- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] net: netfilter: Fix CVE-2024-50038
by Dong Chenchen 22 Nov '24

22 Nov '24

fix CVE-2024-50038 Florian Westphal (1): netfilter: xtables: avoid NFPROTO_UNSPEC where needed Pablo Neira Ayuso (1): netfilter: xtables: fix typo causing some targets not to load on IPv6 net/netfilter/xt_CHECKSUM.c | 33 +++++++--- net/netfilter/xt_CLASSIFY.c | 16 ++++- net/netfilter/xt_CONNSECMARK.c | 36 +++++++---- net/netfilter/xt_CT.c | 111 ++++++++++++++++++++++----------- net/netfilter/xt_IDLETIMER.c | 59 ++++++++++++------ net/netfilter/xt_LED.c | 39 ++++++++---- net/netfilter/xt_NFLOG.c | 36 +++++++---- net/netfilter/xt_RATEEST.c | 39 ++++++++---- net/netfilter/xt_SECMARK.c | 27 +++++++- net/netfilter/xt_TRACE.c | 36 +++++++---- net/netfilter/xt_addrtype.c | 15 ++++- net/netfilter/xt_cluster.c | 33 +++++++--- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 ++++++++---- net/netfilter/xt_connmark.c | 28 ++++++++- net/netfilter/xt_mark.c | 42 ++++++++++--- 16 files changed, 427 insertions(+), 166 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-22.03-LTS-SP1 0/2] net: netfilter: Fix CVE-2024-50038
by Dong Chenchen 22 Nov '24

22 Nov '24

fix CVE-2024-50038 Florian Westphal (1): netfilter: xtables: avoid NFPROTO_UNSPEC where needed Pablo Neira Ayuso (1): netfilter: xtables: fix typo causing some targets not to load on IPv6 net/netfilter/xt_CHECKSUM.c | 33 +++++++--- net/netfilter/xt_CLASSIFY.c | 16 ++++- net/netfilter/xt_CONNSECMARK.c | 36 +++++++---- net/netfilter/xt_CT.c | 111 ++++++++++++++++++++++----------- net/netfilter/xt_IDLETIMER.c | 59 ++++++++++++------ net/netfilter/xt_LED.c | 39 ++++++++---- net/netfilter/xt_NFLOG.c | 36 +++++++---- net/netfilter/xt_RATEEST.c | 39 ++++++++---- net/netfilter/xt_SECMARK.c | 27 +++++++- net/netfilter/xt_TRACE.c | 36 +++++++---- net/netfilter/xt_addrtype.c | 15 ++++- net/netfilter/xt_cluster.c | 33 +++++++--- net/netfilter/xt_connbytes.c | 4 +- net/netfilter/xt_connlimit.c | 39 ++++++++---- net/netfilter/xt_connmark.c | 28 ++++++++- net/netfilter/xt_mark.c | 42 ++++++++++--- 16 files changed, 427 insertions(+), 166 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] RDMA/cxgb4: Added NULL check for lookup_atid
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Mikhail Lobanov <m.lobanov(a)rosalinux.ru> stable inclusion from stable-v5.10.227 commit dd598ac57dcae796cb58551074660c39b43fb155 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQRV CVE: CVE-2024-47749 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e766e6a92410ca269161de059fff0843b8ddd65f ] The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Add a NULL check to prevent null pointer dereferencing. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC") Signed-off-by: Mikhail Lobanov <m.lobanov(a)rosalinux.ru> Link: https://patch.msgid.link/20240912145844.77516-1-m.lobanov@rosalinux.ru Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/infiniband/hw/cxgb4/cm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index 8c54b1be0442..95300b2e1ffe 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -1222,6 +1222,8 @@ static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb) int ret; ep = lookup_atid(t, atid); + if (!ep) + return -EINVAL; pr_debug("ep %p tid %u snd_isn %u rcv_isn %u\n", ep, tid, be32_to_cpu(req->snd_isn), be32_to_cpu(req->rcv_isn)); @@ -2279,6 +2281,9 @@ static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb) int ret = 0; ep = lookup_atid(t, atid); + if (!ep) + return -EINVAL; + la = (struct sockaddr_in *)&ep->com.local_addr; ra = (struct sockaddr_in *)&ep->com.remote_addr; la6 = (struct sockaddr_in6 *)&ep->com.local_addr; -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Kaixin Wang <kxwang23(a)m.fudan.edu.cn> stable inclusion from stable-v5.10.227 commit 338a0582b28e69460df03af50e938b86b4206353 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQS4 CVE: CVE-2024-47747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b5109b60ee4fcb2f2bb24f589575e10cc5283ad4 ] In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ether3_ledoff ether3_remove | free_netdev(dev); | put_devic | kfree(dev); | | ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2); | // use dev Fix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove. Fixes: 6fd9c53f7186 ("net: seeq: Convert timers to use timer_setup()") Signed-off-by: Kaixin Wang <kxwang23(a)m.fudan.edu.cn> Link: https://patch.msgid.link/20240915144045.451-1-kxwang23@m.fudan.edu.cn Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/seeq/ether3.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/seeq/ether3.c b/drivers/net/ethernet/seeq/ether3.c index 65c98837ec45..3d4a86bf8fd1 100644 --- a/drivers/net/ethernet/seeq/ether3.c +++ b/drivers/net/ethernet/seeq/ether3.c @@ -845,9 +845,11 @@ static void ether3_remove(struct expansion_card *ec) { struct net_device *dev = ecard_get_drvdata(ec); + ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2); ecard_set_drvdata(ec, NULL); unregister_netdev(dev); + del_timer_sync(&priv(dev)->timer); free_netdev(dev); ecard_release_resources(ec); } -- 2.25.1

2 3

[PATCH OLK-6.6] netfilter: br_netfilter: fix panic with metadata_dst skb
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Andy Roulin <aroulin(a)nvidia.com> stable inclusion from stable-v6.6.57 commit 3453f5839420bfbb85c86c61e49f49ffd0f041c4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYREA CVE: CVE-2024-50045 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f9ff7665cd128012868098bbd07e28993e314fdb ] Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit. It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge-nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL. Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu. The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst->dev, thus the crash. This case was never supported in