de8da2604d904c9df3a08e5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9FV CVE: CVE-2023-52685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return 64-bit value since persistent_ram_zone::buffer_size has type size_t which is derived from the 64-bit *unsigned long*, while the ecc_blocks variable this value gets assigned to has (always 32-bit) *int* type. Even if that value fits into *int* type, an overflow is still possible when calculating the size_t typed ecc_total variable further below since there's no cast to any 64-bit type before multiplication. Declaring the ecc_blocks variable as *size_t* should fix this mess... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support") Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index a0fa3820ef2a..5ac9b1f155a8 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, { int numerr; struct persistent_ram_buffer *buffer = prz->buffer; - int ecc_blocks; + size_t ecc_blocks; size_t ecc_total; if (!ecc_info || !ecc_info->ecc_size) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ext4/resize.c [ Commit 31f13421c004a420c("ext4: correct offset of gdb backup in non meta_bg group to update_backups") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 767cbebf04ee..eb10a43b1498 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1558,7 +1558,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t old_gdb = 0; update_backups(sb, sbi->s_sbh->b_blocknr, (char *)es, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
by Li Lingfeng 21 May '24

21 May '24

From: Justin Tee <justin.tee(a)broadcom.com> stable inclusion from stable-v5.10.215 commit c473288f27d15014447de5a891bdf22a0695847a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGLA CVE: CVE-2024-35930 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2ae917d4bcab80ab304b774d492e2fcd6c52c06b ] The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an unsuccessful status. In such cases, the elsiocb is not issued, the completion is not called, and thus the elsiocb resource is leaked. Check return value after calling lpfc_sli4_resume_rpi() and conditionally release the elsiocb resource. Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Link: https://lore.kernel.org/r/20240131185112.149731-3-justintee8345@gmail.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_nportdisc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c index 1e22364a31fc..d6287c58d504 100644 --- a/drivers/scsi/lpfc/lpfc_nportdisc.c +++ b/drivers/scsi/lpfc/lpfc_nportdisc.c @@ -784,8 +784,10 @@ lpfc_rcv_padisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, /* Save the ELS cmd */ elsiocb->drvrTimeout = cmd; - lpfc_sli4_resume_rpi(ndlp, - lpfc_mbx_cmpl_resume_rpi, elsiocb); + if (lpfc_sli4_resume_rpi(ndlp, + lpfc_mbx_cmpl_resume_rpi, + elsiocb)) + kfree(elsiocb); goto out; } } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
by Li Lingfeng 21 May '24

21 May '24

From: Justin Tee <justin.tee(a)broadcom.com> stable inclusion from stable-v5.10.215 commit c473288f27d15014447de5a891bdf22a0695847a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGLA CVE: CVE-2024-35930 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2ae917d4bcab80ab304b774d492e2fcd6c52c06b ] The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an unsuccessful status. In such cases, the elsiocb is not issued, the completion is not called, and thus the elsiocb resource is leaked. Check return value after calling lpfc_sli4_resume_rpi() and conditionally release the elsiocb resource. Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Link: https://lore.kernel.org/r/20240131185112.149731-3-justintee8345@gmail.com Reviewed-by: Himanshu Madhani <himanshu.madhani(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_nportdisc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c index 3dfed191252c..22e336cb2284 100644 --- a/drivers/scsi/lpfc/lpfc_nportdisc.c +++ b/drivers/scsi/lpfc/lpfc_nportdisc.c @@ -601,8 +601,10 @@ lpfc_rcv_padisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, /* Save the ELS cmd */ elsiocb->drvrTimeout = cmd; - lpfc_sli4_resume_rpi(ndlp, - lpfc_mbx_cmpl_resume_rpi, elsiocb); + if (lpfc_sli4_resume_rpi(ndlp, + lpfc_mbx_cmpl_resume_rpi, + elsiocb)) + kfree(elsiocb); goto out; } } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52669
by Yongqiang Liu 21 May '24

21 May '24

Herbert Xu (1): crypto: s390/aes - Fix buffer overread in CTR mode arch/s390/crypto/aes_s390.c | 5 +++-- arch/s390/crypto/paes_s390.c | 4 +++- 2 files changed, 6 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP2] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ext4/resize.c [ Commit 31f13421c004a420c("ext4: correct offset of gdb backup in non meta_bg group to update_backups") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 58980c6acbc8..b433d28b76a5 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1548,7 +1548,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t old_gdb = 0; update_backups(sb, ext4_group_first_block_no(sb, 0), -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
by Li Zetao 21 May '24

21 May '24

From: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R0VC Reference: https://lore.kernel.org/all/1716212077-43826-1-git-send-email-xiaojiangfeng… ---------------------------------------- When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly. The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays. When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes signed int file_disp; // 4 bytes unsigned short line; // 2 bytes unsigned short flags; // 2 bytes } ... with 12 bytes total, requiring 4-byte alignment. When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes unsigned short flags; // 2 bytes < implicit padding > // 2 bytes } ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment. When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes. For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes when searching for entries: for (bug = __start___bug_table; bug < __stop___bug_table; ++bug) if (bugaddr == bug_addr(bug)) return bug; However for modules, module_bug_finalize() depends on the trailing bytes when calculating the number of entries: mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry); ... and as the last bug_entry lacks the necessary padding bytes, this entry will not be counted, e.g. in the case of a single entry: sechdrs[i].sh_size == 6 sizeof(struct bug_entry) == 8; sechdrs[i].sh_size / sizeof(struct bug_entry) == 0; Consequently module_find_bug() will miss the last bug_entry when it does: for (i = 0; i < mod->num_bugs; ++i, ++bug) if (bugaddr == bug_addr(bug)) goto out; ... which can lead to a kenrel panic due to an unhandled bug. This can be demonstrated with the following module: static int __init buginit(void) { WARN(1, "hello\n"); return 0; } static void __exit bugexit(void) { } module_init(buginit); module_exit(bugexit); MODULE_LICENSE("GPL"); ... which will trigger a kernel panic when loaded: ------------[ cut here ]------------ hello Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: hello(O+) CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8 Hardware name: linux,dummy-virt (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : buginit+0x18/0x1000 [hello] lr : buginit+0x18/0x1000 [hello] sp : ffff800080533ae0 x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000 x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58 x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0 x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006 x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720 x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312 x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 Call trace: buginit+0x18/0x1000 [hello] do_one_initcall+0x80/0x1c8 do_init_module+0x60/0x218 load_module+0x1ba4/0x1d70 __do_sys_init_module+0x198/0x1d0 __arm64_sys_init_module+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xd8 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 Code: d0ffffe0 910003fd 91000000 9400000b (d4210000) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: BRK handler: Fatal exception Fix this by always aligning the end of a bug_entry to 4 bytes, which is correct regardless of CONFIG_DEBUG_BUGVERBOSE. Fixes: 9fb7410f955f ("arm64/BUG: Use BRK instruction for generic BUG traps") Signed-off-by: Yuanbin Xie <xieyuanbin1(a)huawei.com> Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Reviewed-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/asm-bug.h | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/include/asm/asm-bug.h b/arch/arm64/include/asm/asm-bug.h index b3552c4a405f2..13a5abaac36bf 100644 --- a/arch/arm64/include/asm/asm-bug.h +++ b/arch/arm64/include/asm/asm-bug.h @@ -39,6 +39,7 @@ 14470: .long 14471f - 14470b; \ _BUGVERBOSE_LOCATION(__FILE__, __LINE__) \ .short flags; \ + .align 2; \ .popsection; \ 14471: #else -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP2] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ext4/resize.c [ Commit 31f13421c004a420c("ext4: correct offset of gdb backup in non meta_bg group to update_backups") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 58980c6acbc8..b433d28b76a5 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1548,7 +1548,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t old_gdb = 0; update_backups(sb, sbi->s_sbh->b_blocknr, (char *)es, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ext4/resize.c [ Commit 31f13421c004a420c("ext4: correct offset of gdb backup in non meta_bg group to update_backups") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 58980c6acbc8..b433d28b76a5 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1548,7 +1548,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t old_gdb = 0; update_backups(sb, sbi->s_sbh->b_blocknr, (char *)es, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ext4/resize.c [ Commit 31f13421c004a420c("ext4: correct offset of gdb backup in non meta_bg group to update_backups") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 58980c6acbc8..b433d28b76a5 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1548,7 +1548,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t old_gdb = 0; update_backups(sb, sbi->s_sbh->b_blocknr, (char *)es, -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] Bluetooth: af_bluetooth: Fix deadlock
by Li Huafei 21 May '24

21 May '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.9-rc1 commit f7b94bdc1ec107c92262716b073b3e816d4784fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK0R CVE: CVE-2024-26886 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioctl to avoid the UAF: INFO: task kworker/u9:1:121 blocked for more than 30 seconds. Not tainted 6.7.6-lemon #183 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __schedule+0x37d/0xa00 schedule+0x32/0xe0 __lock_sock+0x68/0xa0 ? __pfx_autoremove_wake_function+0x10/0x10 lock_sock_nested+0x43/0x50 l2cap_sock_recv_cb+0x21/0xa0 l2cap_recv_frame+0x55b/0x30a0 ? psi_task_switch+0xeb/0x270 ? finish_task_switch.isra.0+0x93/0x2a0 hci_rx_work+0x33a/0x3f0 process_one_work+0x13a/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe0/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: 2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/af_bluetooth.c [ The conflict occurred because commit f4b41f062c42 ("net: remove noblock parameter from skb_recv_datagram()") and b8ddc3b14c7a ("Bluetooth: fix indentation and alignment reported by checkpatch") were not merged. ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- net/bluetooth/af_bluetooth.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index 363f85c617bbc..0bd7ad4e72dc6 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -263,14 +263,11 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, if (flags & MSG_OOB) return -EOPNOTSUPP; - lock_sock(sk); - skb = skb_recv_datagram(sk, flags, noblock, &err); if (!skb) { if (sk->sk_shutdown & RCV_SHUTDOWN) err = 0; - release_sock(sk); return err; } @@ -293,8 +290,6 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, skb_free_datagram(sk, skb); - release_sock(sk); - if (flags & MSG_TRUNC) copied = skblen; @@ -519,10 +514,11 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) if (sk->sk_state == BT_LISTEN) return -EINVAL; - lock_sock(sk); + spin_lock(&sk->sk_receive_queue.lock); skb = skb_peek(&sk->sk_receive_queue); amount = skb ? skb->len : 0; - release_sock(sk); + spin_unlock(&sk->sk_receive_queue.lock); + err = put_user(amount, (int __user *) arg); break; -- 2.25.1

2 1

[PATCH OLK-5.10] Bluetooth: af_bluetooth: Fix deadlock
by Li Huafei 21 May '24

21 May '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.9-rc1 commit f7b94bdc1ec107c92262716b073b3e816d4784fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK0R CVE: CVE-2024-26886 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioctl to avoid the UAF: INFO: task kworker/u9:1:121 blocked for more than 30 seconds. Not tainted 6.7.6-lemon #183 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __schedule+0x37d/0xa00 schedule+0x32/0xe0 __lock_sock+0x68/0xa0 ? __pfx_autoremove_wake_function+0x10/0x10 lock_sock_nested+0x43/0x50 l2cap_sock_recv_cb+0x21/0xa0 l2cap_recv_frame+0x55b/0x30a0 ? psi_task_switch+0xeb/0x270 ? finish_task_switch.isra.0+0x93/0x2a0 hci_rx_work+0x33a/0x3f0 process_one_work+0x13a/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe0/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: 2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/af_bluetooth.c [ The conflict occurred because commit f4b41f062c42 ("net: remove noblock parameter from skb_recv_datagram()") and b8ddc3b14c7a ("Bluetooth: fix indentation and alignment reported by checkpatch") were not merged. ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- net/bluetooth/af_bluetooth.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index 14a917e70f3ee..bb648d2a14fbb 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -263,14 +263,11 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, if (flags & MSG_OOB) return -EOPNOTSUPP; - lock_sock(sk); - skb = skb_recv_datagram(sk, flags, noblock, &err); if (!skb) { if (sk->sk_shutdown & RCV_SHUTDOWN) err = 0; - release_sock(sk); return err; } @@ -296,8 +293,6 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, skb_free_datagram(sk, skb); - release_sock(sk); - if (flags & MSG_TRUNC) copied = skblen; @@ -520,10 +515,11 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) if (sk->sk_state == BT_LISTEN) return -EINVAL; - lock_sock(sk); + spin_lock(&sk->sk_receive_queue.lock); skb = skb_peek(&sk->sk_receive_queue); amount = skb ? skb->len : 0; - release_sock(sk); + spin_unlock(&sk->sk_receive_queue.lock); + err = put_user(amount, (int __user *) arg); break; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/ext4/resize.c [ Commit 31f13421c004a420c("ext4: correct offset of gdb backup in non meta_bg group to update_backups") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 767cbebf04ee..eb10a43b1498 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1558,7 +1558,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t old_gdb = 0; update_backups(sb, sbi->s_sbh->b_blocknr, (char *)es, -- 2.31.1

1 0

[PATCH openEuler-22.03-LTS-SP2 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52669
by Yongqiang Liu 21 May '24

21 May '24

Herbert Xu (1): crypto: s390/aes - Fix buffer overread in CTR mode arch/s390/crypto/aes_s390.c | 5 +++-- arch/s390/crypto/paes_s390.c | 4 +++- 2 files changed, 6 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP2] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 2d022055675c..9edc8da921f4 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1551,7 +1551,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr - ext4_group_first_block_no(sb, 0); sector_t old_gdb = 0; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 2d022055675c..9edc8da921f4 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1551,7 +1551,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr - ext4_group_first_block_no(sb, 0); sector_t old_gdb = 0; -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 2d022055675c..9edc8da921f4 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1551,7 +1551,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr - ext4_group_first_block_no(sb, 0); sector_t old_gdb = 0; -- 2.31.1

2 1

[PATCH OLK-5.10] ext4: fix corruption during on-line resize
by Zhihao Cheng 21 May '24

21 May '24

From: Maximilian Heyne <mheyne(a)amazon.de> stable inclusion from stable-v5.10.215 commit e8e8b197317228b5089ed9e7802dadf3ccaa027a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CF CVE: CVE-2024-35807 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a6b3bfe176e8a5b05ec4447404e412c2a3fc92cc ] We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096 of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test # 79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test # 3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The last checksum might be different depending on how the file is laid out across the physical blocks. The actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of the meta block group's block descriptor. During the on-line resize the file system will be converted to meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB. However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group yet. In the reproducer we achieved this by substracting the size of a whole block group from the point where the meta block group would start. This must be considered when updating the backup block group descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already part of the meta block group or not. Fixes: 01f795f9e0d67 ("ext4: add online resizing support for meta_bg and 64-bit file systems") Cc: <stable(a)vger.kernel.org> Signed-off-by: Maximilian Heyne <mheyne(a)amazon.de> Tested-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Reviewed-by: Srivathsa Dara <srivathsa.d.dara(a)oracle.com> Link: https://lore.kernel.org/r/20240215155009.94493-1-mheyne@amazon.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index 2d022055675c..9edc8da921f4 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1551,7 +1551,8 @@ static int ext4_flex_group_add(struct super_block *sb, int gdb_num = group / EXT4_DESC_PER_BLOCK(sb); int gdb_num_end = ((group + flex_gd->count - 1) / EXT4_DESC_PER_BLOCK(sb)); - int meta_bg = ext4_has_feature_meta_bg(sb); + int meta_bg = ext4_has_feature_meta_bg(sb) && + gdb_num >= le32_to_cpu(es->s_first_meta_bg); sector_t padding_blocks = meta_bg ? 0 : sbi->s_sbh->b_blocknr - ext4_group_first_block_no(sb, 0); sector_t old_gdb = 0; -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY
by Li Zetao 21 May '24

21 May '24

From: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: NA Reference: https://lore.kernel.org/all/1716212077-43826-1-git-send-email-xiaojiangfeng… ---------------------------------------- When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly. The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays. When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes signed int file_disp; // 4 bytes unsigned short line; // 2 bytes unsigned short flags; // 2 bytes } ... with 12 bytes total, requiring 4-byte alignment. When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes unsigned short flags; // 2 bytes < implicit padding > // 2 bytes } ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment. When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes. For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes when searching for entries: for (bug = __start___bug_table; bug < __stop___bug_table; ++bug) if (bugaddr == bug_addr(bug)) return bug; However for modules, module_bug_finalize() depends on the trailing bytes when calculating the number of entries: mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry); ... and as the last bug_entry lacks the necessary padding bytes, this entry will not be counted, e.g. in the case of a single entry: sechdrs[i].sh_size == 6 sizeof(struct bug_entry) == 8; sechdrs[i].sh_size / sizeof(struct bug_entry) == 0; Consequently module_find_bug() will miss the last bug_entry when it does: for (i = 0; i < mod->num_bugs; ++i, ++bug) if (bugaddr == bug_addr(bug)) goto out; ... which can lead to a kenrel panic due to an unhandled bug. This can be demonstrated with the following module: static int __init buginit(void) { WARN(1, "hello\n"); return 0; } static void __exit bugexit(void) { } module_init(buginit); module_exit(bugexit); MODULE_LICENSE("GPL"); ... which will trigger a kernel panic when loaded: ------------[ cut here ]------------ hello Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: hello(O+) CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8 Hardware name: linux,dummy-virt (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : buginit+0x18/0x1000 [hello] lr : buginit+0x18/0x1000 [hello] sp : ffff800080533ae0 x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000 x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58 x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0 x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006 x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720 x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312 x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 Call trace: buginit+0x18/0x1000 [hello] do_one_initcall+0x80/0x1c8 do_init_module+0x60/0x218 load_module+0x1ba4/0x1d70 __do_sys_init_module+0x198/0x1d0 __arm64_sys_init_module+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xd8 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 Code: d0ffffe0 910003fd 91000000 9400000b (d4210000) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: BRK handler: Fatal exception Fix this by always aligning the end of a bug_entry to 4 bytes, which is correct regardless of CONFIG_DEBUG_BUGVERBOSE. Fixes: 9fb7410f955f ("arm64/BUG: Use BRK instruction for generic BUG traps") Signed-off-by: Yuanbin Xie <xieyuanbin1(a)huawei.com> Signed-off-by: Jiangfeng Xiao <xiaojiangfeng(a)huawei.com> Reviewed-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Li Zetao <lizetao1(a)huawei.com> --- arch/arm64/include/asm/asm-bug.h | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/include/asm/asm-bug.h b/arch/arm64/include/asm/asm-bug.h index b3552c4a405f2..13a5abaac36bf 100644 --- a/arch/arm64/include/asm/asm-bug.h +++ b/arch/arm64/include/asm/asm-bug.h @@ -39,6 +39,7 @@ 14470: .long 14471f - 14470b; \ _BUGVERBOSE_LOCATION(__FILE__, __LINE__) \ .short flags; \ + .align 2; \ .popsection; \ 14471: #else -- 2.34.1

2 1

[PATCH OLK-5.10] dm snapshot: fix lockup in dm_exception_table_exit
by Li Lingfeng 21 May '24

21 May '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.4.274 commit e7d4cff57c3c43fdd72342c78d4138f509c7416e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CC CVE: CVE-2024-35805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6e7132ed3c07bd8a6ce3db4bb307ef2852b322dc ] There was reported lockup when we exit a snapshot with many exceptions. Fix this by adding "cond_resched" to the loop that frees the exceptions. Reported-by: John Pittman <jpittman(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-snap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c index 41735a25d50a..de73fe79640f 100644 --- a/drivers/md/dm-snap.c +++ b/drivers/md/dm-snap.c @@ -685,8 +685,10 @@ static void dm_exception_table_exit(struct dm_exception_table *et, for (i = 0; i < size; i++) { slot = et->table + i; - hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) + hlist_bl_for_each_entry_safe(ex, pos, n, slot, hash_list) { kmem_cache_free(mem, ex); + cond_resched(); + } } vfree(et->table); -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: Skip do PCI error slot reset during RAS recovery
by Liu Chuang 21 May '24

21 May '24

From: "Stanley.Yang" <Stanley.Yang(a)amd.com> mainline inclusion from mainline-v6.9-rc1 commit 601429cca96b4af3be44172c3b64e4228515dbe1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGL7 CVE: CVE-2024-26969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Why: The PCI error slot reset maybe triggered after inject ue to UMC multi times, this caused system hang. [ 557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume [ 557.373718] [drm] PCIE GART of 512M enabled. [ 557.373722] [drm] PTB located at 0x0000031FED700000 [ 557.373788] [drm] VRAM is lost due to GPU reset! [ 557.373789] [drm] PSP is resuming... [ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset [ 557.547067] [drm] PCI error: detected callback, state(1)!! [ 557.547069] [drm] No support for XGMI hive yet... [ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter [ 557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations [ 557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered [ 557.610492] [drm] PCI error: slot reset callback!! ... [ 560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI [ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic #101-Ubuntu [ 560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023 [ 560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu] [ 560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff <48> 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00 [ 560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202 [ 560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0 [ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010 [ 560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08 [ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000 [ 560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000 [ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000 [ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0 [ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 560.843444] PKRU: 55555554 [ 560.846480] Call Trace: [ 560.849225] <TASK> [ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.856488] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.861379] ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.867778] ? show_regs.part.0+0x23/0x29 [ 560.872293] ? __die_body.cold+0x8/0xd [ 560.876502] ? die_addr+0x3e/0x60 [ 560.880238] ? exc_general_protection+0x1c5/0x410 [ 560.885532] ? asm_exc_general_protection+0x27/0x30 [ 560.891025] ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.904520] process_one_work+0x228/0x3d0 How: In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure. Signed-off-by: Stanley.Yang <Stanley.Yang(a)amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_device.c Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c index bde0496d2f15..177d70b70471 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c @@ -4995,6 +4995,20 @@ pci_ers_result_t amdgpu_pci_slot_reset(struct pci_dev *pdev) bool need_full_reset = true; u32 memsize; struct list_head device_list; + struct amdgpu_hive_info *hive; + int hive_ras_recovery = 0; + struct amdgpu_ras *ras; + + /* PCI error slot reset should be skipped During RAS recovery */ + hive = amdgpu_get_xgmi_hive(adev); + if (hive) { + hive_ras_recovery = atomic_read(&hive->ras_recovery); + amdgpu_put_xgmi_hive(hive); + } + ras = amdgpu_ras_get_context(adev); + if ((amdgpu_ip_version(adev, GC_HWIP, 0) == IP_VERSION(9, 4, 3)) && + ras && (atomic_read(&ras->in_recovery) || hive_ras_recovery)) + return PCI_ERS_RESULT_RECOVERED; DRM_INFO("PCI error: slot reset callback!!\n"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] dm snapshot: fix lockup in dm_exception_table_exit
by Li Lingfeng 21 May '24

21 May '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.4.274 commit e7d4cff57c3c43fdd72342c78d4138f509c7416e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9CC CVE: CVE-2024-35805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6e7132ed3c07bd8a6ce3db4bb307ef2852b322dc ] There was reported lockup when we exit a snapshot with many exceptions. Fix this by adding "cond_resched" to the loop that frees the exceptions. Reported-by: John Pittman <jpittman(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/md/dm-snap.c [Commit f79ae415b64c change the way to traverse exception] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-snap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c index 52101e5c7258..ad65b4a8464d 100644 --- a/drivers/md/dm-snap.c +++ b/drivers/md/dm-snap.c @@ -650,8 +650,10 @@ static void dm_exception_table_exit(struct dm_exception_table *et, for (i = 0; i < size; i++) { slot = et->table + i; - list_for_each_entry_safe (ex, next, slot, hash_list) + list_for_each_entry_safe (ex, next, slot, hash_list) { kmem_cache_free(mem, ex); + cond_resched(); + } } vfree(et->table); -- 2.31.1

2 1

[PATCH OLK-5.10 0/3] xfs: three bug fix recently
by Long Li 21 May '24

21 May '24

This patch set fix three bug: Jiachen Zhang (1): xfs: ensure logflagsp is initialized in xfs_bmap_del_extent_real Long Li (1): iomap: fix warning in xfs_iomap_write_delalloc_release() Zhang Tianci (1): xfs: update dir3 leaf block metadata after swap fs/xfs/libxfs/xfs_bmap.c | 76 +++++++++++++++--------------------- fs/xfs/libxfs/xfs_da_btree.c | 7 ++++ fs/xfs/xfs_iomap.c | 2 +- 3 files changed, 40 insertions(+), 45 deletions(-) -- 2.31.1

2 4

[PATCH OLK-5.10] [Huawei] bpf: tcp: fix compilation fails during resolve_btfids when pahole version < 12
by Luo Gengkun 21 May '24

21 May '24

From: Yang Jihong <yangjihong1(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9QZ7Q ------------------------------- commit 63695db417a9 ("[Backport] bpf: tcp: Put some tcp cong functions in allowlist for bpf-tcp-cc") puts some tcp cong helper functions, into the allowlist for the bpf-tcp-cc program. The pahole version must be later than 1.21 (see [1]). Otherwise, compilation fails: LD .tmp_vmlinux.kallsyms1 KSYMS .tmp_vmlinux.kallsyms1.S AS .tmp_vmlinux.kallsyms1.S LD .tmp_vmlinux.kallsyms2 KSYMS .tmp_vmlinux.kallsyms2.S AS .tmp_vmlinux.kallsyms2.S LD vmlinux BTFIDS vmlinux FAILED unresolved symbol cubictcp_state make: *** [Makefile:1191: vmlinux] Error 255 The actual pahole version we use is 1.17, add pahole verion flags to move out functions. [1]: https://lore.kernel.org/dwarves/20210506015824.2335125-1-kafai@fb.com/ Fixes: e78aea8b2170 ("bpf: tcp: Put some tcp cong functions in allowlist for bpf-tcp-cc") Signed-off-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- net/ipv4/bpf_tcp_ca.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv4/bpf_tcp_ca.c b/net/ipv4/bpf_tcp_ca.c index 575245276f76..94863facecd7 100644 --- a/net/ipv4/bpf_tcp_ca.c +++ b/net/ipv4/bpf_tcp_ca.c @@ -187,6 +187,7 @@ BTF_ID(func, tcp_slow_start) BTF_ID(func, tcp_cong_avoid_ai) #ifdef CONFIG_X86 #ifdef CONFIG_DYNAMIC_FTRACE +#if CONFIG_PAHOLE_VERSION >= 120 #if IS_BUILTIN(CONFIG_TCP_CONG_CUBIC) BTF_ID(func, cubictcp_init) BTF_ID(func, cubictcp_recalc_ssthresh) @@ -213,6 +214,7 @@ BTF_ID(func, bbr_ssthresh) BTF_ID(func, bbr_min_tso_segs) BTF_ID(func, bbr_set_state) #endif +#endif /* CONFIG_PAHOLE_VERSION */ #endif /* CONFIG_DYNAMIC_FTRACE */ #endif /* CONFIG_X86 */ BTF_SET_END(bpf_tcp_ca_check_kfunc_ids) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS 0/2] CVE-2023-52676
by Pu Lehui 21 May '24

21 May '24

Andrei Matei (2): bpf: Fix verification of indirect var-off stack access bpf: Guard stack limits against 32bit overflow kernel/bpf/verifier.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] sched/all: Change all BUG_ON() instances in the scheduler to WARN_ON_ONCE()
by Zhao Wenhui 21 May '24

21 May '24

From: Ingo Molnar <mingo(a)kernel.org> mainline inclusion from mainline-v6.1-rc1 commit 09348d75a6ce60eec85c86dd0ab7babc4db3caf6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9QW75 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no good reason to crash a user's system with a BUG_ON(), chances are high that they'll never even see the crash message on Xorg, and it won't make it into the syslog either. By using a WARN_ON_ONCE() we at least give the user a chance to report any bugs triggered here - instead of getting silent hangs. None of these WARN_ON_ONCE()s are supposed to trigger, ever - so we ignore cases where a NULL check is done via a BUG_ON() and we let a NULL pointer through after a WARN_ON_ONCE(). There's one exception: WARN_ON_ONCE() arguments with side-effects, such as locking - in this case we use the return value of the WARN_ON_ONCE(), such as in: - BUG_ON(!lock_task_sighand(p, &flags)); + if (WARN_ON_ONCE(!lock_task_sighand(p, &flags))) + return; Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/YvSsKcAXISmshtHo@gmail.com Conflicts: kernel/sched/deadline.c kernel/sched/fair.c kernel/sched/core.c kernel/sched/sched.h [Some contexts around BUG_ON are different. No functional impact.] Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- kernel/sched/autogroup.c | 3 ++- kernel/sched/core.c | 2 +- kernel/sched/cpupri.c | 2 +- kernel/sched/deadline.c | 26 +++++++++++++------------- kernel/sched/fair.c | 10 +++++----- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 6 +++--- 7 files changed, 26 insertions(+), 25 deletions(-) diff --git a/kernel/sched/autogroup.c b/kernel/sched/autogroup.c index 640d4019deac..067f2e6d8546 100644 --- a/kernel/sched/autogroup.c +++ b/kernel/sched/autogroup.c @@ -139,7 +139,8 @@ autogroup_move_group(struct task_struct *p, struct autogroup *ag) struct task_struct *t; unsigned long flags; - BUG_ON(!lock_task_sighand(p, &flags)); + if (WARN_ON_ONCE(!lock_task_sighand(p, &flags))) + return; prev = p->signal->autogroup; if (prev == ag) { diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 7825ceaae0c4..fe9f91f39e2f 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -948,7 +948,7 @@ static struct rq *move_queued_task(struct rq *rq, struct rq_flags *rf, rq = cpu_rq(new_cpu); rq_lock(rq, rf); - BUG_ON(task_cpu(p) != new_cpu); + WARN_ON_ONCE(task_cpu(p) != new_cpu); enqueue_task(rq, p, 0); p->on_rq = TASK_ON_RQ_QUEUED; check_preempt_curr(rq, p, 0); diff --git a/kernel/sched/cpupri.c b/kernel/sched/cpupri.c index daaadf939ccb..324af8dcadc0 100644 --- a/kernel/sched/cpupri.c +++ b/kernel/sched/cpupri.c @@ -66,7 +66,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p, int idx = 0; int task_pri = convert_prio(p->prio); - BUG_ON(task_pri >= CPUPRI_NR_PRIORITIES); + WARN_ON_ONCE(task_pri >= CPUPRI_NR_PRIORITIES); for (idx = 0; idx < task_pri; idx++) { struct cpupri_vec *vec = &cp->pri_to_cpu[idx]; diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index 6c4f93af15db..43ecd27b37c8 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -157,7 +157,7 @@ void dl_change_utilization(struct task_struct *p, u64 new_bw) { struct rq *rq; - BUG_ON(p->dl.flags & SCHED_FLAG_SUGOV); + WARN_ON_ONCE(p->dl.flags & SCHED_FLAG_SUGOV); if (task_on_rq_queued(p)) return; @@ -450,7 +450,7 @@ static void enqueue_pushable_dl_task(struct rq *rq, struct task_struct *p) struct task_struct *entry; bool leftmost = true; - BUG_ON(!RB_EMPTY_NODE(&p->pushable_dl_tasks)); + WARN_ON_ONCE(!RB_EMPTY_NODE(&p->pushable_dl_tasks)); while (*link) { parent = *link; @@ -545,7 +545,7 @@ static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p * Failed to find any suitable CPU. * The task will never come back! */ - BUG_ON(dl_bandwidth_enabled()); + WARN_ON_ONCE(dl_bandwidth_enabled()); /* * If admission control is disabled we @@ -701,7 +701,7 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq = dl_rq_of_se(dl_se); struct rq *rq = rq_of_dl_rq(dl_rq); - BUG_ON(pi_se->dl_runtime <= 0); + WARN_ON_ONCE(pi_se->dl_runtime <= 0); /* * This could be the case for a !-dl task that is boosted. @@ -1407,7 +1407,7 @@ static void __enqueue_dl_entity(struct sched_dl_entity *dl_se) struct sched_dl_entity *entry; int leftmost = 1; - BUG_ON(!RB_EMPTY_NODE(&dl_se->rb_node)); + WARN_ON_ONCE(!RB_EMPTY_NODE(&dl_se->rb_node)); while (*link) { parent = *link; @@ -1443,7 +1443,7 @@ static void enqueue_dl_entity(struct sched_dl_entity *dl_se, struct sched_dl_entity *pi_se, int flags) { - BUG_ON(on_dl_rq(dl_se)); + WARN_ON_ONCE(on_dl_rq(dl_se)); /* * If this is a wakeup or a new instance, the scheduling @@ -1780,7 +1780,7 @@ pick_next_task_dl(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) put_prev_task(rq, prev); dl_se = pick_next_dl_entity(rq, dl_rq); - BUG_ON(!dl_se); + WARN_ON_ONCE(!dl_se); p = dl_task_of(dl_se); p->se.exec_start = rq_clock_task(rq); @@ -1987,12 +1987,12 @@ static struct task_struct *pick_next_pushable_dl_task(struct rq *rq) p = rb_entry(rq->dl.pushable_dl_tasks_root.rb_leftmost, struct task_struct, pushable_dl_tasks); - BUG_ON(rq->cpu != task_cpu(p)); - BUG_ON(task_current(rq, p)); - BUG_ON(p->nr_cpus_allowed <= 1); + WARN_ON_ONCE(rq->cpu != task_cpu(p)); + WARN_ON_ONCE(task_current(rq, p)); + WARN_ON_ONCE(p->nr_cpus_allowed <= 1); - BUG_ON(!task_on_rq_queued(p)); - BUG_ON(!dl_task(p)); + WARN_ON_ONCE(!task_on_rq_queued(p)); + WARN_ON_ONCE(!dl_task(p)); return p; } @@ -2266,7 +2266,7 @@ static void set_cpus_allowed_dl(struct task_struct *p, struct root_domain *src_rd; struct rq *rq; - BUG_ON(!dl_task(p)); + WARN_ON_ONCE(!dl_task(p)); rq = task_rq(p); src_rd = rq->rd; diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 6d0ec315f7be..3bd5aa6dedb3 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -2411,7 +2411,7 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags, if (!join) return; - BUG_ON(irqs_disabled()); + WARN_ON_ONCE(irqs_disabled()); double_lock_irq(&my_grp->lock, &grp->lock); for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++) { @@ -7595,7 +7595,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ find_matching_se(&se, &pse); update_curr(cfs_rq_of(se)); - BUG_ON(!pse); + WARN_ON_ONCE(!pse); if (wakeup_preempt_entity(se, pse) == 1) { /* * Bias pick_next to pick the sched entity that is @@ -8608,7 +8608,7 @@ static void attach_task(struct rq *rq, struct task_struct *p) { lockdep_assert_held(&rq->lock); - BUG_ON(task_rq(p) != rq); + WARN_ON_ONCE(task_rq(p) != rq); activate_task(rq, p, ENQUEUE_NOCLOCK); p->on_rq = TASK_ON_RQ_QUEUED; check_preempt_curr(rq, p, 0); @@ -9916,7 +9916,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, goto out_balanced; } - BUG_ON(busiest == env.dst_rq); + WARN_ON_ONCE(busiest == env.dst_rq); schedstat_add(sd->lb_imbalance[idle], env.imbalance); @@ -10212,7 +10212,7 @@ static int active_load_balance_cpu_stop(void *data) * we need to fix it. Originally reported by * Bjorn Helgaas on a 128-CPU setup. */ - BUG_ON(busiest_rq == target_rq); + WARN_ON_ONCE(busiest_rq == target_rq); /* Search for an sd spanning us and the target CPU. */ rcu_read_lock(); diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index ad893ec818cd..58364f489529 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -758,7 +758,7 @@ static void __disable_runtime(struct rq *rq) * We cannot be left wanting - that would mean some runtime * leaked out of the system. */ - BUG_ON(want); + WARN_ON_ONCE(want); balanced: /* * Disable all the borrow logic by pretending we have inf diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 1d882a2b8d5f..4dd0e4de0aab 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2146,8 +2146,8 @@ static inline void double_rq_lock(struct rq *rq1, struct rq *rq2) __acquires(rq1->lock) __acquires(rq2->lock) { - BUG_ON(!irqs_disabled()); - BUG_ON(rq1 != rq2); + WARN_ON_ONCE(!irqs_disabled()); + WARN_ON_ONCE(rq1 != rq2); raw_spin_lock(&rq1->lock); __acquire(rq2->lock); /* Fake it out ;) */ } @@ -2162,7 +2162,7 @@ static inline void double_rq_unlock(struct rq *rq1, struct rq *rq2) __releases(rq1->lock) __releases(rq2->lock) { - BUG_ON(rq1 != rq2); + WARN_ON_ONCE(rq1 != rq2); raw_spin_unlock(&rq1->lock); __release(rq2->lock); } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Guard stack limits against 32bit overflow
by Pu Lehui 21 May '24

21 May '24

From: Andrei Matei <andreimatei1(a)gmail.com> mainline inclusion from mainline-v6.8-rc1 commit 1d38a9ee81570c4bd61f557832dead4d6f816760 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9EW CVE: CVE-2023-52676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235f… Reported-by: Andrii Nakryiko <andrii.nakryiko(a)gmail.com> Signed-off-by: Andrei Matei <andreimatei1(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Acked-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com Conflicts: kernel/bpf/verifier.c [The conflict is because some modifications were merged by the commit 8463d83a25f00 ("bpf: Fix accesses to uninit stack slots")] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index b45dbd8b6348..34292a48e59c 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3917,7 +3917,7 @@ static int check_stack_access_within_bounds( struct bpf_reg_state *regs = cur_regs(env); struct bpf_reg_state *reg = regs + regno; struct bpf_func_state *state = func(env, reg); - int min_off, max_off; + s64 min_off, max_off; int err; char *err_extra; @@ -3930,7 +3930,7 @@ static int check_stack_access_within_bounds( err_extra = " write to"; if (tnum_is_const(reg->var_off)) { - min_off = reg->var_off.value + off; + min_off = (s64)reg->var_off.value + off; max_off = min_off + access_size; } else { if (reg->smax_value >= BPF_MAX_VAR_OFF || -- 2.34.1

2 1

[PATCH OLK-5.10] net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()
by Zhengchao Shao 21 May '24

21 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.215 commit bc4d1ebca11b4f194e262326bd45938e857c59d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGJZ CVE: CVE-2024-35934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 00af2aa93b76b1bade471ad0d0525d4d29ca5cc0 ] Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1] This patch returns early from smc_pnet_net_init() if there is no netdevice yet. I am not even sure why smc_pnet_create_pnetids_list() even exists, because smc_pnet_netdev_event() is also calling smc_pnet_add_base_pnetid() when handling NETDEV_UP event. [1] extract of typical syzbot reports 2 locks held by syz-executor.3/12252: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Wenjia Zhang <wenjia(a)linux.ibm.com> Cc: Jan Karcher <jaka(a)linux.ibm.com> Cc: "D. Wythe" <alibuda(a)linux.alibaba.com> Cc: Tony Lu <tonylu(a)linux.alibaba.com> Cc: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240302100744.3868021-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/smc/smc_pnet.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c index eb0971a1797a..bf8c662a6116 100644 --- a/net/smc/smc_pnet.c +++ b/net/smc/smc_pnet.c @@ -797,6 +797,16 @@ static void smc_pnet_create_pnetids_list(struct net *net) u8 ndev_pnetid[SMC_MAX_PNETID_LEN]; struct net_device *dev; + /* Newly created netns do not have devices. + * Do not even acquire rtnl. + */ + if (list_empty(&net->dev_base_head)) + return; + + /* Note: This might not be needed, because smc_pnet_netdev_event() + * is also calling smc_pnet_add_base_pnetid() when handling + * NETDEV_UP event. + */ rtnl_lock(); for_each_netdev(net, dev) smc_pnet_add_base_pnetid(net, dev, ndev_pnetid); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] btrfs: send: handle path ref underflow in header iterate_inode_ref()
by Wang Zhaolong 21 May '24

21 May '24

From: David Sterba <dsterba(a)suse.com> mainline inclusion from mainline-v6.9-rc1 commit 3c6ee34c6f9cd12802326da26631232a61743501 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIK CVE: CVE-2024-35935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses. Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/send.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 6b80dee17f49..23981c31c35f 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -966,7 +966,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path, ret = PTR_ERR(start); goto out; } - BUG_ON(start < p->buf); + if (unlikely(start < p->buf)) { + btrfs_err(root->fs_info, + "send: path ref buffer underflow for key (%llu %u %llu)", + found_key->objectid, + found_key->type, + found_key->offset); + ret = -EINVAL; + goto out; + } } p->start = start; } else { -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: send: handle path ref underflow in header iterate_inode_ref()
by Wang Zhaolong 21 May '24

21 May '24

From: David Sterba <dsterba(a)suse.com> mainline inclusion from mainline-v6.9-rc1 commit 3c6ee34c6f9cd12802326da26631232a61743501 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIK CVE: CVE-2024-35935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses. Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/send.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 6b80dee17f49..23981c31c35f 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -966,7 +966,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path, ret = PTR_ERR(start); goto out; } - BUG_ON(start < p->buf); + if (unlikely(start < p->buf)) { + btrfs_err(root->fs_info, + "send: path ref buffer underflow for key (%llu %u %llu)", + found_key->objectid, + found_key->type, + found_key->offset); + ret = -EINVAL; + goto out; + } } p->start = start; } else { -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP2] btrfs: send: handle path ref underflow in header iterate_inode_ref()
by Wang Zhaolong 21 May '24

21 May '24

From: David Sterba <dsterba(a)suse.com> mainline inclusion from mainline-v6.9-rc1 commit 3c6ee34c6f9cd12802326da26631232a61743501 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIK CVE: CVE-2024-35935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses. Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/send.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index b081b61e97c8..9f28d235f611 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -966,7 +966,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path, ret = PTR_ERR(start); goto out; } - BUG_ON(start < p->buf); + if (unlikely(start < p->buf)) { + btrfs_err(root->fs_info, + "send: path ref buffer underflow for key (%llu %u %llu)", + found_key->objectid, + found_key->type, + found_key->offset); + ret = -EINVAL; + goto out; + } } p->start = start; } else { -- 2.34.3

2 1

[PATCH OLK-5.10] btrfs: send: handle path ref underflow in header iterate_inode_ref()
by Wang Zhaolong 21 May '24

21 May '24

From: David Sterba <dsterba(a)suse.com> mainline inclusion from mainline-v6.9-rc1 commit 3c6ee34c6f9cd12802326da26631232a61743501 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIK CVE: CVE-2024-35935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses. Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/send.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 4e7bf22a8c36..6e5a1ca3c1c2 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -966,7 +966,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path, ret = PTR_ERR(start); goto out; } - BUG_ON(start < p->buf); + if (unlikely(start < p->buf)) { + btrfs_err(root->fs_info, + "send: path ref buffer underflow for key (%llu %u %llu)", + found_key->objectid, + found_key->type, + found_key->offset); + ret = -EINVAL; + goto out; + } } p->start = start; } else { -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] btrfs: send: handle path ref underflow in header iterate_inode_ref()
by Wang Zhaolong 21 May '24

21 May '24

From: David Sterba <dsterba(a)suse.com> mainline inclusion from mainline-v6.9-rc1 commit 3c6ee34c6f9cd12802326da26631232a61743501 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIK CVE: CVE-2024-35935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses. Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/btrfs/send.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c index 606c90457ca3..c62e59a4065f 100644 --- a/fs/btrfs/send.c +++ b/fs/btrfs/send.c @@ -956,7 +956,15 @@ static int iterate_inode_ref(struct btrfs_root *root, struct btrfs_path *path, ret = PTR_ERR(start); goto out; } - BUG_ON(start < p->buf); + if (unlikely(start < p->buf)) { + btrfs_err(root->fs_info, + "send: path ref buffer underflow for key (%llu %u %llu)", + found_key->objectid, + found_key->type, + found_key->offset); + ret = -EINVAL; + goto out; + } } p->start = start; } else { -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
by Luo Gengkun 21 May '24

21 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.8-rc1 commit 0a233867a39078ebb0f575e2948593bbff5826b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9J4 CVE: CVE-2023-52675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c index e8074d7f2401..ac28952cdf87 100644 --- a/arch/powerpc/perf/imc-pmu.c +++ b/arch/powerpc/perf/imc-pmu.c @@ -291,6 +291,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue; @@ -298,6 +300,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str; if (pmu->events[i].scale) { ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); + if (!ev_scale_str) + continue; dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); if (!dev_str) continue; @@ -307,6 +311,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) if (pmu->events[i].unit) { ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); + if (!ev_unit_str) + continue; dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); if (!dev_str) continue; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 13138/22448] kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed'
by kernel test robot 21 May '24

21 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37e0a494c2c8c6f0570068ab47a3e8319dbac30b commit: 7e2ab91ea07673f855f16b54b7c6e6853b2efc1c [13138/22448] livepatch/x86: support livepatch without ftrace config: x86_64-randconfig-073-20240521 (https://download.01.org/0day-ci/archive/20240521/202405211203.buT47nPT-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240521/202405211203.buT47nPT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405211203.buT47nPT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed' [-Wmissing-prototypes] 75 | struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch) | ^ kernel/livepatch/core.c:75:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 75 | struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch) | ^ | static kernel/livepatch/core.c:402:5: warning: no previous prototype for function 'klp_try_disable_patch' [-Wmissing-prototypes] 402 | int klp_try_disable_patch(void *data) | ^ kernel/livepatch/core.c:402:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 402 | int klp_try_disable_patch(void *data) | ^ | static kernel/livepatch/core.c:441:13: warning: no previous prototype for function 'arch_klp_code_modify_prepare' [-Wmissing-prototypes] 441 | void __weak arch_klp_code_modify_prepare(void) | ^ kernel/livepatch/core.c:441:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 441 | void __weak arch_klp_code_modify_prepare(void) | ^ | static kernel/livepatch/core.c:445:13: warning: no previous prototype for function 'arch_klp_code_modify_post_process' [-Wmissing-prototypes] 445 | void __weak arch_klp_code_modify_post_process(void) | ^ kernel/livepatch/core.c:445:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 445 | void __weak arch_klp_code_modify_post_process(void) | ^ | static kernel/livepatch/core.c:617:5: warning: no previous prototype for function 'klp_try_enable_patch' [-Wmissing-prototypes] 617 | int klp_try_enable_patch(void *data) | ^ kernel/livepatch/core.c:617:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 617 | int klp_try_enable_patch(void *data) | ^ | static kernel/livepatch/core.c:1013:12: warning: no previous prototype for function 'arch_klp_func_can_patch' [-Wmissing-prototypes] 1013 | int __weak arch_klp_func_can_patch(struct klp_func *func) | ^ kernel/livepatch/core.c:1013:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1013 | int __weak arch_klp_func_can_patch(struct klp_func *func) | ^ | static 6 warnings generated. vim +/klp_check_patch_kprobed +75 kernel/livepatch/core.c 7e8d223e3ef865 Cheng Jian 2019-01-28 69 c8f9d7a3aae362 Cheng Jian 2019-01-28 70 #ifdef CONFIG_LIVEPATCH_RESTRICT_KPROBE c8f9d7a3aae362 Cheng Jian 2019-01-28 71 /* c8f9d7a3aae362 Cheng Jian 2019-01-28 72 * Check whether a function has been registered with kprobes before patched. c8f9d7a3aae362 Cheng Jian 2019-01-28 73 * We can't patched this function util we unregisted the kprobes. c8f9d7a3aae362 Cheng Jian 2019-01-28 74 */ c8f9d7a3aae362 Cheng Jian 2019-01-28 @75 struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch) c8f9d7a3aae362 Cheng Jian 2019-01-28 76 { c8f9d7a3aae362 Cheng Jian 2019-01-28 77 struct klp_object *obj; c8f9d7a3aae362 Cheng Jian 2019-01-28 78 struct klp_func *func; c8f9d7a3aae362 Cheng Jian 2019-01-28 79 struct kprobe *kp; c8f9d7a3aae362 Cheng Jian 2019-01-28 80 int i; c8f9d7a3aae362 Cheng Jian 2019-01-28 81 c8f9d7a3aae362 Cheng Jian 2019-01-28 82 klp_for_each_object(patch, obj) { c8f9d7a3aae362 Cheng Jian 2019-01-28 83 klp_for_each_func(obj, func) { c8f9d7a3aae362 Cheng Jian 2019-01-28 84 for (i = 0; i < func->old_size; i++) { c8f9d7a3aae362 Cheng Jian 2019-01-28 85 kp = get_kprobe((void *)func->old_addr + i); c8f9d7a3aae362 Cheng Jian 2019-01-28 86 if (kp) { c8f9d7a3aae362 Cheng Jian 2019-01-28 87 pr_err("func %s has been probed, (un)patch failed\n", c8f9d7a3aae362 Cheng Jian 2019-01-28 88 func->old_name); c8f9d7a3aae362 Cheng Jian 2019-01-28 89 return kp; c8f9d7a3aae362 Cheng Jian 2019-01-28 90 } c8f9d7a3aae362 Cheng Jian 2019-01-28 91 } c8f9d7a3aae362 Cheng Jian 2019-01-28 92 } c8f9d7a3aae362 Cheng Jian 2019-01-28 93 } c8f9d7a3aae362 Cheng Jian 2019-01-28 94 c8f9d7a3aae362 Cheng Jian 2019-01-28 95 return NULL; c8f9d7a3aae362 Cheng Jian 2019-01-28 96 } c8f9d7a3aae362 Cheng Jian 2019-01-28 97 #else c8f9d7a3aae362 Cheng Jian 2019-01-28 98 static inline struct kprobe *klp_check_patch_kprobed(struct klp_patch *patch) c8f9d7a3aae362 Cheng Jian 2019-01-28 99 { c8f9d7a3aae362 Cheng Jian 2019-01-28 100 return NULL; c8f9d7a3aae362 Cheng Jian 2019-01-28 101 } c8f9d7a3aae362 Cheng Jian 2019-01-28 102 #endif /* CONFIG_LIVEPATCH_RESTRICT_KPROBE */ c8f9d7a3aae362 Cheng Jian 2019-01-28 103 :::::: The code at line 75 was first introduced by commit :::::: c8f9d7a3aae362482f81ba7c6819d410d66619ab livepatch/core: Restrict livepatch patched/unpatched when plant kprobe :::::: TO: Cheng Jian <cj.chengjian(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20629/22450] drivers/crypto/zhaoxin-gmi-sm4.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 21 May '24

21 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5708160127a606e51a136509cfe0a9448a09849a commit: 358c7df96d1cc7a30096129ccedbeaa21d7eee44 [20629/22450] crypto: Driver for Zhaoxin GMI SM4 Block Cipher Algorithm config: x86_64-buildonly-randconfig-004-20240521 (https://download.01.org/0day-ci/archive/20240521/202405211248.9n4OIoTz-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240521/202405211248.9n4OIoTz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405211248.9n4OIoTz-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/crypto/zhaoxin-gmi-sm4.c:164:5: warning: no previous prototype for function 'gmi_sm4_set_key' [-Wmissing-prototypes] 164 | int gmi_sm4_set_key(struct crypto_skcipher *tfm, const u8 *in_key, | ^ drivers/crypto/zhaoxin-gmi-sm4.c:164:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 164 | int gmi_sm4_set_key(struct crypto_skcipher *tfm, const u8 *in_key, | ^ | static drivers/crypto/zhaoxin-gmi-sm4.c:189:6: warning: variable 'iv' set but not used [-Wunused-but-set-variable] 189 | u8 *iv; | ^ drivers/crypto/zhaoxin-gmi-sm4.c:292:6: warning: variable 'iv' set but not used [-Wunused-but-set-variable] 292 | u8 *iv; | ^ drivers/crypto/zhaoxin-gmi-sm4.c:359:6: warning: variable 'iv' set but not used [-Wunused-but-set-variable] 359 | u8 *iv = NULL; | ^ drivers/crypto/zhaoxin-gmi-sm4.c:468:6: warning: variable 'iv' set but not used [-Wunused-but-set-variable] 468 | u8 *iv = NULL; | ^ drivers/crypto/zhaoxin-gmi-sm4.c:572:6: warning: variable 'iv' set but not used [-Wunused-but-set-variable] 572 | u8 *iv = NULL; | ^ 6 warnings generated. >> drivers/crypto/zhaoxin-gmi-sm4.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] sched/all: Change all BUG_ON() instances in the scheduler to WARN_ON_ONCE()
by Zhao Wenhui 21 May '24

21 May '24

From: Ingo Molnar <mingo(a)kernel.org> mainline inclusion from mainline-v6.1-rc1 commit 09348d75a6ce60eec85c86dd0ab7babc4db3caf6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9QW75 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no good reason to crash a user's system with a BUG_ON(), chances are high that they'll never even see the crash message on Xorg, and it won't make it into the syslog either. By using a WARN_ON_ONCE() we at least give the user a chance to report any bugs triggered here - instead of getting silent hangs. None of these WARN_ON_ONCE()s are supposed to trigger, ever - so we ignore cases where a NULL check is done via a BUG_ON() and we let a NULL pointer through after a WARN_ON_ONCE(). There's one exception: WARN_ON_ONCE() arguments with side-effects, such as locking - in this case we use the return value of the WARN_ON_ONCE(), such as in: - BUG_ON(!lock_task_sighand(p, &flags)); + if (WARN_ON_ONCE(!lock_task_sighand(p, &flags))) + return; Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/YvSsKcAXISmshtHo@gmail.com Conflicts: kernel/sched/deadline.c kernel/sched/fair.c kernel/sched/core.c kernel/sched/sched.h [Some contexts around BUG_ON are different. No functional impact.] Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- kernel/sched/autogroup.c | 3 ++- kernel/sched/core.c | 2 +- kernel/sched/cpupri.c | 2 +- kernel/sched/deadline.c | 29 +++++++++++++++++------------ kernel/sched/fair.c | 10 +++++----- kernel/sched/rt.c | 2 +- kernel/sched/sched.h | 6 +++--- 7 files changed, 30 insertions(+), 24 deletions(-) diff --git a/kernel/sched/autogroup.c b/kernel/sched/autogroup.c index 640d4019deac..067f2e6d8546 100644 --- a/kernel/sched/autogroup.c +++ b/kernel/sched/autogroup.c @@ -139,7 +139,8 @@ autogroup_move_group(struct task_struct *p, struct autogroup *ag) struct task_struct *t; unsigned long flags; - BUG_ON(!lock_task_sighand(p, &flags)); + if (WARN_ON_ONCE(!lock_task_sighand(p, &flags))) + return; prev = p->signal->autogroup; if (prev == ag) { diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 7825ceaae0c4..fe9f91f39e2f 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -948,7 +948,7 @@ static struct rq *move_queued_task(struct rq *rq, struct rq_flags *rf, rq = cpu_rq(new_cpu); rq_lock(rq, rf); - BUG_ON(task_cpu(p) != new_cpu); + WARN_ON_ONCE(task_cpu(p) != new_cpu); enqueue_task(rq, p, 0); p->on_rq = TASK_ON_RQ_QUEUED; check_preempt_curr(rq, p, 0); diff --git a/kernel/sched/cpupri.c b/kernel/sched/cpupri.c index daaadf939ccb..324af8dcadc0 100644 --- a/kernel/sched/cpupri.c +++ b/kernel/sched/cpupri.c @@ -66,7 +66,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p, int idx = 0; int task_pri = convert_prio(p->prio); - BUG_ON(task_pri >= CPUPRI_NR_PRIORITIES); + WARN_ON_ONCE(task_pri >= CPUPRI_NR_PRIORITIES); for (idx = 0; idx < task_pri; idx++) { struct cpupri_vec *vec = &cp->pri_to_cpu[idx]; diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c index 6c4f93af15db..27eba8f120c8 100644 --- a/kernel/sched/deadline.c +++ b/kernel/sched/deadline.c @@ -157,7 +157,7 @@ void dl_change_utilization(struct task_struct *p, u64 new_bw) { struct rq *rq; - BUG_ON(p->dl.flags & SCHED_FLAG_SUGOV); + WARN_ON_ONCE(p->dl.flags & SCHED_FLAG_SUGOV); if (task_on_rq_queued(p)) return; @@ -450,7 +450,7 @@ static void enqueue_pushable_dl_task(struct rq *rq, struct task_struct *p) struct task_struct *entry; bool leftmost = true; - BUG_ON(!RB_EMPTY_NODE(&p->pushable_dl_tasks)); + WARN_ON_ONCE(!RB_EMPTY_NODE(&p->pushable_dl_tasks)); while (*link) { parent = *link; @@ -545,7 +545,7 @@ static struct rq *dl_task_offline_migration(struct rq *rq, struct task_struct *p * Failed to find any suitable CPU. * The task will never come back! */ - BUG_ON(dl_bandwidth_enabled()); + WARN_ON_ONCE(dl_bandwidth_enabled()); /* * If admission control is disabled we @@ -701,7 +701,7 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq = dl_rq_of_se(dl_se); struct rq *rq = rq_of_dl_rq(dl_rq); - BUG_ON(pi_se->dl_runtime <= 0); + WARN_ON_ONCE(pi_se->dl_runtime <= 0); /* * This could be the case for a !-dl task that is boosted. @@ -1407,7 +1407,7 @@ static void __enqueue_dl_entity(struct sched_dl_entity *dl_se) struct sched_dl_entity *entry; int leftmost = 1; - BUG_ON(!RB_EMPTY_NODE(&dl_se->rb_node)); + WARN_ON_ONCE(!RB_EMPTY_NODE(&dl_se->rb_node)); while (*link) { parent = *link; @@ -1443,7 +1443,7 @@ static void enqueue_dl_entity(struct sched_dl_entity *dl_se, struct sched_dl_entity *pi_se, int flags) { - BUG_ON(on_dl_rq(dl_se)); + WARN_ON_ONCE(on_dl_rq(dl_se)); /* * If this is a wakeup or a new instance, the scheduling @@ -1777,11 +1777,16 @@ pick_next_task_dl(struct rq *rq, struct task_struct *prev, struct rq_flags *rf) if (unlikely(!dl_rq->dl_nr_running)) return NULL; +<<<<<<< HEAD put_prev_task(rq, prev); dl_se = pick_next_dl_entity(rq, dl_rq); BUG_ON(!dl_se); +======= + dl_se = pick_next_dl_entity(dl_rq); + WARN_ON_ONCE(!dl_se); +>>>>>>> 5677c9387367 ([Backport] sched/all: Change all BUG_ON() instances in the scheduler to WARN_ON_ONCE()) p = dl_task_of(dl_se); p->se.exec_start = rq_clock_task(rq); @@ -1987,12 +1992,12 @@ static struct task_struct *pick_next_pushable_dl_task(struct rq *rq) p = rb_entry(rq->dl.pushable_dl_tasks_root.rb_leftmost, struct task_struct, pushable_dl_tasks); - BUG_ON(rq->cpu != task_cpu(p)); - BUG_ON(task_current(rq, p)); - BUG_ON(p->nr_cpus_allowed <= 1); + WARN_ON_ONCE(rq->cpu != task_cpu(p)); + WARN_ON_ONCE(task_current(rq, p)); + WARN_ON_ONCE(p->nr_cpus_allowed <= 1); - BUG_ON(!task_on_rq_queued(p)); - BUG_ON(!dl_task(p)); + WARN_ON_ONCE(!task_on_rq_queued(p)); + WARN_ON_ONCE(!dl_task(p)); return p; } @@ -2266,7 +2271,7 @@ static void set_cpus_allowed_dl(struct task_struct *p, struct root_domain *src_rd; struct rq *rq; - BUG_ON(!dl_task(p)); + WARN_ON_ONCE(!dl_task(p)); rq = task_rq(p); src_rd = rq->rd; diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 6d0ec315f7be..3bd5aa6dedb3 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -2411,7 +2411,7 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags, if (!join) return; - BUG_ON(irqs_disabled()); + WARN_ON_ONCE(irqs_disabled()); double_lock_irq(&my_grp->lock, &grp->lock); for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++) { @@ -7595,7 +7595,7 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ find_matching_se(&se, &pse); update_curr(cfs_rq_of(se)); - BUG_ON(!pse); + WARN_ON_ONCE(!pse); if (wakeup_preempt_entity(se, pse) == 1) { /* * Bias pick_next to pick the sched entity that is @@ -8608,7 +8608,7 @@ static void attach_task(struct rq *rq, struct task_struct *p) { lockdep_assert_held(&rq->lock); - BUG_ON(task_rq(p) != rq); + WARN_ON_ONCE(task_rq(p) != rq); activate_task(rq, p, ENQUEUE_NOCLOCK); p->on_rq = TASK_ON_RQ_QUEUED; check_preempt_curr(rq, p, 0); @@ -9916,7 +9916,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, goto out_balanced; } - BUG_ON(busiest == env.dst_rq); + WARN_ON_ONCE(busiest == env.dst_rq); schedstat_add(sd->lb_imbalance[idle], env.imbalance); @@ -10212,7 +10212,7 @@ static int active_load_balance_cpu_stop(void *data) * we need to fix it. Originally reported by * Bjorn Helgaas on a 128-CPU setup. */ - BUG_ON(busiest_rq == target_rq); + WARN_ON_ONCE(busiest_rq == target_rq); /* Search for an sd spanning us and the target CPU. */ rcu_read_lock(); diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index ad893ec818cd..58364f489529 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -758,7 +758,7 @@ static void __disable_runtime(struct rq *rq) * We cannot be left wanting - that would mean some runtime * leaked out of the system. */ - BUG_ON(want); + WARN_ON_ONCE(want); balanced: /* * Disable all the borrow logic by pretending we have inf diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 1d882a2b8d5f..4dd0e4de0aab 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2146,8 +2146,8 @@ static inline void double_rq_lock(struct rq *rq1, struct rq *rq2) __acquires(rq1->lock) __acquires(rq2->lock) { - BUG_ON(!irqs_disabled()); - BUG_ON(rq1 != rq2); + WARN_ON_ONCE(!irqs_disabled()); + WARN_ON_ONCE(rq1 != rq2); raw_spin_lock(&rq1->lock); __acquire(rq2->lock); /* Fake it out ;) */ } @@ -2162,7 +2162,7 @@ static inline void double_rq_unlock(struct rq *rq1, struct rq *rq2) __releases(rq1->lock) __releases(rq2->lock) { - BUG_ON(rq1 != rq2); + WARN_ON_ONCE(rq1 != rq2); raw_spin_unlock(&rq1->lock); __release(rq2->lock); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-35936
by Yifan Qiao 21 May '24

21 May '24

David Sterba (1): btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() Dominique Martinet (1): btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() fs/btrfs/volumes.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH OLK-5.10 v3] KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
by Ye Bin 21 May '24

21 May '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.8 commit 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8ZA CVE: CVE-2024-35791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory. Fixes: 19a23da53932 ("Fix unsynchronized access to sev members through svm_register_enc_region") Reported-by: Gabe Kirkpatrick <gkirkpatrick(a)google.com> Cc: Josh Eads <josheads(a)google.com> Cc: Peter Gonda <pgonda(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20240217013430.2079561-1-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c2b34998c27d..52e14d6aa496 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1024,20 +1024,22 @@ int svm_register_enc_region(struct kvm *kvm, goto e_free; } - region->uaddr = range->addr; - region->size = range->size; - - list_add_tail(&region->list, &sev->regions_list); - mutex_unlock(&kvm->lock); - /* * The guest may change the memory encryption attribute from C=0 -> C=1 * or vice versa for this memory range. Lets make sure caches are * flushed to ensure that guest data gets written into memory with - * correct C-bit. + * correct C-bit. Note, this must be done before dropping kvm->lock, + * as region and its array of pages can be freed by a different task + * once kvm->lock is released. */ sev_clflush_pages(region->pages, region->npages); + region->uaddr = range->addr; + region->size = range->size; + + list_add_tail(&region->list, &sev->regions_list); + mutex_unlock(&kvm->lock); + return ret; e_free: -- 2.31.1

2 1

[PATCH OLK-5.10] KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
by Ye Bin 21 May '24

21 May '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.8 commit 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807 category: bugfix CVE: CVE-2024-35791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory. Fixes: 19a23da53932 ("Fix unsynchronized access to sev members through svm_register_enc_region") Reported-by: Gabe Kirkpatrick <gkirkpatrick(a)google.com> Cc: Josh Eads <josheads(a)google.com> Cc: Peter Gonda <pgonda(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20240217013430.2079561-1-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c2b34998c27d..52e14d6aa496 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1024,20 +1024,22 @@ int svm_register_enc_region(struct kvm *kvm, goto e_free; } - region->uaddr = range->addr; - region->size = range->size; - - list_add_tail(&region->list, &sev->regions_list); - mutex_unlock(&kvm->lock); - /* * The guest may change the memory encryption attribute from C=0 -> C=1 * or vice versa for this memory range. Lets make sure caches are * flushed to ensure that guest data gets written into memory with - * correct C-bit. + * correct C-bit. Note, this must be done before dropping kvm->lock, + * as region and its array of pages can be freed by a different task + * once kvm->lock is released. */ sev_clflush_pages(region->pages, region->npages); + region->uaddr = range->addr; + region->size = range->size; + + list_add_tail(&region->list, &sev->regions_list); + mutex_unlock(&kvm->lock); + return ret; e_free: -- 2.31.1

2 1

[PATCH OLK-5.10] btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
by Yifan Qiao 21 May '24

21 May '24

From: David Sterba <dsterba(a)suse.com> stable inclusion from stable-v5.4.274 commit 576164bd01bd795f8b09fb194b493103506b33c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIP CVE: CVE-2024-35936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7411055db5ce64f836aaffd422396af0075fdc99 ] The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/volumes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index eaf5cd043dac..634b73d734bc 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -3178,7 +3178,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info) mutex_unlock(&fs_info->delete_unused_bgs_mutex); goto error; } - BUG_ON(ret == 0); /* Corruption */ + if (ret == 0) { + /* + * On the first search we would find chunk tree with + * offset -1, which is not possible. On subsequent + * loops this would find an existing item on an invalid + * offset (one less than the previous one, wrong + * alignment and size). + */ + ret = -EUCLEAN; + goto error; + } ret = btrfs_previous_item(chunk_root, path, key.objectid, key.type); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()
by Yifan Qiao 21 May '24

21 May '24

From: David Sterba <dsterba(a)suse.com> stable inclusion from stable-v5.4.274 commit 576164bd01bd795f8b09fb194b493103506b33c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIP CVE: CVE-2024-35936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7411055db5ce64f836aaffd422396af0075fdc99 ] The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/volumes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 054468e43228..172cec8a12dd 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -2922,7 +2922,17 @@ static int btrfs_relocate_sys_chunks(struct btrfs_fs_info *fs_info) mutex_unlock(&fs_info->delete_unused_bgs_mutex); goto error; } - BUG_ON(ret == 0); /* Corruption */ + if (ret == 0) { + /* + * On the first search we would find chunk tree with + * offset -1, which is not possible. On subsequent + * loops this would find an existing item on an invalid + * offset (one less than the previous one, wrong + * alignment and size). + */ + ret = -EUCLEAN; + goto error; + } ret = btrfs_previous_item(chunk_root, path, key.objectid, key.type); -- 2.39.2

2 1

[PATCH OLK-5.10] KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
by Ye Bin 21 May '24

21 May '24

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.8 commit 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8ZA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory. Fixes: 19a23da53932 ("Fix unsynchronized access to sev members through svm_register_enc_region") Reported-by: Gabe Kirkpatrick <gkirkpatrick(a)google.com> Cc: Josh Eads <josheads(a)google.com> Cc: Peter Gonda <pgonda(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20240217013430.2079561-1-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c2b34998c27d..52e14d6aa496 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -1024,20 +1024,22 @@ int svm_register_enc_region(struct kvm *kvm, goto e_free; } - region->uaddr = range->addr; - region->size = range->size; - - list_add_tail(&region->list, &sev->regions_list); - mutex_unlock(&kvm->lock); - /* * The guest may change the memory encryption attribute from C=0 -> C=1 * or vice versa for this memory range. Lets make sure caches are * flushed to ensure that guest data gets written into memory with - * correct C-bit. + * correct C-bit. Note, this must be done before dropping kvm->lock, + * as region and its array of pages can be freed by a different task + * once kvm->lock is released. */ sev_clflush_pages(region->pages, region->npages); + region->uaddr = range->addr; + region->size = range->size; + + list_add_tail(&region->list, &sev->regions_list); + mutex_unlock(&kvm->lock); + return ret; e_free: -- 2.31.1

2 1

[PATCH OLK-5.10 0/1] Fix allmodconfig build error
by Shuai Wu 21 May '24

21 May '24

Fix allmodconfig build error in hiroce3 driver. Shuai Wu (1): net/ethernet/huawei/hiroce3: Fix allmodconfig build error .../hw/hiroce3/bond/roce_bond_common.c | 38 +- .../hw/hiroce3/cq/roce_cq_destroy.c | 15 +- .../hw/hiroce3/host/hmm/hmm_comp_mtt.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_mw_mr.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_res.c | 1 + .../infiniband/hw/hiroce3/host/hmm/hmm_mr.c | 98 +---- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.c | 4 +- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.h | 2 +- .../include/rdma/rdma_context_format.h | 4 +- .../include/rdma/rdma_ext_ctx_format.h | 5 +- .../hw/hiroce3/include/rdma/roce_ccf_format.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_attr.h | 4 +- .../include/rdma/roce_verbs_attr_qpc_chip.h | 4 +- .../hiroce3/include/rdma/roce_verbs_cq_attr.h | 4 +- .../include/rdma/roce_verbs_ext_attr.h | 4 +- .../include/rdma/roce_verbs_gid_attr.h | 4 +- .../hiroce3/include/rdma/roce_verbs_mr_attr.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_pub.h | 4 +- .../include/rdma/roce_verbs_srq_attr.h | 4 +- drivers/infiniband/hw/hiroce3/mr/roce_mr.c | 37 -- drivers/infiniband/hw/hiroce3/roce.h | 1 - drivers/infiniband/hw/hiroce3/roce_main.c | 7 +- .../ethernet/huawei/hinic3/bond/hinic3_bond.c | 1 - .../ethernet/huawei/hinic3/bond/hinic3_bond.h | 4 +- .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.c | 198 +++------ .../huawei/hinic3/cqm/cqm_bitmap_table.c | 10 +- .../huawei/hinic3/cqm/cqm_bloomfilter.c | 69 +--- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.c | 139 ++----- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.h | 2 - .../net/ethernet/huawei/hinic3/cqm/cqm_db.c | 192 +++------ .../ethernet/huawei/hinic3/cqm/cqm_define.h | 4 - .../net/ethernet/huawei/hinic3/cqm/cqm_main.c | 178 +++------ .../ethernet/huawei/hinic3/cqm/cqm_object.c | 378 +++++------------- .../huawei/hinic3/cqm/cqm_object_intern.c | 194 +++------ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 2 +- .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 38 -- .../huawei/hinic3/hw/hinic3_multi_host_mgmt.c | 56 ++- .../hinic3/include/bond/bond_common_defs.h | 4 +- .../huawei/hinic3/include/hinic3_common.h | 2 - .../huawei/hinic3/include/hinic3_cqm.h | 11 - .../huawei/hinic3/include/hinic3_cqm_define.h | 4 - .../include/mpu/mpu_outband_ncsi_cmd_defs.h | 4 +- 42 files changed, 474 insertions(+), 1266 deletions(-) -- 2.33.0

2 2

[PATCH OLK-5.10] ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
by felix 21 May '24

21 May '24

From: "Geoffrey D. Bennett" <g(a)b4.vu> stable inclusion from stable-v5.15.148 commit e517645ead5ea22c69d2a44694baa23fe1ce7c2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9ID CVE: CVE-2023-52674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04f8f053252b86c7583895c962d66747ecdc61b7 ] Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside scarlett2_mixer_values[]. Signed-off-by: Geoffrey D. Bennett <g(a)b4.vu> Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") Link: https://lore.kernel.org/r/3b19fb3da641b587749b85fe1daa1b4e696c0c1b.17030010… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: sound/usb/mixer_scarlett_gen2.c [Some context inconsistencies exist in the scarlett2_mixer_ctl_put function, which does not affect the patch] Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- sound/usb/mixer_scarlett_gen2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c index 1b7c7b754c38..6b7c8b8d7111 100644 --- a/sound/usb/mixer_scarlett_gen2.c +++ b/sound/usb/mixer_scarlett_gen2.c @@ -1509,7 +1509,8 @@ static int scarlett2_mixer_ctl_put(struct snd_kcontrol *kctl, mutex_lock(&private->data_mutex); oval = private->mix[elem->control]; - val = ucontrol->value.integer.value[0]; + val = clamp(ucontrol->value.integer.value[0], + 0L, (long)SCARLETT2_MIXER_MAX_VALUE); num_mixer_in = ports[SCARLETT2_PORT_TYPE_MIX].num[SCARLETT2_PORT_OUT]; mix_num = elem->control / num_mixer_in; -- 2.34.1

2 1

[PATCH OLK-5.10] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Guo Mengqi 21 May '24

21 May '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.210 commit c6a8111aacbfe7a8a70f46cc0de8eed00561693c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JR3 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 5749998feaa4..6e2c1ba18012 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -24,10 +24,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -59,7 +62,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -206,6 +209,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -233,34 +237,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -271,6 +278,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Guo Mengqi 21 May '24

21 May '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.210 commit c6a8111aacbfe7a8a70f46cc0de8eed00561693c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JR3 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 5749998feaa4..6e2c1ba18012 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -24,10 +24,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -59,7 +62,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -206,6 +209,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -233,34 +237,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -271,6 +278,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Guo Mengqi 21 May '24

21 May '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.210 commit c6a8111aacbfe7a8a70f46cc0de8eed00561693c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JR3 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 5749998feaa4..6e2c1ba18012 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -24,10 +24,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -59,7 +62,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -206,6 +209,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -233,34 +237,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -271,6 +278,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] hwrng: core - Fix page fault dead lock on mmap-ed hwrng
by Guo Mengqi 21 May '24

21 May '24

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.210 commit c6a8111aacbfe7a8a70f46cc0de8eed00561693c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JR3 CVE: CVE-2023-52615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78aafb3884f6bc6636efcc1760c891c8500b9922 upstream. There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. Reported-by: Edward Adam Davis <eadavis(a)qq.com> Reported-by: syzbot+c52ab18308964d248092(a)syzkaller.appspotmail.com Fixes: 9996508b3353 ("hwrng: core - Replace u32 in driver API with byte array") Cc: <stable(a)vger.kernel.org> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/hw_random/core.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 5749998feaa4..6e2c1ba18012 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -24,10 +24,13 @@ #include <linux/random.h> #include <linux/sched.h> #include <linux/slab.h> +#include <linux/string.h> #include <linux/uaccess.h> #define RNG_MODULE_NAME "hw_random" +#define RNG_BUFFER_SIZE (SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES) + static struct hwrng *current_rng; /* the current rng has been explicitly chosen by user via sysfs */ static int cur_rng_set_by_user; @@ -59,7 +62,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static size_t rng_buffer_size(void) { - return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES; + return RNG_BUFFER_SIZE; } static void add_early_randomness(struct hwrng *rng) @@ -206,6 +209,7 @@ static inline int rng_get_data(struct hwrng *rng, u8 *buffer, size_t size, static ssize_t rng_dev_read(struct file *filp, char __user *buf, size_t size, loff_t *offp) { + u8 buffer[RNG_BUFFER_SIZE]; ssize_t ret = 0; int err = 0; int bytes_read, len; @@ -233,34 +237,37 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, if (bytes_read < 0) { err = bytes_read; goto out_unlock_reading; + } else if (bytes_read == 0 && + (filp->f_flags & O_NONBLOCK)) { + err = -EAGAIN; + goto out_unlock_reading; } + data_avail = bytes_read; } - if (!data_avail) { - if (filp->f_flags & O_NONBLOCK) { - err = -EAGAIN; - goto out_unlock_reading; - } - } else { - len = data_avail; + len = data_avail; + if (len) { if (len > size) len = size; data_avail -= len; - if (copy_to_user(buf + ret, rng_buffer + data_avail, - len)) { + memcpy(buffer, rng_buffer + data_avail, len); + } + mutex_unlock(&reading_mutex); + put_rng(rng); + + if (len) { + if (copy_to_user(buf + ret, buffer, len)) { err = -EFAULT; - goto out_unlock_reading; + goto out; } size -= len; ret += len; } - mutex_unlock(&reading_mutex); - put_rng(rng); if (need_resched()) schedule_timeout_interruptible(1); @@ -271,6 +278,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, } } out: + memzero_explicit(buffer, sizeof(buffer)); return ret ? : err; out_unlock_reading: -- 2.17.1

2 1

[PATCH OLK-5.10] can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
by Guo Mengqi 21 May '24

21 May '24

From: Ziqi Zhao <astrajoan(a)yahoo.com> mainline inclusion from mainline-v6.8-rc5 commit 6cdedc18ba7b9dacc36466e27e3267d201948c8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GX CVE: CVE-2023-52638 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939_socks_lock - active_session_list_lock - sk_session_queue_lock A reasonable fix is to change j1939_socks_lock to an rwlock, since in the rare situations where a write lock is required for the linked list that j1939_socks_lock is protecting, the code does not attempt to acquire any more locks. This would break the circular lock dependency, where, for example, the current thread already locks j1939_socks_lock and attempts to acquire sk_session_queue_lock, and at the same time, another thread attempts to acquire j1939_socks_lock while holding sk_session_queue_lock. NOTE: This patch along does not fix the unregister_netdevice bug reported by Syzbot; instead, it solves a deadlock situation to prepare for one or more further patches to actually fix the Syzbot bug, which appears to be a reference counting problem within the j1939 codebase. Reported-by: <syzbot+1591462f226d9cbf0564(a)syzkaller.appspotmail.com> Signed-off-by: Ziqi Zhao <astrajoan(a)yahoo.com> Reviewed-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://lore.kernel.org/all/20230721162226.8639-1-astrajoan@yahoo.com [mkl: remove unrelated newline change] Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Conflicts: net/can/j1939/socket.c --- net/can/j1939/j1939-priv.h | 2 +- net/can/j1939/main.c | 2 +- net/can/j1939/socket.c | 20 ++++++++++---------- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h index 9ac2a10b1826..b7be21287f34 100644 --- a/net/can/j1939/j1939-priv.h +++ b/net/can/j1939/j1939-priv.h @@ -83,7 +83,7 @@ struct j1939_priv { unsigned int tp_max_packet_size; /* lock for j1939_socks list */ - spinlock_t j1939_socks_lock; + rwlock_t j1939_socks_lock; struct list_head j1939_socks; struct kref rx_kref; diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c index 9169ef174ff0..457d4e01fc7c 100644 --- a/net/can/j1939/main.c +++ b/net/can/j1939/main.c @@ -270,7 +270,7 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) return ERR_PTR(-ENOMEM); j1939_tp_init(priv); - spin_lock_init(&priv->j1939_socks_lock); + rwlock_init(&priv->j1939_socks_lock); INIT_LIST_HEAD(&priv->j1939_socks); mutex_lock(&j1939_netdev_lock); diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index c216c60f572b..a56b9139a0b9 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -80,16 +80,16 @@ static void j1939_jsk_add(struct j1939_priv *priv, struct j1939_sock *jsk) jsk->state |= J1939_SOCK_BOUND; j1939_priv_get(priv); - spin_lock_bh(&priv->j1939_socks_lock); + write_lock_bh(&priv->j1939_socks_lock); list_add_tail(&jsk->list, &priv->j1939_socks); - spin_unlock_bh(&priv->j1939_socks_lock); + write_unlock_bh(&priv->j1939_socks_lock); } static void j1939_jsk_del(struct j1939_priv *priv, struct j1939_sock *jsk) { - spin_lock_bh(&priv->j1939_socks_lock); + write_lock_bh(&priv->j1939_socks_lock); list_del_init(&jsk->list); - spin_unlock_bh(&priv->j1939_socks_lock); + write_unlock_bh(&priv->j1939_socks_lock); j1939_priv_put(priv); jsk->state &= ~J1939_SOCK_BOUND; @@ -340,13 +340,13 @@ bool j1939_sk_recv_match(struct j1939_priv *priv, struct j1939_sk_buff_cb *skcb) struct j1939_sock *jsk; bool match = false; - spin_lock_bh(&priv->j1939_socks_lock); + read_lock_bh(&priv->j1939_socks_lock); list_for_each_entry(jsk, &priv->j1939_socks, list) { match = j1939_sk_recv_match_one(jsk, skcb); if (match) break; } - spin_unlock_bh(&priv->j1939_socks_lock); + read_unlock_bh(&priv->j1939_socks_lock); return match; } @@ -355,11 +355,11 @@ void j1939_sk_recv(struct j1939_priv *priv, struct sk_buff *skb) { struct j1939_sock *jsk; - spin_lock_bh(&priv->j1939_socks_lock); + read_lock_bh(&priv->j1939_socks_lock); list_for_each_entry(jsk, &priv->j1939_socks, list) { j1939_sk_recv_one(jsk, skb); } - spin_unlock_bh(&priv->j1939_socks_lock); + read_unlock_bh(&priv->j1939_socks_lock); } static void j1939_sk_sock_destruct(struct sock *sk) @@ -1210,7 +1210,7 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv) struct j1939_sock *jsk; int error_code = ENETDOWN; - spin_lock_bh(&priv->j1939_socks_lock); + read_lock_bh(&priv->j1939_socks_lock); list_for_each_entry(jsk, &priv->j1939_socks, list) { jsk->sk.sk_err = error_code; if (!sock_flag(&jsk->sk, SOCK_DEAD)) @@ -1218,7 +1218,7 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv) j1939_sk_queue_drop_all(priv, jsk, error_code); } - spin_unlock_bh(&priv->j1939_socks_lock); + read_unlock_bh(&priv->j1939_socks_lock); } static int j1939_sk_no_ioctlcmd(struct socket *sock, unsigned int cmd, -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
by Guo Mengqi 21 May '24

21 May '24

From: Ziqi Zhao <astrajoan(a)yahoo.com> mainline inclusion from mainline-v6.8-rc5 commit 6cdedc18ba7b9dacc36466e27e3267d201948c8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GX CVE: CVE-2023-52638 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939_socks_lock - active_session_list_lock - sk_session_queue_lock A reasonable fix is to change j1939_socks_lock to an rwlock, since in the rare situations where a write lock is required for the linked list that j1939_socks_lock is protecting, the code does not attempt to acquire any more locks. This would break the circular lock dependency, where, for example, the current thread already locks j1939_socks_lock and attempts to acquire sk_session_queue_lock, and at the same time, another thread attempts to acquire j1939_socks_lock while holding sk_session_queue_lock. NOTE: This patch along does not fix the unregister_netdevice bug reported by Syzbot; instead, it solves a deadlock situation to prepare for one or more further patches to actually fix the Syzbot bug, which appears to be a reference counting problem within the j1939 codebase. Reported-by: <syzbot+1591462f226d9cbf0564(a)syzkaller.appspotmail.com> Signed-off-by: Ziqi Zhao <astrajoan(a)yahoo.com> Reviewed-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://lore.kernel.org/all/20230721162226.8639-1-astrajoan@yahoo.com [mkl: remove unrelated newline change] Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Conflicts: net/can/j1939/socket.c --- net/can/j1939/j1939-priv.h | 2 +- net/can/j1939/main.c | 2 +- net/can/j1939/socket.c | 20 ++++++++++---------- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h index cea712fb2a9e..07a1dd479d89 100644 --- a/net/can/j1939/j1939-priv.h +++ b/net/can/j1939/j1939-priv.h @@ -83,7 +83,7 @@ struct j1939_priv { unsigned int tp_max_packet_size; /* lock for j1939_socks list */ - spinlock_t j1939_socks_lock; + rwlock_t j1939_socks_lock; struct list_head j1939_socks; struct kref rx_kref; diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c index 9169ef174ff0..457d4e01fc7c 100644 --- a/net/can/j1939/main.c +++ b/net/can/j1939/main.c @@ -270,7 +270,7 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) return ERR_PTR(-ENOMEM); j1939_tp_init(priv); - spin_lock_init(&priv->j1939_socks_lock); + rwlock_init(&priv->j1939_socks_lock); INIT_LIST_HEAD(&priv->j1939_socks); mutex_lock(&j1939_netdev_lock); diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index 906a08d38c1c..00b2b31b5a68 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -80,16 +80,16 @@ static void j1939_jsk_add(struct j1939_priv *priv, struct j1939_sock *jsk) jsk->state |= J1939_SOCK_BOUND; j1939_priv_get(priv); - spin_lock_bh(&priv->j1939_socks_lock); + write_lock_bh(&priv->j1939_socks_lock); list_add_tail(&jsk->list, &priv->j1939_socks); - spin_unlock_bh(&priv->j1939_socks_lock); + write_unlock_bh(&priv->j1939_socks_lock); } static void j1939_jsk_del(struct j1939_priv *priv, struct j1939_sock *jsk) { - spin_lock_bh(&priv->j1939_socks_lock); + write_lock_bh(&priv->j1939_socks_lock); list_del_init(&jsk->list); - spin_unlock_bh(&priv->j1939_socks_lock); + write_unlock_bh(&priv->j1939_socks_lock); j1939_priv_put(priv); jsk->state &= ~J1939_SOCK_BOUND; @@ -329,13 +329,13 @@ bool j1939_sk_recv_match(struct j1939_priv *priv, struct j1939_sk_buff_cb *skcb) struct j1939_sock *jsk; bool match = false; - spin_lock_bh(&priv->j1939_socks_lock); + read_lock_bh(&priv->j1939_socks_lock); list_for_each_entry(jsk, &priv->j1939_socks, list) { match = j1939_sk_recv_match_one(jsk, skcb); if (match) break; } - spin_unlock_bh(&priv->j1939_socks_lock); + read_unlock_bh(&priv->j1939_socks_lock); return match; } @@ -344,11 +344,11 @@ void j1939_sk_recv(struct j1939_priv *priv, struct sk_buff *skb) { struct j1939_sock *jsk; - spin_lock_bh(&priv->j1939_socks_lock); + read_lock_bh(&priv->j1939_socks_lock); list_for_each_entry(jsk, &priv->j1939_socks, list) { j1939_sk_recv_one(jsk, skb); } - spin_unlock_bh(&priv->j1939_socks_lock); + read_unlock_bh(&priv->j1939_socks_lock); } static void j1939_sk_sock_destruct(struct sock *sk) @@ -1196,7 +1196,7 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv) struct j1939_sock *jsk; int error_code = ENETDOWN; - spin_lock_bh(&priv->j1939_socks_lock); + read_lock_bh(&priv->j1939_socks_lock); list_for_each_entry(jsk, &priv->j1939_socks, list) { jsk->sk.sk_err = error_code; if (!sock_flag(&jsk->sk, SOCK_DEAD)) @@ -1204,7 +1204,7 @@ void j1939_sk_netdev_event_netdown(struct j1939_priv *priv) j1939_sk_queue_drop_all(priv, jsk, error_code); } - spin_unlock_bh(&priv->j1939_socks_lock); + read_unlock_bh(&priv->j1939_socks_lock); } static int j1939_sk_no_ioctlcmd(struct socket *sock, unsigned int cmd, -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] dm-crypt: don't modify the data when using authenticated encryption
by Guo Mengqi 21 May '24

21 May '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream. It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time. [1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 5d772f322a24..5edcdcee91c2 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2064,6 +2064,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; + if (crypt_integrity_aead(cc)) { + bio_copy_data(clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector += bio_sectors(clone); crypt_inc_pending(io); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] dm-crypt: don't modify the data when using authenticated encryption
by Guo Mengqi 21 May '24

21 May '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream. It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time. [1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 17ddca293965..ca50ee8a53f2 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2062,6 +2062,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; + if (crypt_integrity_aead(cc)) { + bio_copy_data(clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector += bio_sectors(clone); crypt_inc_pending(io); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] dm-crypt: don't modify the data when using authenticated encryption
by Guo Mengqi 21 May '24

21 May '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream. It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time. [1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 17ddca293965..ca50ee8a53f2 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2062,6 +2062,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; + if (crypt_integrity_aead(cc)) { + bio_copy_data(clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector += bio_sectors(clone); crypt_inc_pending(io); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
by Guo Mengqi 21 May '24

21 May '24

From: Devyn Liu <liudingyuan(a)huawei.com> stable inclusion from stable-v5.10.211 commit e94da8aca2e78ef9ecca02eb211869eacd5504e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2NX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de8b6e1c231a95abf95ad097b993d34b31458ec9 ] Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null pointer error: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: complete+0x54/0x100 hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] __handle_irq_event_percpu+0x64/0x1e0 handle_irq_event+0x7c/0x1cc Signed-off-by: Devyn Liu <liudingyuan(a)huawei.com> Link: https://msgid.link/r/20240123071149.917678-1-liudingyuan@huawei.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/spi/spi-hisi-sfc-v3xx.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/spi/spi-hisi-sfc-v3xx.c b/drivers/spi/spi-hisi-sfc-v3xx.c index d3a23b1c2a4c..61bf00dfe9c3 100644 --- a/drivers/spi/spi-hisi-sfc-v3xx.c +++ b/drivers/spi/spi-hisi-sfc-v3xx.c @@ -377,6 +377,11 @@ static const struct spi_controller_mem_ops hisi_sfc_v3xx_mem_ops = { static irqreturn_t hisi_sfc_v3xx_isr(int irq, void *data) { struct hisi_sfc_v3xx_host *host = data; + u32 reg; + + reg = readl(host->regbase + HISI_SFC_V3XX_INT_STAT); + if (!reg) + return IRQ_NONE; hisi_sfc_v3xx_disable_int(host); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
by Guo Mengqi 21 May '24

21 May '24

From: Devyn Liu <liudingyuan(a)huawei.com> stable inclusion from stable-v5.10.211 commit e94da8aca2e78ef9ecca02eb211869eacd5504e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2NX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de8b6e1c231a95abf95ad097b993d34b31458ec9 ] Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null pointer error: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: complete+0x54/0x100 hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] __handle_irq_event_percpu+0x64/0x1e0 handle_irq_event+0x7c/0x1cc Signed-off-by: Devyn Liu <liudingyuan(a)huawei.com> Link: https://msgid.link/r/20240123071149.917678-1-liudingyuan@huawei.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/spi/spi-hisi-sfc-v3xx.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/spi/spi-hisi-sfc-v3xx.c b/drivers/spi/spi-hisi-sfc-v3xx.c index d3a23b1c2a4c..61bf00dfe9c3 100644 --- a/drivers/spi/spi-hisi-sfc-v3xx.c +++ b/drivers/spi/spi-hisi-sfc-v3xx.c @@ -377,6 +377,11 @@ static const struct spi_controller_mem_ops hisi_sfc_v3xx_mem_ops = { static irqreturn_t hisi_sfc_v3xx_isr(int irq, void *data) { struct hisi_sfc_v3xx_host *host = data; + u32 reg; + + reg = readl(host->regbase + HISI_SFC_V3XX_INT_STAT); + if (!reg) + return IRQ_NONE; hisi_sfc_v3xx_disable_int(host); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
by Guo Mengqi 21 May '24

21 May '24

From: Devyn Liu <liudingyuan(a)huawei.com> stable inclusion from stable-v5.10.211 commit e94da8aca2e78ef9ecca02eb211869eacd5504e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2NX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de8b6e1c231a95abf95ad097b993d34b31458ec9 ] Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null pointer error: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: complete+0x54/0x100 hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] __handle_irq_event_percpu+0x64/0x1e0 handle_irq_event+0x7c/0x1cc Signed-off-by: Devyn Liu <liudingyuan(a)huawei.com> Link: https://msgid.link/r/20240123071149.917678-1-liudingyuan@huawei.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/spi/spi-hisi-sfc-v3xx.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/spi/spi-hisi-sfc-v3xx.c b/drivers/spi/spi-hisi-sfc-v3xx.c index d3a23b1c2a4c..61bf00dfe9c3 100644 --- a/drivers/spi/spi-hisi-sfc-v3xx.c +++ b/drivers/spi/spi-hisi-sfc-v3xx.c @@ -377,6 +377,11 @@ static const struct spi_controller_mem_ops hisi_sfc_v3xx_mem_ops = { static irqreturn_t hisi_sfc_v3xx_isr(int irq, void *data) { struct hisi_sfc_v3xx_host *host = data; + u32 reg; + + reg = readl(host->regbase + HISI_SFC_V3XX_INT_STAT); + if (!reg) + return IRQ_NONE; hisi_sfc_v3xx_disable_int(host); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] net: ip_tunnel: prevent perpetual headroom growth
by Guo Mengqi 21 May '24

21 May '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.212 commit 2e95350fe9db9d53c701075060ac8ac883b68aee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E47C Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f ] syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report.c:588 __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline] ___skb_get_hash net/core/flow_dissector.c:1791 [inline] __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856 skb_get_hash include/linux/skbuff.h:1556 [inline] ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748 ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592 ... ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 .. iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831 ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 ... The splat occurs because skb->data points past skb->head allocated area. This is because neigh layer does: __skb_pull(skb, skb_network_offset(skb)); ... but skb_network_offset() returns a negative offset and __skb_pull() arg is unsigned. IOW, we skb->data gets "adjusted" by a huge value. The negative value is returned because skb->head and skb->data distance is more than 64k and skb->network_header (u16) has wrapped around. The bug is in the ip_tunnel infrastructure, which can cause dev->needed_headroom to increment ad infinitum. The syzkaller reproducer consists of packets getting routed via a gre tunnel, and route of gre encapsulated packets pointing at another (ipip) tunnel. The ipip encapsulation finds gre0 as next output device. This results in the following pattern: 1). First packet is to be sent out via gre0. Route lookup found an output device, ipip0. 2). ip_tunnel_xmit for gre0 bumps gre0->needed_headroom based on the future output device, rt.dev->needed_headroom (ipip0). 3). ip output / start_xmit moves skb on to ipip0. which runs the same code path again (xmit recursion). 4). Routing step for the post-gre0-encap packet finds gre0 as output device to use for ipip0 encapsulated packet. tunl0->needed_headroom is then incremented based on the (already bumped) gre0 device headroom. This repeats for every future packet: gre0->needed_headroom gets inflated because previous packets' ipip0 step incremented rt->dev (gre0) headroom, and ipip0 incremented because gre0 needed_headroom was increased. For each subsequent packet, gre/ipip0->needed_headroom grows until post-expand-head reallocations result in a skb->head/data distance of more than 64k. Once that happens, skb->network_header (u16) wraps around when pskb_expand_head tries to make sure that skb_network_offset() is unchanged after the headroom expansion/reallocation. After this skb_network_offset(skb) returns a different (and negative) result post headroom expansion. The next trip to neigh layer (or anything else that would __skb_pull the network header) makes skb->data point to a memory location outside skb->head area. v2: Cap the needed_headroom update to an arbitarily chosen upperlimit to prevent perpetual increase instead of dropping the headroom increment completely. Reported-and-tested-by: syzbot+bfde3bef047a81b8fde6(a)syzkaller.appspotmail.com Closes: https://groups.google.com/g/syzkaller-bugs/c/fL9G6GtWskY/m/VKk_PR5FBAAJ Fixes: 243aad830e8a ("ip_gre: include route header_len in max_headroom calculation") Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240220135606.4939-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv4/ip_tunnel.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index 1d11e1832059..0953d805cbbe 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -553,6 +553,20 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, return 0; } +static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +{ + /* we must cap headroom to some upperlimit, else pskb_expand_head + * will overflow header offsets in skb_headers_offset_update(). + */ + static const unsigned int max_allowed = 512; + + if (headroom > max_allowed) + headroom = max_allowed; + + if (headroom > READ_ONCE(dev->needed_headroom)) + WRITE_ONCE(dev->needed_headroom, headroom); +} + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto, int tunnel_hlen) { @@ -626,13 +640,13 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, } headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; - if (headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, headroom); - - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, headroom)) { ip_rt_put(rt); goto tx_dropped; } + + ip_tunnel_adj_headroom(dev, headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, proto, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; @@ -810,16 +824,16 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr) + rt->dst.header_len + ip_encap_hlen(&tunnel->encap); - if (max_headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, max_headroom); - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, max_headroom)) { ip_rt_put(rt); dev->stats.tx_dropped++; kfree_skb(skb); return; } + ip_tunnel_adj_headroom(dev, max_headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; -- 2.17.1

2 1

[PATCH v2 OLK-5.10 00/11] sync hulk-5.10 patches
by Yu Kuai 21 May '24

21 May '24

Changes in v2: - fix head in commit message Three features related: - add a switch to enable hungtask check for io, patch 1-2 - add a config to control hierarchical throttle, patch 3-4 - support enable/disable blk-mq debugfs dynamically, patch 5-11 Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (9): block: add a switch to enable hungtask check for io block: disable BLK_IO_HUNG_TASK_CHECK by default blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue block: support to disable debugfs by default arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + block/Kconfig | 31 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 87 ++++++++++++++++++++++---- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 ++++ block/blk-mq.c | 12 ++++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 ++- block/blk-sysfs.c | 82 ++++++++++++++++++++---- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 8 ++- kernel/trace/blktrace.c | 3 - 17 files changed, 245 insertions(+), 42 deletions(-) -- 2.39.2

2 12

[PATCH OLK-6.6 0/1] Fix allmodconfig build error
by Shuai Wu 21 May '24

21 May '24

Fix allmodconfig build error in hiroce3 driver. Shuai Wu (1): net/ethernet/huawei/hiroce3: Fix allmodconfig build error .../hw/hiroce3/bond/roce_bond_common.c | 38 +- .../hw/hiroce3/cq/roce_cq_destroy.c | 15 +- .../hw/hiroce3/host/hmm/hmm_comp_mtt.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_mw_mr.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_res.c | 1 + .../infiniband/hw/hiroce3/host/hmm/hmm_mr.c | 98 +---- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.c | 4 +- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.h | 2 +- .../include/rdma/rdma_context_format.h | 4 +- .../include/rdma/rdma_ext_ctx_format.h | 5 +- .../hw/hiroce3/include/rdma/roce_ccf_format.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_attr.h | 4 +- .../include/rdma/roce_verbs_attr_qpc_chip.h | 4 +- .../hiroce3/include/rdma/roce_verbs_cq_attr.h | 4 +- .../include/rdma/roce_verbs_ext_attr.h | 4 +- .../include/rdma/roce_verbs_gid_attr.h | 4 +- .../hiroce3/include/rdma/roce_verbs_mr_attr.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_pub.h | 4 +- .../include/rdma/roce_verbs_srq_attr.h | 4 +- drivers/infiniband/hw/hiroce3/mr/roce_mr.c | 37 -- drivers/infiniband/hw/hiroce3/roce.h | 1 - drivers/infiniband/hw/hiroce3/roce_main.c | 7 +- .../ethernet/huawei/hinic3/bond/hinic3_bond.c | 1 - .../ethernet/huawei/hinic3/bond/hinic3_bond.h | 4 +- .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.c | 198 +++------ .../huawei/hinic3/cqm/cqm_bitmap_table.c | 10 +- .../huawei/hinic3/cqm/cqm_bloomfilter.c | 69 +--- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.c | 139 ++----- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.h | 2 - .../net/ethernet/huawei/hinic3/cqm/cqm_db.c | 192 +++------ .../ethernet/huawei/hinic3/cqm/cqm_define.h | 4 - .../net/ethernet/huawei/hinic3/cqm/cqm_main.c | 178 +++------ .../ethernet/huawei/hinic3/cqm/cqm_object.c | 378 +++++------------- .../huawei/hinic3/cqm/cqm_object_intern.c | 194 +++------ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 2 +- .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 38 -- .../huawei/hinic3/hw/hinic3_multi_host_mgmt.c | 56 ++- .../hinic3/include/bond/bond_common_defs.h | 4 +- .../huawei/hinic3/include/hinic3_common.h | 2 - .../huawei/hinic3/include/hinic3_cqm.h | 11 - .../huawei/hinic3/include/hinic3_cqm_define.h | 4 - .../include/mpu/mpu_outband_ncsi_cmd_defs.h | 4 +- 42 files changed, 474 insertions(+), 1266 deletions(-) -- 2.33.0

2 3

[PATCH openEuler-22.03-LTS-SP1] cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
by Pu Lehui 21 May '24

21 May '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.213 commit 5f4e51abfbe6eb444fa91906a5cd083044278297 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q92U CVE: CVE-2024-27431 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2487007aa3b9fafbd2cb14068f49791ce1d7ede5 ] When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program. Fixes: 9216477449f3 ("bpf: cpumap: Add the possibility to attach an eBPF program to cpumap") Reported-by: Tobias Böhm <tobias(a)aibor.de> Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Link: https://lore.kernel.org/r/20240305213132.11955-1-toke@redhat.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cpumap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c index 2097ed9bd583..6e4ce0be8be8 100644 --- a/kernel/bpf/cpumap.c +++ b/kernel/bpf/cpumap.c @@ -237,7 +237,7 @@ static int cpu_map_bpf_prog_run_xdp(struct bpf_cpu_map_entry *rcpu, void **frames, int n, struct xdp_cpumap_stats *stats) { - struct xdp_rxq_info rxq; + struct xdp_rxq_info rxq = {}; struct xdp_buff xdp; int i, nframes = 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
by Pu Lehui 21 May '24

21 May '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.213 commit 5f4e51abfbe6eb444fa91906a5cd083044278297 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q92U CVE: CVE-2024-27431 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2487007aa3b9fafbd2cb14068f49791ce1d7ede5 ] When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program. Fixes: 9216477449f3 ("bpf: cpumap: Add the possibility to attach an eBPF program to cpumap") Reported-by: Tobias Böhm <tobias(a)aibor.de> Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Link: https://lore.kernel.org/r/20240305213132.11955-1-toke@redhat.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cpumap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c index 2097ed9bd583..6e4ce0be8be8 100644 --- a/kernel/bpf/cpumap.c +++ b/kernel/bpf/cpumap.c @@ -237,7 +237,7 @@ static int cpu_map_bpf_prog_run_xdp(struct bpf_cpu_map_entry *rcpu, void **frames, int n, struct xdp_cpumap_stats *stats) { - struct xdp_rxq_info rxq; + struct xdp_rxq_info rxq = {}; struct xdp_buff xdp; int i, nframes = 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
by Pu Lehui 21 May '24

21 May '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.213 commit 5f4e51abfbe6eb444fa91906a5cd083044278297 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q92U CVE: CVE-2024-27431 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2487007aa3b9fafbd2cb14068f49791ce1d7ede5 ] When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program. Fixes: 9216477449f3 ("bpf: cpumap: Add the possibility to attach an eBPF program to cpumap") Reported-by: Tobias Böhm <tobias(a)aibor.de> Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Link: https://lore.kernel.org/r/20240305213132.11955-1-toke@redhat.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cpumap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c index 2097ed9bd583..6e4ce0be8be8 100644 --- a/kernel/bpf/cpumap.c +++ b/kernel/bpf/cpumap.c @@ -237,7 +237,7 @@ static int cpu_map_bpf_prog_run_xdp(struct bpf_cpu_map_entry *rcpu, void **frames, int n, struct xdp_cpumap_stats *stats) { - struct xdp_rxq_info rxq; + struct xdp_rxq_info rxq = {}; struct xdp_buff xdp; int i, nframes = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
by Pu Lehui 21 May '24

21 May '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.213 commit 5f4e51abfbe6eb444fa91906a5cd083044278297 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q92U CVE: CVE-2024-27431 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2487007aa3b9fafbd2cb14068f49791ce1d7ede5 ] When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program. Fixes: 9216477449f3 ("bpf: cpumap: Add the possibility to attach an eBPF program to cpumap") Reported-by: Tobias Böhm <tobias(a)aibor.de> Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Link: https://lore.kernel.org/r/20240305213132.11955-1-toke@redhat.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cpumap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c index 2097ed9bd583..6e4ce0be8be8 100644 --- a/kernel/bpf/cpumap.c +++ b/kernel/bpf/cpumap.c @@ -237,7 +237,7 @@ static int cpu_map_bpf_prog_run_xdp(struct bpf_cpu_map_entry *rcpu, void **frames, int n, struct xdp_cpumap_stats *stats) { - struct xdp_rxq_info rxq; + struct xdp_rxq_info rxq = {}; struct xdp_buff xdp; int i, nframes = 0; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 37e0a494c2c8c6f0570068ab47a3e8319dbac30b
by kernel test robot 21 May '24

21 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 37e0a494c2c8c6f0570068ab47a3e8319dbac30b !7586 powerpc/imc-pmu: Add a null pointer check in update_events_in_group() Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-005-20240521 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-randconfig-013-20240521 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-randconfig-075-20240521 | `-- kernel-sched-sparsemask.h:warning:array-subscript-is-outside-array-bounds-of-const-struct-sparsemask_chunk |-- x86_64-randconfig-103-20240521 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-randconfig-161-20240520 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-buildonly-randconfig-002-20240521 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-004-20240521 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-014-20240521 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-015-20240521 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension `-- x86_64-randconfig-101-20240521 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension elapsed time: 733m configs tested: 35 configs skipped: 146 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240520 gcc arm64 randconfig-002-20240520 gcc arm64 randconfig-003-20240520 gcc arm64 randconfig-004-20240520 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240521 clang x86_64 buildonly-randconfig-002-20240521 clang x86_64 buildonly-randconfig-003-20240521 gcc x86_64 buildonly-randconfig-004-20240521 clang x86_64 buildonly-randconfig-005-20240521 gcc x86_64 buildonly-randconfig-006-20240521 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240521 clang x86_64 randconfig-002-20240521 clang x86_64 randconfig-003-20240521 clang x86_64 randconfig-004-20240521 clang x86_64 randconfig-005-20240521 clang x86_64 randconfig-006-20240521 clang x86_64 randconfig-011-20240521 clang x86_64 randconfig-012-20240521 gcc x86_64 randconfig-013-20240521 gcc x86_64 randconfig-014-20240521 clang x86_64 randconfig-015-20240521 clang x86_64 randconfig-016-20240521 gcc x86_64 randconfig-071-20240521 gcc x86_64 randconfig-072-20240521 clang x86_64 randconfig-073-20240521 clang x86_64 randconfig-074-20240521 gcc x86_64 randconfig-075-20240521 gcc x86_64 randconfig-076-20240521 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] irqchip/gic-v3-its: Prevent double free on error
by Liu Mingrui 21 May '24

21 May '24

From: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> stable inclusion from stable-v5.10.216 commit aa44d21574751a7d6bca892eb8e0e9ac68372e52 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HX CVE: CVE-2024-35847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c26591afd33adce296c022e3480dea4282b7ef91 upstream. The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240418061053.96803-2-guanrui.huang@linux.alibab… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 806359f3376a..8a716da480b0 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -5210,13 +5210,8 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq set_bit(i, bitmap); } - if (err) { - if (i > 0) - its_vpe_irq_domain_free(domain, virq, i); - - its_lpi_free(bitmap, base, nr_ids); - its_free_prop_table(vprop_page); - } + if (err) + its_vpe_irq_domain_free(domain, virq, i); return err; } -- 2.25.1

2 1

[PATCH OLK-5.10] irqchip/gic-v3-its: Prevent double free on error
by Liu Mingrui 21 May '24

21 May '24

From: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> stable inclusion from stable-v5.10.216 commit aa44d21574751a7d6bca892eb8e0e9ac68372e52 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HX CVE: CVE-2024-35847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c26591afd33adce296c022e3480dea4282b7ef91 upstream. The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240418061053.96803-2-guanrui.huang@linux.alibab… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 806359f3376a..8a716da480b0 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -5210,13 +5210,8 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq set_bit(i, bitmap); } - if (err) { - if (i > 0) - its_vpe_irq_domain_free(domain, virq, i); - - its_lpi_free(bitmap, base, nr_ids); - its_free_prop_table(vprop_page); - } + if (err) + its_vpe_irq_domain_free(domain, virq, i); return err; } -- 2.25.1

2 1

[PATCH OLK-5.10] irqchip/gic-v3-its: Prevent double free on error
by Liu Mingrui 21 May '24

21 May '24

From: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> stable inclusion from stable-v5.10.216 commit aa44d21574751a7d6bca892eb8e0e9ac68372e52 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HX CVE: CVE-2024-35847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c26591afd33adce296c022e3480dea4282b7ef91 upstream. The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240418061053.96803-2-guanrui.huang@linux.alibab… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 806359f3376a..8a716da480b0 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -5210,13 +5210,8 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq set_bit(i, bitmap); } - if (err) { - if (i > 0) - its_vpe_irq_domain_free(domain, virq, i); - - its_lpi_free(bitmap, base, nr_ids); - its_free_prop_table(vprop_page); - } + if (err) + its_vpe_irq_domain_free(domain, virq, i); return err; } -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 3e487df5eb680f408967a545bd1a5fc20ab62dbc
by kernel test robot 21 May '24

21 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 3e487df5eb680f408967a545bd1a5fc20ab62dbc !7520 drm/i915/gt: Reset queue_priority_hint on parking Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allnoconfig `-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst elapsed time: 727m configs tested: 35 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240520 clang arm64 randconfig-002-20240520 clang arm64 randconfig-003-20240520 clang arm64 randconfig-004-20240520 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240520 clang x86_64 buildonly-randconfig-002-20240520 gcc x86_64 buildonly-randconfig-003-20240520 gcc x86_64 buildonly-randconfig-004-20240520 gcc x86_64 buildonly-randconfig-005-20240520 gcc x86_64 buildonly-randconfig-006-20240520 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240520 clang x86_64 randconfig-002-20240520 gcc x86_64 randconfig-003-20240520 gcc x86_64 randconfig-004-20240520 gcc x86_64 randconfig-005-20240520 gcc x86_64 randconfig-006-20240520 clang x86_64 randconfig-011-20240520 clang x86_64 randconfig-012-20240520 gcc x86_64 randconfig-013-20240520 clang x86_64 randconfig-014-20240520 clang x86_64 randconfig-015-20240520 gcc x86_64 randconfig-016-20240520 gcc x86_64 randconfig-071-20240520 clang x86_64 randconfig-072-20240520 gcc x86_64 randconfig-073-20240520 clang x86_64 randconfig-074-20240520 gcc x86_64 randconfig-075-20240520 clang x86_64 randconfig-076-20240520 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550
by kernel test robot 21 May '24

21 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 !5480 [OLK-6.6] Fix DMA RW sequence disorder issue Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405201915.EtSGIZ33-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405202025.9w8wgmwQ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405202027.XOiN2dDz-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405202102.9bImbUvA-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405202228.Trf7bvHA-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405202248.hKgUtGVI-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) arch/x86/kernel/zhaoxin_kh40000.c:348:11: error: no member named 'dma_ops' in 'struct device' arch/x86/kernel/zhaoxin_kh40000.c:348:16: error: 'struct device' has no member named 'dma_ops' arch/x86/kernel/zhaoxin_kh40000.c:47:30: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] arch/x86/kernel/zhaoxin_kh40000.c:87:24: error: incompatible integer to pointer conversion initializing 'struct iommu_domain *' with an expression of type 'int' [-Wint-conversion] arch/x86/kernel/zhaoxin_kh40000.c:87:33: error: call to undeclared function 'iommu_get_dma_domain'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] drivers/iommu/iommu.c:1141:(.text+0x263a): undefined reference to `iova_reserve_domain_addr' kernel/dma/contiguous.c:228:13: error: 'is_zhaoxin_kh40000' undeclared (first use in this function) kernel/dma/contiguous.c:228:6: error: use of undeclared identifier 'is_zhaoxin_kh40000' Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- x86_64-buildonly-randconfig-002-20240520 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:struct-device-has-no-member-named-dma_ops | `-- kernel-dma-contiguous.c:error:is_zhaoxin_kh40000-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-161-20240520 |-- drivers-iommu-iommu.c:(.text):undefined-reference-to-iova_reserve_domain_addr `-- mm-readahead.c-page_cache_sync_ra()-warn:bitwise-AND-condition-is-false-here clang_recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_before_active_check | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_destroy | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_init_slave | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_netdev_event | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_service_proc | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_tracker_get | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_deatch_bond | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_detach_nic_bond_work | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev_by_name | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_queue_bond_work | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq_destroy.c:warning:no-previous-prototype-for-function-roce3_cq_hw2sw | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_cleanup_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_init_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_alloc | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_disable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_enable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_res.c:warning:no-previous-prototype-for-function-hmm_rdma_mpt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_alloc_mr | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_free_tpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_umem_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_context_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_ext_ctx_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_dif_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_verbs_cmd.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-mr-roce_mr.c:warning:no-previous-prototype-for-function-roce3_check_mr_status | |-- drivers-infiniband-hw-hiroce3-rdma-rdma_comp.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_bond_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_link_event | |-- drivers-infiniband-hw-hiroce3-roce_sysfs.c:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-bat_table-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_fill_cla | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_numb-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_type-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_fill_cla()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_lock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_unlock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_xyz()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-free_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-malloc_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-bloomfilter_init_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-k_flag-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-op-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-bloomfilter_init_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_dec()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_inc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd_buf-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box_async()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_imm()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_record-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-direct_wqe-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-object-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-pagenum-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_get_db_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_direct_wqe_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_fc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_update_pri()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_software_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_get_hardware_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-data-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-event-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_capability_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_template-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_aeq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_capability_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ecq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nocq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_scq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_register()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_unregister()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-bh-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-common-not-described-in-cqm_object_share_recv_queue_add_container | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_number-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_gid_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_timer_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-function_id-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-global_funcid-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_base-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_number-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-init_rq_num-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_funcid | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_old | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-room_header_alloc-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-xid-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_hash_buf_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_timer_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_gid_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_fc_srq_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_funcid()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_alloc_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_old()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_add_container()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_timer_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_free_srq_bitmap_index | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-common-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-container_addr-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link_mode-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_container_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_used_rq_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_head_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_tail_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-tail-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_per_buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_linkwqe_fill()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_bitmap_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_container_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_used_rq_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_cfg.c:warning:expecting-prototype-for-hinic_set_vf_dev_cap().-Prototype-was-for-hinic3_init_vf_dev_cap()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_get | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__mbox_to_host | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-comm_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-get_slave_func_netdev_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hilink_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_get_master_host_mbox_enable | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_nic_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_register_slave_ppf | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-set_slave_func_nic_state | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-sw_func_ppf_mbox_handler |-- arm64-randconfig-001-20240520 | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-004-20240520 | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-r053-20240520 | `-- ld.lld:error:undefined-symbol:__memcpy_mc |-- x86_64-allnoconfig | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:linux-version.h-not-needed. | |-- drivers-infiniband-hw-hiroce3-roce.h:linux-version.h-not-needed. | |-- drivers-net-ethernet-huawei-hinic3-bond-hinic3_bond.c:linux-version.h-not-needed. | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:hinic3_hwif.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_before_active_check | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_destroy | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_init_slave | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_netdev_event | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_service_proc | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_tracker_get | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_deatch_bond | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_detach_nic_bond_work | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev_by_name | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_queue_bond_work | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq_destroy.c:warning:no-previous-prototype-for-function-roce3_cq_hw2sw | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_cleanup_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_init_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_alloc | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_disable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_enable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_res.c:warning:no-previous-prototype-for-function-hmm_rdma_mpt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_alloc_mr | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_free_tpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_umem_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_context_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_ext_ctx_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_dif_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_verbs_cmd.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-mr-roce_mr.c:warning:no-previous-prototype-for-function-roce3_check_mr_status | |-- drivers-infiniband-hw-hiroce3-rdma-rdma_comp.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_bond_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_link_event | |-- drivers-infiniband-hw-hiroce3-roce_sysfs.c:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-bat_table-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_fill_cla | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_numb-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_type-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_fill_cla()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_lock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_unlock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_xyz()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-free_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-malloc_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-bloomfilter_init_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-k_flag-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-op-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-bloomfilter_init_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_dec()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_inc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd_buf-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box_async()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_imm()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_record-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-direct_wqe-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-object-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-pagenum-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_get_db_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_direct_wqe_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_fc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_update_pri()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_software_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_get_hardware_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-data-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-event-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_capability_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_template-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_aeq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_capability_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ecq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nocq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_scq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_register()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_unregister()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-bh-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-common-not-described-in-cqm_object_share_recv_queue_add_container | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_number-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_gid_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_timer_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-function_id-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-global_funcid-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_base-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_number-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-init_rq_num-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_funcid | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_old | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-room_header_alloc-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-xid-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_hash_buf_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_timer_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_gid_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_fc_srq_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_funcid()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_alloc_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_old()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_add_container()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_timer_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_free_srq_bitmap_index | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-common-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-container_addr-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link_mode-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_container_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_used_rq_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_head_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_tail_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-tail-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_per_buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_linkwqe_fill()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_bitmap_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_container_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_used_rq_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_cfg.c:warning:expecting-prototype-for-hinic_set_vf_dev_cap().-Prototype-was-for-hinic3_init_vf_dev_cap()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_get | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__mbox_to_host | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-comm_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-get_slave_func_netdev_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hilink_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_get_master_host_mbox_enable | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_nic_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_register_slave_ppf | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-set_slave_func_nic_state | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-sw_func_ppf_mbox_handler |-- x86_64-buildonly-randconfig-001-20240520 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:call-to-undeclared-function-iommu_get_dma_domain-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:incompatible-integer-to-pointer-conversion-initializing-struct-iommu_domain-with-an-expression-of-type-int | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:no-member-named-dma_ops-in-struct-device | `-- kernel-dma-contiguous.c:error:use-of-undeclared-identifier-is_zhaoxin_kh40000 |-- x86_64-randconfig-001-20240520 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-006-20240520 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-011-20240520 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-013-20240520 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-014-20240520 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-071-20240520 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-073-20240520 | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true |-- x86_64-randconfig-075-20240520 | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:call-to-undeclared-function-iommu_get_dma_domain-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- arch-x86-kernel-zhaoxin_kh40000.c:error:incompatible-integer-to-pointer-conversion-initializing-struct-iommu_domain-with-an-expression-of-type-int | `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true `-- x86_64-rhel-8.3-rust `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true elapsed time: 724m configs tested: 40 configs skipped: 141 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240520 clang arm64 randconfig-002-20240520 clang arm64 randconfig-003-20240520 clang arm64 randconfig-004-20240520 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240520 gcc loongarch randconfig-002-20240520 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240520 clang x86_64 buildonly-randconfig-002-20240520 gcc x86_64 buildonly-randconfig-003-20240520 gcc x86_64 buildonly-randconfig-004-20240520 gcc x86_64 buildonly-randconfig-005-20240520 gcc x86_64 buildonly-randconfig-006-20240520 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240520 clang x86_64 randconfig-002-20240520 gcc x86_64 randconfig-003-20240520 gcc x86_64 randconfig-004-20240520 gcc x86_64 randconfig-005-20240520 gcc x86_64 randconfig-006-20240520 clang x86_64 randconfig-011-20240520 clang x86_64 randconfig-012-20240520 gcc x86_64 randconfig-013-20240520 clang x86_64 randconfig-014-20240520 clang x86_64 randconfig-015-20240520 gcc x86_64 randconfig-016-20240520 gcc x86_64 randconfig-071-20240520 clang x86_64 randconfig-072-20240520 gcc x86_64 randconfig-073-20240520 clang x86_64 randconfig-074-20240520 gcc x86_64 randconfig-075-20240520 clang x86_64 randconfig-076-20240520 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9620/9669] arch/x86/kernel/zhaoxin_kh40000.c:348:16: error: 'struct device' has no member named 'dma_ops'
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: ef20808db09987137fba30519fb94a6b12b63ee7 [9620/9669] Add kh40000_iommu_dma_ops for KH-40000 platform config: x86_64-buildonly-randconfig-002-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202248.hKgUtGVI-lkp@…) compiler: gcc-11 (Ubuntu 11.4.0-4ubuntu1) 11.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202248.hKgUtGVI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202248.hKgUtGVI-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kernel/zhaoxin_kh40000.c: In function 'kh40000_set_iommu_dma_ops': >> arch/x86/kernel/zhaoxin_kh40000.c:348:16: error: 'struct device' has no member named 'dma_ops' 348 | if (dev->dma_ops) { | ^~ arch/x86/kernel/zhaoxin_kh40000.c:349:36: error: 'struct device' has no member named 'dma_ops' 349 | iommu_dma_ops = dev->dma_ops; | ^~ vim +348 arch/x86/kernel/zhaoxin_kh40000.c 345 346 void kh40000_set_iommu_dma_ops(struct device *dev) 347 { > 348 if (dev->dma_ops) { -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9620/9669] arch/x86/kernel/zhaoxin_kh40000.c:348:11: error: no member named 'dma_ops' in 'struct device'
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: ef20808db09987137fba30519fb94a6b12b63ee7 [9620/9669] Add kh40000_iommu_dma_ops for KH-40000 platform config: x86_64-buildonly-randconfig-001-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202228.Trf7bvHA-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202228.Trf7bvHA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202228.Trf7bvHA-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kernel/zhaoxin_kh40000.c:47:30: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 47 | if (ZHAOXIN_P2CW_NODE_CHECK | zhaoxin_patch_code) | ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/zhaoxin_kh40000.c:87:33: error: call to undeclared function 'iommu_get_dma_domain'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 87 | struct iommu_domain *domain = iommu_get_dma_domain(dev); | ^ arch/x86/kernel/zhaoxin_kh40000.c:87:33: note: did you mean 'iommu_is_dma_domain'? include/linux/iommu.h:273:20: note: 'iommu_is_dma_domain' declared here 273 | static inline bool iommu_is_dma_domain(struct iommu_domain *domain) | ^ arch/x86/kernel/zhaoxin_kh40000.c:87:24: error: incompatible integer to pointer conversion initializing 'struct iommu_domain *' with an expression of type 'int' [-Wint-conversion] 87 | struct iommu_domain *domain = iommu_get_dma_domain(dev); | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/zhaoxin_kh40000.c:348:11: error: no member named 'dma_ops' in 'struct device' 348 | if (dev->dma_ops) { | ~~~ ^ arch/x86/kernel/zhaoxin_kh40000.c:349:24: error: no member named 'dma_ops' in 'struct device' 349 | iommu_dma_ops = dev->dma_ops; | ~~~ ^ 1 warning and 4 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for CRYPTO_CRC32C_INTEL Depends on [n]: CRYPTO [=y] && !KMSAN [=y] && X86 [=y] Selected by [y]: - ISCSI_TARGET [=y] && TARGET_CORE [=y] && INET [=y] && X86 [=y] vim +348 arch/x86/kernel/zhaoxin_kh40000.c 345 346 void kh40000_set_iommu_dma_ops(struct device *dev) 347 { > 348 if (dev->dma_ops) { -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] jbd2: speed up jbd2_transaction_committed()
by Zhang Yi 20 May '24

20 May '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9QSJ5 CVE: NA -------------------------------- jbd2_transaction_committed() is used to check whether a transaction with the given tid has already committed, it holds j_state_lock in read mode and check the tid of current running transaction and committing transaction, but holding the j_state_lock is expensive. We have already stored the sequence number of the most recently committed transaction in journal t->j_commit_sequence, we could do this check by comparing it with the given tid instead. If the given tid isn't smaller than j_commit_sequence, we can ensure that the given transaction has been committed. That way we could drop the expensive lock and achieve about 10% ~ 20% performance gains in concurrent DIOs on may virtual machine with 100G ramdisk. fio -filename=/mnt/foo -direct=1 -iodepth=10 -rw=$rw -ioengine=libaio \ -bs=4k -size=10G -numjobs=10 -runtime=60 -overwrite=1 -name=test \ -group_reporting Before: overwrite IOPS=88.2k, BW=344MiB/s read IOPS=95.7k, BW=374MiB/s rand overwrite IOPS=98.7k, BW=386MiB/s randread IOPS=102k, BW=397MiB/s After: overwrite IOPS=105k, BW=410MiB/s read IOPS=112k, BW=436MiB/s rand overwrite IOPS=104k, BW=404MiB/s randread IOPS=111k, BW=432MiB/s CC: Dave Chinner <david(a)fromorbit.com> Suggested-by: Dave Chinner <david(a)fromorbit.com> Link: https://lore.kernel.org/linux-ext4/ZjILCPNZRHeazSqV@dread.disaster.area/ Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> --- fs/jbd2/commit.c | 2 +- fs/jbd2/journal.c | 12 +----------- 2 files changed, 2 insertions(+), 12 deletions(-) diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c index 5e122586e06e..8244cab17688 100644 --- a/fs/jbd2/commit.c +++ b/fs/jbd2/commit.c @@ -1108,7 +1108,7 @@ void jbd2_journal_commit_transaction(journal_t *journal) commit_transaction->t_state = T_COMMIT_CALLBACK; J_ASSERT(commit_transaction == journal->j_committing_transaction); - journal->j_commit_sequence = commit_transaction->t_tid; + WRITE_ONCE(journal->j_commit_sequence, commit_transaction->t_tid); journal->j_committing_transaction = NULL; commit_time = ktime_to_ns(ktime_sub(ktime_get(), start_time)); diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 19c69229ac6e..fc4c7a2bf6d5 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -789,17 +789,7 @@ EXPORT_SYMBOL(jbd2_fc_end_commit_fallback); /* Return 1 when transaction with given tid has already committed. */ int jbd2_transaction_committed(journal_t *journal, tid_t tid) { - int ret = 1; - - read_lock(&journal->j_state_lock); - if (journal->j_running_transaction && - journal->j_running_transaction->t_tid == tid) - ret = 0; - if (journal->j_committing_transaction && - journal->j_committing_transaction->t_tid == tid) - ret = 0; - read_unlock(&journal->j_state_lock); - return ret; + return tid_geq(READ_ONCE(journal->j_commit_sequence), tid); } EXPORT_SYMBOL(jbd2_transaction_committed); -- 2.39.2

2 1

[openeuler:OLK-6.6 9619/9669] kernel/dma/contiguous.c:228:13: error: 'is_zhaoxin_kh40000' undeclared
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9619/9669] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-buildonly-randconfig-002-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202102.9bImbUvA-lkp@…) compiler: gcc-11 (Ubuntu 11.4.0-4ubuntu1) 11.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202102.9bImbUvA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202102.9bImbUvA-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/dma/contiguous.c: In function 'dma_contiguous_reserve': >> kernel/dma/contiguous.c:228:13: error: 'is_zhaoxin_kh40000' undeclared (first use in this function) 228 | if (is_zhaoxin_kh40000) | ^~~~~~~~~~~~~~~~~~ kernel/dma/contiguous.c:228:13: note: each undeclared identifier is reported only once for each function it appears in vim +/is_zhaoxin_kh40000 +228 kernel/dma/contiguous.c 208 209 /** 210 * dma_contiguous_reserve() - reserve area(s) for contiguous memory handling 211 * @limit: End address of the reserved memory (optional, 0 for any). 212 * 213 * This function reserves memory from early allocator. It should be 214 * called by arch specific code once the early allocator (memblock or bootmem) 215 * has been activated and all other subsystems have already allocated/reserved 216 * memory. 217 */ 218 void __init dma_contiguous_reserve(phys_addr_t limit) 219 { 220 phys_addr_t selected_size = 0; 221 phys_addr_t selected_base = 0; 222 phys_addr_t selected_limit = limit; 223 bool fixed = false; 224 225 dma_numa_cma_reserve(); 226 227 #if defined(CONFIG_X86_64) && defined(CONFIG_PCI) > 228 if (is_zhaoxin_kh40000) 229 return; 230 #endif 231 pr_debug("%s(limit %08lx)\n", __func__, (unsigned long)limit); 232 233 if (size_cmdline != -1) { 234 selected_size = size_cmdline; 235 selected_base = base_cmdline; 236 selected_limit = min_not_zero(limit_cmdline, limit); 237 if (base_cmdline + size_cmdline == limit_cmdline) 238 fixed = true; 239 } else { 240 #ifdef CONFIG_CMA_SIZE_SEL_MBYTES 241 selected_size = size_bytes; 242 #elif defined(CONFIG_CMA_SIZE_SEL_PERCENTAGE) 243 selected_size = cma_early_percent_memory(); 244 #elif defined(CONFIG_CMA_SIZE_SEL_MIN) 245 selected_size = min(size_bytes, cma_early_percent_memory()); 246 #elif defined(CONFIG_CMA_SIZE_SEL_MAX) 247 selected_size = max(size_bytes, cma_early_percent_memory()); 248 #endif 249 } 250 251 if (selected_size && !dma_contiguous_default_area) { 252 pr_debug("%s: reserving %ld MiB for global area\n", __func__, 253 (unsigned long)selected_size / SZ_1M); 254 255 dma_contiguous_reserve_area(selected_size, selected_base, 256 selected_limit, 257 &dma_contiguous_default_area, 258 fixed); 259 } 260 } 261 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9619/9669] arch/x86/kernel/zhaoxin_kh40000.c:87:33: error: call to undeclared function 'iommu_get_dma_domain'; ISO C99 and later do not support implicit function declarations
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9619/9669] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-buildonly-randconfig-001-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202027.XOiN2dDz-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202027.XOiN2dDz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202027.XOiN2dDz-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kernel/zhaoxin_kh40000.c:47:30: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 47 | if (ZHAOXIN_P2CW_NODE_CHECK | zhaoxin_patch_code) | ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/zhaoxin_kh40000.c:87:33: error: call to undeclared function 'iommu_get_dma_domain'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 87 | struct iommu_domain *domain = iommu_get_dma_domain(dev); | ^ arch/x86/kernel/zhaoxin_kh40000.c:87:33: note: did you mean 'iommu_is_dma_domain'? include/linux/iommu.h:273:20: note: 'iommu_is_dma_domain' declared here 273 | static inline bool iommu_is_dma_domain(struct iommu_domain *domain) | ^ >> arch/x86/kernel/zhaoxin_kh40000.c:87:24: error: incompatible integer to pointer conversion initializing 'struct iommu_domain *' with an expression of type 'int' [-Wint-conversion] 87 | struct iommu_domain *domain = iommu_get_dma_domain(dev); | ^ ~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning and 2 errors generated. -- >> kernel/dma/contiguous.c:228:6: error: use of undeclared identifier 'is_zhaoxin_kh40000' 228 | if (is_zhaoxin_kh40000) | ^ 1 error generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for CRYPTO_CRC32C_INTEL Depends on [n]: CRYPTO [=y] && !KMSAN [=y] && X86 [=y] Selected by [y]: - ISCSI_TARGET [=y] && TARGET_CORE [=y] && INET [=y] && X86 [=y] vim +/iommu_get_dma_domain +87 arch/x86/kernel/zhaoxin_kh40000.c 64 65 static void kh40000_sync_single_dma_for_cpu(struct device *dev, dma_addr_t paddr, 66 enum dma_data_direction dir, bool is_iommu) 67 { 68 u8 vid; 69 struct pci_dev *pci; 70 u64 dma_mask = *dev->dma_mask; 71 72 /* check direction */ 73 if ((dir != DMA_FROM_DEVICE) && (dir != DMA_BIDIRECTIONAL)) 74 return; 75 76 /* check dma capability */ 77 if (dma_mask <= DMA_BIT_MASK(32)) 78 return; 79 80 /* check device type */ 81 pci = kh40000_get_pci_dev(dev); 82 if (pci == NULL) 83 return; 84 85 /* get real physical address */ 86 if (is_iommu) { > 87 struct iommu_domain *domain = iommu_get_dma_domain(dev); 88 89 paddr = iommu_iova_to_phys(domain, paddr); 90 if (!paddr) 91 return; 92 } 93 94 /* check node or not */ 95 if ((zhaoxin_patch_code & ZHAOXIN_P2CW_NODE_CHECK) 96 && pfn_to_nid(PFN_DOWN(paddr)) == dev_to_node(dev)) 97 return; 98 99 /* flush data by one pci read cycle */ 100 pci_read_config_byte(pci, PCI_VENDOR_ID, &vid); 101 } 102 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9639/9669] drivers/iommu/iommu.c:1141:undefined reference to `iova_reserve_domain_addr'
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: 40c9fc02b0564bbcbc3fc6e14f3aea3639f0afa6 [9639/9669] iommu/vt-d: Add support for detecting ACPI namespace device in RMRR config: x86_64-randconfig-161-20240520 (https://download.01.org/0day-ci/archive/20240520/202405202025.9w8wgmwQ-lkp@…) compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405202025.9w8wgmwQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405202025.9w8wgmwQ-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/iommu/iommu.o: in function `iommu_create_device_direct_mappings': >> drivers/iommu/iommu.c:1141:(.text+0x263a): undefined reference to `iova_reserve_domain_addr' vim +1141 drivers/iommu/iommu.c 1085 1086 static int iommu_create_device_direct_mappings(struct iommu_domain *domain, 1087 struct device *dev) 1088 { 1089 struct iommu_resv_region *entry; 1090 struct list_head mappings; 1091 unsigned long pg_size; 1092 int ret = 0; 1093 1094 pg_size = domain->pgsize_bitmap ? 1UL << __ffs(domain->pgsize_bitmap) : 0; 1095 INIT_LIST_HEAD(&mappings); 1096 1097 if (WARN_ON_ONCE(iommu_is_dma_domain(domain) && !pg_size)) 1098 return -EINVAL; 1099 1100 iommu_get_resv_regions(dev, &mappings); 1101 1102 /* We need to consider overlapping regions for different devices */ 1103 list_for_each_entry(entry, &mappings, list) { 1104 dma_addr_t start, end, addr; 1105 size_t map_size = 0; 1106 1107 if (entry->type == IOMMU_RESV_DIRECT) 1108 dev->iommu->require_direct = 1; 1109 1110 if ((entry->type != IOMMU_RESV_DIRECT && 1111 entry->type != IOMMU_RESV_DIRECT_RELAXABLE) || 1112 !iommu_is_dma_domain(domain)) 1113 continue; 1114 1115 start = ALIGN(entry->start, pg_size); 1116 end = ALIGN(entry->start + entry->length, pg_size); 1117 1118 for (addr = start; addr <= end; addr += pg_size) { 1119 phys_addr_t phys_addr; 1120 1121 if (addr == end) 1122 goto map_end; 1123 1124 phys_addr = iommu_iova_to_phys(domain, addr); 1125 if (!phys_addr) { 1126 map_size += pg_size; 1127 continue; 1128 } 1129 1130 map_end: 1131 if (map_size) { 1132 ret = iommu_map(domain, addr - map_size, 1133 addr - map_size, map_size, 1134 entry->prot, GFP_KERNEL); 1135 if (ret) 1136 goto out; 1137 map_size = 0; 1138 } 1139 } 1140 if (apply_zhaoxin_dmar_acpi_a_behavior()) > 1141 iova_reserve_domain_addr(domain, start, end); 1142 } 1143 1144 if (!list_empty(&mappings) && iommu_is_dma_domain(domain)) 1145 iommu_flush_iotlb_all(domain); 1146 1147 out: 1148 iommu_put_resv_regions(dev, &mappings); 1149 1150 return ret; 1151 } 1152 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/61] mm/page_onwer: support recording and
by Jinjiang Tu 20 May '24

20 May '24

Support page_owner_module feature. Akira Yokosawa (2): docs: vm/page_owner: use literal blocks for param description docs: vm/page_owner: tweak literal block in STANDARD FORMAT SPECIFIERS Charan Teja Kalla (2): mm: fix use-after free of page_ext after race with memory-offline mm/page_exit: fix kernel doc warning in page_ext_put() Chen Xiao (1): docs: mm/page_owner: fix spelling mistakes Chongxi Zhao (1): tools/vm/page_owner_sort.c: support sorting pid and time Eric Dumazet (1): mm/page_owner: use strscpy() instead of strlcpy() Haowen Bai (1): tools/vm/page_owner: support debug log to avoid huge log print Hyeonggon Yoo (1): mm/page_owner: record single timestamp value for high order allocations Jiajian Ye (9): tools/vm/page_owner_sort.c: add a security check tools/vm/page_owner_sort.c: support sorting by tgid and update documentation tools/vm/page_owner_sort: fix three trivival places tools/vm/page_owner_sort: support for sorting by task command name tools/vm/page_owner_sort.c: support for selecting by PID, TGID or task command name tools/vm/page_owner_sort.c: support for user-defined culling rules tools/vm/page_owner_sort.c: use fprintf() to send error messages to stderr tools/vm/page_owner_sort.c: support for multi-value selection in single argument tools/vm/page_owner_sort.c: support sorting blocks by multiple keys Jianlin Lv (1): tools/vm/page_owner_sort: free memory before exit Jinjiang Tu (11): mm/page_owner: support identifying pages allocated by modules mm/page_owner: support filtering by modules when dumping page_owner mm/page_owner: show top modules allocating pages when oom occurred mm/page_owner: support configuring the num of modules to dump mm/page_owner: supporting showing the module statistics via debugfs mm/page_owner: record leaked module into individual list Documentation: update page_owner document for module statistics tools/vm/page_owner_sort: support for selecting by module name tools/vm/page_owner_sort: support for culling by module name tools/vm/page_owner_sort: support sorting by module name Documentation: update document for page_owner_sort tool Jonathan Corbet (1): docs: fix RST error in vm/page_owner.rst Sean Anderson (2): tools/vm/page_owner_sort.c: sort by stacktrace before culling tools/vm/page_owner_sort.c: support sorting by stack trace Sergei Trofimovich (1): mm: page_owner: detect page_owner recursion via task_struct Shenghong Han (2): tools/vm/page_owner_sort.c: two trivial fixes Documentation/vm/page_owner.rst: update the documentation Steve Chou (1): tools/mm/page_owner_sort.c: fix TGID output when cull=tg is used Tang Bin (1): tools/vm/page_owner_sort.c: check malloc() return Ting Liu (1): mm: make some vars and functions static or __init Vijayanand Jitta (2): lib: stackdepot: add support to disable stack depot lib: stackdepot: fix ignoring return value warning Ville Syrjälä (1): drm/i915: Fix oops due to missing stack depot Vlastimil Babka (3): lib/stackdepot: allow optional init and stack_table allocation by kvmalloc() lib/stackdepot: allow requesting early initialization dynamically lib/stackdepot: replace CONFIG_STACK_HASH_ORDER with automatic sizing Waiman Long (3): mm/page_owner: use scnprintf() to avoid excessive buffer overrun check mm/page_owner: print memcg information mm/page_owner: record task command name Yinan Zhang (3): tools/vm/page_owner_sort.c: add switch between culling by stacktrace and txt tools/vm/page_owner_sort.c: remove -c option doc/vm/page_owner.rst: remove content related to -c option Yixuan Cao (7): mm/page_owner.c: record tgid tools/vm/page_owner_sort.c: delete invalid duplicate code tools/vm/page_owner_sort.c: fix the instructions for use tools/vm/page_owner_sort.c: provide allocator labelling and update --cull and --sort options tools/vm/page_owner_sort.c: avoid repeated judgments tools/vm/page_owner_sort.c: adjust the indent in is_need() tools/vm/page_owner_sort: fix -f option Yogesh Lal (1): lib: stackdepot: add support to configure STACK_HASH_SIZE Zhenhua Huang (1): mm/page_owner.c: remove redundant drain_all_pages Zhenliang Wei (1): tools/vm/page_owner_sort.c: count and sort by mem .../admin-guide/kernel-parameters.txt | 6 + Documentation/vm/page_owner.rst | 129 ++- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + drivers/gpu/drm/drm_mm.c | 4 + drivers/gpu/drm/i915/intel_runtime_pm.c | 1 + include/linux/page_ext.h | 17 +- include/linux/page_idle.h | 34 +- include/linux/sched.h | 3 + include/linux/stackdepot.h | 34 +- init/main.c | 9 +- lib/Kconfig | 4 + lib/Kconfig.kasan | 4 +- lib/stackdepot.c | 126 ++- mm/Kconfig.debug | 9 + mm/Makefile | 1 + mm/page_ext.c | 108 ++- mm/page_owner.c | 209 ++-- mm/page_owner.h | 71 ++ mm/page_owner_module.c | 402 ++++++++ tools/vm/page_owner_sort.c | 904 +++++++++++++++++- 20 files changed, 1927 insertions(+), 149 deletions(-) create mode 100644 mm/page_owner.h create mode 100644 mm/page_owner_module.c -- 2.25.1

2 62

[PATCH OLK-6.6 0/2] memcg_swap_qos: Backport two bugfix
by Liu Shixin 20 May '24

20 May '24

Backport two bugfix for memcg_swap_qos feature. Liu Shixin (2): memcg: fix incorrect value of sysctl_memcg_swap_qos_stat mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile mm/memcontrol.c | 28 +++++++++++++++++++--------- mm/swapfile.c | 8 +++----- 2 files changed, 22 insertions(+), 14 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 00/10] Introduce NUMA isolation and consolidation
by Hui Tang 20 May '24

20 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (9): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 +++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 ++++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 ++++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 ++++++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 ++++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++++- 22 files changed, 1843 insertions(+), 25 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 11

[PATCH OLK-5.10] irqchip/gic-v3-its: Prevent double free on error
by Liu Mingrui 20 May '24

20 May '24

From: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> stable inclusion from stable-v5.10.216 commit aa44d21574751a7d6bca892eb8e0e9ac68372e52 category: bugfix bugzilla: 189928 CVE: CVE-2024-35847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c26591afd33adce296c022e3480dea4282b7ef91 upstream. The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240418061053.96803-2-guanrui.huang@linux.alibab… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 806359f3376a..8a716da480b0 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -5210,13 +5210,8 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq set_bit(i, bitmap); } - if (err) { - if (i > 0) - its_vpe_irq_domain_free(domain, virq, i); - - its_lpi_free(bitmap, base, nr_ids); - its_free_prop_table(vprop_page); - } + if (err) + its_vpe_irq_domain_free(domain, virq, i); return err; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
by Luo Gengkun 20 May '24

20 May '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mainline inclusion from mainline-v6.8-rc1 commit ce3e112e7ae854249d8755906acc5f27e1542114 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9GI CVE: CVE-2023-52694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse. Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.k… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c index e0e015243a60..b588fea12502 100644 --- a/drivers/gpu/drm/bridge/ti-tpd12s015.c +++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c @@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) return 0; } -static int __exit tpd12s015_remove(struct platform_device *pdev) +static int tpd12s015_remove(struct platform_device *pdev) { struct tpd12s015_device *tpd = platform_get_drvdata(pdev); @@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); static struct platform_driver tpd12s015_driver = { .probe = tpd12s015_probe, - .remove = __exit_p(tpd12s015_remove), + .remove = tpd12s015_remove, .driver = { .name = "tpd12s015", .of_match_table = tpd12s015_of_match, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] irqchip/gic-v3-its: Prevent double free on error
by Liu Mingrui 20 May '24

20 May '24

From: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> stable inclusion from stable-v5.10.216 commit aa44d21574751a7d6bca892eb8e0e9ac68372e52 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HX CVE: CVE-2024-35847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c26591afd33adce296c022e3480dea4282b7ef91 upstream. The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown") Signed-off-by: Guanrui Huang <guanrui.huang(a)linux.alibaba.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240418061053.96803-2-guanrui.huang@linux.alibab… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 71e1689a32e7..1f157bf54ce1 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -3509,13 +3509,8 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq set_bit(i, bitmap); } - if (err) { - if (i > 0) - its_vpe_irq_domain_free(domain, virq, i); - - its_lpi_free(bitmap, base, nr_ids); - its_free_prop_table(vprop_page); - } + if (err) + its_vpe_irq_domain_free(domain, virq, i); return err; } -- 2.25.1

2 1

[PATCH OLK-5.10] mm/swapfile: fix infinite loop in get_swap_pages after set memory.swapfile
by Liu Shixin 20 May '24

20 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9QRNR CVE: NA -------------------------------- In get_swap_pages(), we select the swap device based on the priority by default. If two or more devices have the same priority, their positions in the avail_lists will move in a circle in plist_requeue(). After set memory.swapfile in a memory cgroup and the priority of the matched swap is less than the priority of these swap, the loop will be confined to these swaps with same priority and can't select the specified swap forever. Fix the infinite loop by skip the unmatched swap before plist_requeue(). Fixes: 682fc25deeed ("mm/swapfile: introduce per-memcg swapfile control") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/swapfile.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/mm/swapfile.c b/mm/swapfile.c index 4aa7339bb365..a10c67728e46 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -1173,15 +1173,13 @@ int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size, start_over: node = numa_node_id(); plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { + if (should_skip_swap_type(si->type, type)) + goto nextsi; + /* requeue si to after same-priority siblings */ plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); spin_unlock(&swap_avail_lock); spin_lock(&si->lock); - if (should_skip_swap_type(si->type, type)) { - spin_unlock(&si->lock); - spin_lock(&swap_avail_lock); - goto nextsi; - } if (!si->highest_bit || !(si->flags & SWP_WRITEOK)) { spin_lock(&swap_avail_lock); if (plist_node_empty(&si->avail_lists[node])) { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
by Luo Gengkun 20 May '24

20 May '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mainline inclusion from mainline-v6.8-rc1 commit 08ccff6ece35f08e8107e975903c370d849089e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9GI CVE: CVE-2023-52694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse. Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.k… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c index e0e015243a60..b588fea12502 100644 --- a/drivers/gpu/drm/bridge/ti-tpd12s015.c +++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c @@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) return 0; } -static int __exit tpd12s015_remove(struct platform_device *pdev) +static int tpd12s015_remove(struct platform_device *pdev) { struct tpd12s015_device *tpd = platform_get_drvdata(pdev); @@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); static struct platform_driver tpd12s015_driver = { .probe = tpd12s015_probe, - .remove = __exit_p(tpd12s015_remove), + .remove = tpd12s015_remove, .driver = { .name = "tpd12s015", .of_match_table = tpd12s015_of_match, -- 2.34.1

2 1

[openeuler:OLK-6.6 9619/9669] arch/x86/kernel/zhaoxin_kh40000.c:47:30: warning: bitwise or with non-zero value always evaluates to true
by kernel test robot 20 May '24

20 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bb74bc369fd2ab5f41a32c4ddc2e23bc76c3c550 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9619/9669] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20240520/202405201915.EtSGIZ33-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240520/202405201915.EtSGIZ33-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405201915.EtSGIZ33-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kernel/zhaoxin_kh40000.c:47:30: warning: bitwise or with non-zero value always evaluates to true [-Wtautological-bitwise-compare] 47 | if (ZHAOXIN_P2CW_NODE_CHECK | zhaoxin_patch_code) | ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +47 arch/x86/kernel/zhaoxin_kh40000.c 36 37 static int __init zhaoxin_patch_code_setup(char *str) 38 { 39 int err = kstrtoul(str, 0, &zhaoxin_patch_code); 40 41 if (err || (zhaoxin_patch_code > ZHAOXIN_PATCH_CODE_MAX)) { 42 pr_err("cmdline 'zhaoxin_patch_bitmask=%s' inappropriate\n", str); 43 zhaoxin_patch_code = ZHAOXIN_PATCH_CODE_DEFAULT; 44 return err; 45 } 46 > 47 if (ZHAOXIN_P2CW_NODE_CHECK | zhaoxin_patch_code) 48 pr_info("zhaoxin dma patch node check is enabled\n"); 49 50 return 0; 51 } 52 __setup("zhaoxin_patch_bitmask=", zhaoxin_patch_code_setup); 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
by Luo Gengkun 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.8-rc1 commit 0a233867a39078ebb0f575e2948593bbff5826b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9J4 CVE: CVE-2023-52675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c index e8074d7f2401..ac28952cdf87 100644 --- a/arch/powerpc/perf/imc-pmu.c +++ b/arch/powerpc/perf/imc-pmu.c @@ -291,6 +291,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue; @@ -298,6 +300,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str; if (pmu->events[i].scale) { ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); + if (!ev_scale_str) + continue; dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); if (!dev_str) continue; @@ -307,6 +311,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) if (pmu->events[i].unit) { ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); + if (!ev_unit_str) + continue; dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); if (!dev_str) continue; -- 2.34.1

2 1

[PATCH] [Backport] powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
by Luo Gengkun 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.8-rc1 commit 0a233867a39078ebb0f575e2948593bbff5826b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9J4 CVE: CVE-2023-52675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c index 6714be662bd4..541a81569bb7 100644 --- a/arch/powerpc/perf/imc-pmu.c +++ b/arch/powerpc/perf/imc-pmu.c @@ -285,6 +285,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue; @@ -292,6 +294,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str; if (pmu->events[i].scale) { ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); + if (!ev_scale_str) + continue; dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); if (!dev_str) continue; @@ -301,6 +305,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) if (pmu->events[i].unit) { ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); + if (!ev_unit_str) + continue; dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); if (!dev_str) continue; -- 2.34.1

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
by Luo Gengkun 20 May '24

20 May '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mainline inclusion from mainline-v6.8-rc1 commit 024352f7928b28f53609660663329d8c0f4ad032 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9GI CVE: CVE-2023-52694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse. Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.k… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c index e0e015243a60..b588fea12502 100644 --- a/drivers/gpu/drm/bridge/ti-tpd12s015.c +++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c @@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) return 0; } -static int __exit tpd12s015_remove(struct platform_device *pdev) +static int tpd12s015_remove(struct platform_device *pdev) { struct tpd12s015_device *tpd = platform_get_drvdata(pdev); @@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); static struct platform_driver tpd12s015_driver = { .probe = tpd12s015_probe, - .remove = __exit_p(tpd12s015_remove), + .remove = tpd12s015_remove, .driver = { .name = "tpd12s015", .of_match_table = tpd12s015_of_match, -- 2.34.1

2 1

[PATCH] [Backport] powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
by Luo Gengkun 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.8-rc1 commit 0a233867a39078ebb0f575e2948593bbff5826b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9J4 CVE: CVE-2023-52675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> --- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c index 6714be662bd4..541a81569bb7 100644 --- a/arch/powerpc/perf/imc-pmu.c +++ b/arch/powerpc/perf/imc-pmu.c @@ -285,6 +285,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue; @@ -292,6 +294,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str; if (pmu->events[i].scale) { ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); + if (!ev_scale_str) + continue; dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); if (!dev_str) continue; @@ -301,6 +305,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) if (pmu->events[i].unit) { ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); + if (!ev_unit_str) + continue; dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); if (!dev_str) continue; -- 2.34.1

1 0

[PATCH] [Backport] powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
by Luo Gengkun 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.8-rc1 commit 0a233867a39078ebb0f575e2948593bbff5826b3 category: bugfix bugzilla: 189832 CVE: CVE-2023-52675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> --- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c index 6714be662bd4..541a81569bb7 100644 --- a/arch/powerpc/perf/imc-pmu.c +++ b/arch/powerpc/perf/imc-pmu.c @@ -285,6 +285,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue; @@ -292,6 +294,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str; if (pmu->events[i].scale) { ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); + if (!ev_scale_str) + continue; dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); if (!dev_str) continue; @@ -301,6 +305,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) if (pmu->events[i].unit) { ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); + if (!ev_unit_str) + continue; dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); if (!dev_str) continue; -- 2.34.1

1 0

[PATCH openEuler-22.03-LTS-SP1] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
by Luo Gengkun 20 May '24

20 May '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mainline inclusion from mainline-v6.8-rc1 commit 024352f7928b28f53609660663329d8c0f4ad032 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9GI CVE: CVE-2023-52694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse. Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.k… Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c index e0e015243a60..b588fea12502 100644 --- a/drivers/gpu/drm/bridge/ti-tpd12s015.c +++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c @@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) return 0; } -static int __exit tpd12s015_remove(struct platform_device *pdev) +static int tpd12s015_remove(struct platform_device *pdev) { struct tpd12s015_device *tpd = platform_get_drvdata(pdev); @@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); static struct platform_driver tpd12s015_driver = { .probe = tpd12s015_probe, - .remove = __exit_p(tpd12s015_remove), + .remove = tpd12s015_remove, .driver = { .name = "tpd12s015", .of_match_table = tpd12s015_of_match, -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
by Luo Gengkun 20 May '24

20 May '24

From: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> mainline inclusion from mainline-v6.8-rc1 commit 024352f7928b28f53609660663329d8c0f4ad032 category: bugfix bugzilla: I9Q9GI CVE: CVE-2023-52694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse. Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter") Signed-off-by: Uwe Kleine-König <u.kleine-koenig(a)pengutronix.de> Signed-off-by: Thomas Zimmermann <tzimmermann(a)suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.k… Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c index e0e015243a60..b588fea12502 100644 --- a/drivers/gpu/drm/bridge/ti-tpd12s015.c +++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c @@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev) return 0; } -static int __exit tpd12s015_remove(struct platform_device *pdev) +static int tpd12s015_remove(struct platform_device *pdev) { struct tpd12s015_device *tpd = platform_get_drvdata(pdev); @@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match); static struct platform_driver tpd12s015_driver = { .probe = tpd12s015_probe, - .remove = __exit_p(tpd12s015_remove), + .remove = tpd12s015_remove, .driver = { .name = "tpd12s015", .of_match_table = tpd12s015_of_match, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
by Luo Gengkun 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> mainline inclusion from mainline-v6.8-rc1 commit category: bugfix bugzilla: 189832 CVE: CVE-2023-52675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> --- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c index 555322677074..65ee4fe863b2 100644 --- a/arch/powerpc/perf/imc-pmu.c +++ b/arch/powerpc/perf/imc-pmu.c @@ -261,6 +261,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue; @@ -268,6 +270,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str; if (pmu->events[i].scale) { ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name); + if (!ev_scale_str) + continue; dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale); if (!dev_str) continue; @@ -277,6 +281,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) if (pmu->events[i].unit) { ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name); + if (!ev_unit_str) + continue; dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit); if (!dev_str) continue; -- 2.34.1

2 1

[PATCH OLK-5.10] powerpc/powernv: Add a null pointer check to scom_debug_init_one()
by Cai Xinchen 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v5.10.209 commit 1eefa93faf69188540b08b024794fa90b1d82e8b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HJ CVE: CVE-2023-52690 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ] kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Add a null pointer check, and release 'ent' to avoid memory leaks. Fixes: bfd2f0d49aef ("powerpc/powernv: Get rid of old scom_controller abstraction") Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://msgid.link/20231208085937.107210-1-chentao@kylinos.cn Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c index fd510d961b8c..d5814c5046ba 100644 --- a/arch/powerpc/platforms/powernv/opal-xscom.c +++ b/arch/powerpc/platforms/powernv/opal-xscom.c @@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn, ent->chip = chip; snprintf(ent->name, 16, "%08x", chip); ent->path.data = (void *)kasprintf(GFP_KERNEL, "%pOF", dn); + if (!ent->path.data) { + kfree(ent); + return -ENOMEM; + } + ent->path.size = strlen((char *)ent->path.data); dir = debugfs_create_dir(ent->name, root); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] LoongArch: fix kdump not work when legacy mode disabled
by Hongchen Zhang 20 May '24

20 May '24

Hongchen Zhang (4): Revert "LoongArch: kdump: Add high memory reservation" Revert "LoongArch: Fix kdump failure on v40 interface specification" Revert "LoongArch: kdump: Add memory reservation for old kernel" LoongArch: fix efi map page table error arch/loongarch/kernel/efi.c | 39 ++++++++++++--- arch/loongarch/kernel/setup.c | 94 +++++------------------------------ 2 files changed, 44 insertions(+), 89 deletions(-) -- 2.33.0

2 5

[PATCH OLK-5.10] f2fs: compress: fix reserve_cblocks counting error when out of space
by Zizhi Wo 20 May '24

20 May '24

From: Xiuhong Wang <xiuhong.wang(a)unisoc.com> stable inclusion from stable-v5.15.153 commit fa3ac8b1a227d9b470b87972494293348b5839ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I8 CVE: CVE-2024-35844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 2f6d721e14b69d6e1251f69fa238b48e8374e25f ] When a file only needs one direct_node, performing the following operations will cause the file to be unrepairable: unisoc # ./f2fs_io compress test.apk unisoc #df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.2M 100% /data unisoc # ./f2fs_io release_cblocks test.apk 924 unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 4.8M 100% /data unisoc # dd if=/dev/random of=file4 bs=1M count=3 3145728 bytes (3.0 M) copied, 0.025 s, 120 M/s unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 0 This is because the file has only one direct_node. After returning to -ENOSPC, reserved_blocks += ret will not be executed. As a result, the reserved_blocks at this time is still 0, which is not the real number of reserved blocks. Therefore, fsck cannot be set to repair the file. After this patch, the fsck flag will be set to fix this problem. unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot then fsck will be executed unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 924 Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS") Signed-off-by: Xiuhong Wang <xiuhong.wang(a)unisoc.com> Signed-off-by: Zhiguo Niu <zhiguo.niu(a)unisoc.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/file.c [Some context inconsistencies exist in the f2fs_reserve_compress_blocks function, which does not affect the patch] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/file.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index 4e6b93f16758..909bb6f09b2e 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -3624,10 +3624,10 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg) return ret; } -static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count) +static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count, + unsigned int *reserved_blocks) { struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode); - unsigned int reserved_blocks = 0; int cluster_size = F2FS_I(dn->inode)->i_cluster_size; block_t blkaddr; int i; @@ -3677,12 +3677,12 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count) f2fs_i_compr_blocks_update(dn->inode, compr_blocks, true); - reserved_blocks += reserved; + *reserved_blocks += reserved; next: count -= cluster_size; } - return reserved_blocks; + return 0; } static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) @@ -3743,7 +3743,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) count = min(end_offset - dn.ofs_in_node, last_idx - page_idx); count = round_up(count, F2FS_I(inode)->i_cluster_size); - ret = reserve_compress_blocks(&dn, count); + ret = reserve_compress_blocks(&dn, count, &reserved_blocks); f2fs_put_dnode(&dn); @@ -3751,13 +3751,12 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) break; page_idx += count; - reserved_blocks += ret; } up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); up_write(&F2FS_I(inode)->i_mmap_sem); - if (ret >= 0) { + if (!ret) { F2FS_I(inode)->i_flags &= ~F2FS_IMMUTABLE_FL; f2fs_set_inode_flags(inode); inode->i_ctime = current_time(inode); @@ -3768,7 +3767,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) out: mnt_drop_write_file(filp); - if (ret >= 0) { + if (!ret) { ret = put_user(reserved_blocks, (u64 __user *)arg); } else if (reserved_blocks && atomic_read(&F2FS_I(inode)->i_compr_blocks)) { -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: compress: fix reserve_cblocks counting error when out of space
by Zizhi Wo 20 May '24

20 May '24

From: Xiuhong Wang <xiuhong.wang(a)unisoc.com> stable inclusion from stable-v5.15.153 commit fa3ac8b1a227d9b470b87972494293348b5839ee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 2f6d721e14b69d6e1251f69fa238b48e8374e25f ] When a file only needs one direct_node, performing the following operations will cause the file to be unrepairable: unisoc # ./f2fs_io compress test.apk unisoc #df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.2M 100% /data unisoc # ./f2fs_io release_cblocks test.apk 924 unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 4.8M 100% /data unisoc # dd if=/dev/random of=file4 bs=1M count=3 3145728 bytes (3.0 M) copied, 0.025 s, 120 M/s unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 0 This is because the file has only one direct_node. After returning to -ENOSPC, reserved_blocks += ret will not be executed. As a result, the reserved_blocks at this time is still 0, which is not the real number of reserved blocks. Therefore, fsck cannot be set to repair the file. After this patch, the fsck flag will be set to fix this problem. unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot then fsck will be executed unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 924 Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS") Signed-off-by: Xiuhong Wang <xiuhong.wang(a)unisoc.com> Signed-off-by: Zhiguo Niu <zhiguo.niu(a)unisoc.com> Reviewed-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/file.c [Some context inconsistencies exist in the f2fs_reserve_compress_blocks function, which does not affect the patch] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/file.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index 4e6b93f16758..909bb6f09b2e 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -3624,10 +3624,10 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg) return ret; } -static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count) +static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count, + unsigned int *reserved_blocks) { struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode); - unsigned int reserved_blocks = 0; int cluster_size = F2FS_I(dn->inode)->i_cluster_size; block_t blkaddr; int i; @@ -3677,12 +3677,12 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count) f2fs_i_compr_blocks_update(dn->inode, compr_blocks, true); - reserved_blocks += reserved; + *reserved_blocks += reserved; next: count -= cluster_size; } - return reserved_blocks; + return 0; } static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) @@ -3743,7 +3743,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) count = min(end_offset - dn.ofs_in_node, last_idx - page_idx); count = round_up(count, F2FS_I(inode)->i_cluster_size); - ret = reserve_compress_blocks(&dn, count); + ret = reserve_compress_blocks(&dn, count, &reserved_blocks); f2fs_put_dnode(&dn); @@ -3751,13 +3751,12 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) break; page_idx += count; - reserved_blocks += ret; } up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); up_write(&F2FS_I(inode)->i_mmap_sem); - if (ret >= 0) { + if (!ret) { F2FS_I(inode)->i_flags &= ~F2FS_IMMUTABLE_FL; f2fs_set_inode_flags(inode); inode->i_ctime = current_time(inode); @@ -3768,7 +3767,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg) out: mnt_drop_write_file(filp); - if (ret >= 0) { + if (!ret) { ret = put_user(reserved_blocks, (u64 __user *)arg); } else if (reserved_blocks && atomic_read(&F2FS_I(inode)->i_compr_blocks)) { -- 2.39.2

2 1

[PATCH OLK-5.10] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
by Yang Yingliang 20 May '24

20 May '24

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> mainline inclusion from mainline-v6.7-rc2 commit 86222a8fc16ec517de8da2604d904c9df3a08e5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9FV CVE: CVE-2023-52685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return 64-bit value since persistent_ram_zone::buffer_size has type size_t which is derived from the 64-bit *unsigned long*, while the ecc_blocks variable this value gets assigned to has (always 32-bit) *int* type. Even if that value fits into *int* type, an overflow is still possible when calculating the size_t typed ecc_total variable further below since there's no cast to any 64-bit type before multiplication. Declaring the ecc_blocks variable as *size_t* should fix this mess... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support") Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index a0fa3820ef2a..5ac9b1f155a8 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, { int numerr; struct persistent_ram_buffer *buffer = prz->buffer; - int ecc_blocks; + size_t ecc_blocks; size_t ecc_total; if (!ecc_info || !ecc_info->ecc_size) -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] LoongArch: fix kdump not work when legacy mode disabled
by Hongchen Zhang 20 May '24

20 May '24

Hongchen Zhang (4): Revert "LoongArch: kdump: Add high memory reservation" Revert "LoongArch: Fix kdump failure on v40 interface specification" Revert "LoongArch: kdump: Add memory reservation for old kernel" LoongArch: fix efi map page table error arch/loongarch/kernel/efi.c | 39 ++++++++++++--- arch/loongarch/kernel/setup.c | 94 +++++------------------------------ 2 files changed, 44 insertions(+), 89 deletions(-) -- 2.33.0

2 6

[PATCH openEuler-1.0-LTS] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
by Yang Yingliang 20 May '24

20 May '24

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> mainline inclusion from mainline-v6.7-rc2 commit 86222a8fc16ec517de8da2604d904c9df3a08e5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9FV CVE: CVE-2023-52685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return 64-bit value since persistent_ram_zone::buffer_size has type size_t which is derived from the 64-bit *unsigned long*, while the ecc_blocks variable this value gets assigned to has (always 32-bit) *int* type. Even if that value fits into *int* type, an overflow is still possible when calculating the size_t typed ecc_total variable further below since there's no cast to any 64-bit type before multiplication. Declaring the ecc_blocks variable as *size_t* should fix this mess... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support") Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index a20fa36184b5..588392e6f531 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -189,7 +189,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, { int numerr; struct persistent_ram_buffer *buffer = prz->buffer; - int ecc_blocks; + size_t ecc_blocks; size_t ecc_total; if (!ecc_info || !ecc_info->ecc_size) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
by Yang Yingliang 20 May '24

20 May '24

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> mainline inclusion from mainline-v6.7-rc2 commit 86222a8fc16ec517de8da2604d904c9df3a08e5d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9Q9FV CVE: CVE-2023-52685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return 64-bit value since persistent_ram_zone::buffer_size has type size_t which is derived from the 64-bit *unsigned long*, while the ecc_blocks variable this value gets assigned to has (always 32-bit) *int* type. Even if that value fits into *int* type, an overflow is still possible when calculating the size_t typed ecc_total variable further below since there's no cast to any 64-bit type before multiplication. Declaring the ecc_blocks variable as *size_t* should fix this mess... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support") Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru Signed-off-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index a20fa36184b5..588392e6f531 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -189,7 +189,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, { int numerr; struct persistent_ram_buffer *buffer = prz->buffer; - int ecc_blocks; + size_t ecc_blocks; size_t ecc_total; if (!ecc_info || !ecc_info->ecc_size) -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] x86/xen: Add some null pointer checking to smp.c
by Yuntao Liu 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v5.10.214 commit eb279074badac0bbe28749906562d648ca4bc750 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK0E CVE: CVE-2024-26908 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3693bb4465e6e32a204a5b86d3ec7e6b9f7e67c2 ] kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. confilct: arch/x86/xen/smp.c Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202401161119.iof6BQsf-lkp@intel.com/ Suggested-by: Markus Elfring <Markus.Elfring(a)web.de> Reviewed-by: Juergen Gross <jgross(a)suse.com> Link: https://lore.kernel.org/r/20240119094948.275390-1-chentao@kylinos.cn Signed-off-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/x86/xen/smp.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c index c1b2f764b29a..ebadcb314fd0 100644 --- a/arch/x86/xen/smp.c +++ b/arch/x86/xen/smp.c @@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) char *resched_name, *callfunc_name, *debug_name; resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); + if (!resched_name) + goto fail_mem; rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, cpu, xen_reschedule_interrupt, @@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) per_cpu(xen_resched_irq, cpu).name = resched_name; callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); + if (!callfunc_name) + goto fail_mem; rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, cpu, xen_call_function_interrupt, @@ -90,6 +94,8 @@ int xen_smp_intr_init(unsigned int cpu) if (!xen_fifo_events) { debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); + if (!debug_name) + goto fail_mem; rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, xen_debug_interrupt, IRQF_PERCPU | IRQF_NOBALANCING, @@ -101,6 +107,8 @@ int xen_smp_intr_init(unsigned int cpu) } callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); + if (!callfunc_name) + goto fail_mem; rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, cpu, xen_call_function_single_interrupt, @@ -114,6 +122,8 @@ int xen_smp_intr_init(unsigned int cpu) return 0; + fail_mem: + rc = -ENOMEM; fail: xen_smp_intr_free(cpu); return rc; -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] LoongArch: fix kdump not work when legacy mode disabled
by Hongchen Zhang 20 May '24

20 May '24

Hongchen Zhang (4): Revert "LoongArch: kdump: Add high memory reservation" Revert "LoongArch: Fix kdump failure on v40 interface specification" Revert "LoongArch: kdump: Add memory reservation for old kernel" LoongArch: fix efi map page table error arch/loongarch/kernel/efi.c | 39 ++++++++++++--- arch/loongarch/kernel/setup.c | 94 +++++------------------------------ 2 files changed, 44 insertions(+), 89 deletions(-) -- 2.33.0

2 5

[PATCH openEuler-22.03-LTS-SP2] x86/xen: Add some null pointer checking to smp.c
by Guo Mengqi 20 May '24

20 May '24

From: Kunwu Chan <chentao(a)kylinos.cn> stable inclusion from stable-v5.10.214 commit eb279074badac0bbe28749906562d648ca4bc750 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK0E CVE: CVE-2024-26908 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3693bb4465e6e32a204a5b86d3ec7e6b9f7e67c2 ] kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Signed-off-by: Kunwu Chan <chentao(a)kylinos.cn> Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202401161119.iof6BQsf-lkp@intel.com/ Suggested-by: Markus Elfring <Markus.Elfring(a)web.de> Reviewed-by: Juergen Gross <jgross(a)suse.com> Link: https://lore.kernel.org/r/20240119094948.275390-1-chentao@kylinos.cn Signed-off-by: Juergen Gross <jgross(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/x86/xen/smp.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c index cdec892b28e2..a641e0d45219 100644 --- a/arch/x86/xen/smp.c +++ b/arch/x86/xen/smp.c @@ -65,6 +65,8 @@ int xen_smp_intr_init(unsigned int cpu) char *resched_name, *callfunc_name, *debug_name; resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); + if (!resched_name) + goto fail_mem; per_cpu(xen_resched_irq, cpu).name = resched_name; rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, cpu, @@ -77,6 +79,8 @@ int xen_smp_intr_init(unsigned int cpu) per_cpu(xen_resched_irq, cpu).irq = rc; callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); + if (!callfunc_name) + goto fail_mem; per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, cpu, @@ -90,6 +94,9 @@ int xen_smp_intr_init(unsigned int cpu) if (!xen_fifo_events) { debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); + if (!debug_name) + goto fail_mem; + per_cpu(xen_debug_irq, cpu).name = debug_name; rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, xen_debug_interrupt, @@ -101,6 +108,9 @@ int xen_smp_intr_init(unsigned int cpu) } callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); + if (!callfunc_name) + goto fail_mem; + per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, cpu, @@ -114,6 +124,8 @@ int xen_smp_intr_init(unsigned int cpu) return 0; + fail_mem: + rc = -ENOMEM; fail: xen_smp_intr_free(cpu); return rc; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] net: hns3: fix kernel crash when 1588 is received on HIP08 devices
by Guo Mengqi 20 May '24

20 May '24

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK8U Reference: https://gitee.com/openeuler/kernel/commit/e318095d78b89cec4f2cb17caa505b7cd… -------------------------------- The HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL, but the hardware can receive 1588 messages, and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the access of hdev->ptp->flags will cause a kernel crash: [ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 [ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge] [ 5889.279101] sp : ffff800012c3bc50 [ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040 [ 5889.289927] x27: ffff800009116484 x26: 0000000080007500 [ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000 [ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000 [ 5889.309134] x21: 0000000000000000 x20: ffff204004220080 [ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000 [ 5889.321897] x17: 0000000000000000 x16: 0000000000000000 [ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000 [ 5889.334617] x13: 0000000000000000 x12: 00000000010011df [ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000 [ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d [ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480 [ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000 [ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000 [ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080 [ 5889.378857] Call trace: [ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3] [ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3] [ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3] [ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3] [ 5889.411084] napi_poll+0xcc/0x264 [ 5889.415329] net_rx_action+0xd4/0x21c [ 5889.419911] __do_softirq+0x130/0x358 [ 5889.424484] irq_exit+0x134/0x154 [ 5889.428700] __handle_domain_irq+0x88/0xf0 [ 5889.433684] gic_handle_irq+0x78/0x2c0 [ 5889.438319] el1_irq+0xb8/0x140 [ 5889.442354] arch_cpu_idle+0x18/0x40 [ 5889.446816] default_idle_call+0x5c/0x1c0 [ 5889.451714] cpuidle_idle_call+0x174/0x1b0 [ 5889.456692] do_idle+0xc8/0x160 [ 5889.460717] cpu_startup_entry+0x30/0xfc [ 5889.465523] secondary_start_kernel+0x158/0x1ec [ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80) [ 5889.477950] SMP: stopping secondary CPUs [ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95 [ 5890.522951] Starting crashdump kernel... Fixes: 56acfb181aba ("net: hns3: add support for PTP") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c index a40b1583f114..0f06f95b09bc 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c @@ -120,7 +120,7 @@ void hclge_ptp_get_rx_hwts(struct hnae3_handle *handle, struct sk_buff *skb, u64 ns = nsec; u32 sec_h; - if (!test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags)) + if (!hdev->ptp || !test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags)) return; /* Since the BD does not have enough space for the higher 16 bits of -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] net: hns3: fix kernel crash when 1588 is received on HIP08 devices
by Guo Mengqi 20 May '24

20 May '24

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK8U Reference: https://gitee.com/openeuler/kernel/commit/e318095d78b89cec4f2cb17caa505b7cd… -------------------------------- The HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL, but the hardware can receive 1588 messages, and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the access of hdev->ptp->flags will cause a kernel crash: [ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 [ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge] [ 5889.279101] sp : ffff800012c3bc50 [ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040 [ 5889.289927] x27: ffff800009116484 x26: 0000000080007500 [ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000 [ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000 [ 5889.309134] x21: 0000000000000000 x20: ffff204004220080 [ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000 [ 5889.321897] x17: 0000000000000000 x16: 0000000000000000 [ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000 [ 5889.334617] x13: 0000000000000000 x12: 00000000010011df [ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000 [ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d [ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480 [ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000 [ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000 [ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080 [ 5889.378857] Call trace: [ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3] [ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3] [ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3] [ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3] [ 5889.411084] napi_poll+0xcc/0x264 [ 5889.415329] net_rx_action+0xd4/0x21c [ 5889.419911] __do_softirq+0x130/0x358 [ 5889.424484] irq_exit+0x134/0x154 [ 5889.428700] __handle_domain_irq+0x88/0xf0 [ 5889.433684] gic_handle_irq+0x78/0x2c0 [ 5889.438319] el1_irq+0xb8/0x140 [ 5889.442354] arch_cpu_idle+0x18/0x40 [ 5889.446816] default_idle_call+0x5c/0x1c0 [ 5889.451714] cpuidle_idle_call+0x174/0x1b0 [ 5889.456692] do_idle+0xc8/0x160 [ 5889.460717] cpu_startup_entry+0x30/0xfc [ 5889.465523] secondary_start_kernel+0x158/0x1ec [ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80) [ 5889.477950] SMP: stopping secondary CPUs [ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95 [ 5890.522951] Starting crashdump kernel... Fixes: 56acfb181aba ("net: hns3: add support for PTP") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c index a40b1583f114..0f06f95b09bc 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c @@ -120,7 +120,7 @@ void hclge_ptp_get_rx_hwts(struct hnae3_handle *handle, struct sk_buff *skb, u64 ns = nsec; u32 sec_h; - if (!test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags)) + if (!hdev->ptp || !test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags)) return; /* Since the BD does not have enough space for the higher 16 bits of -- 2.17.1

2 1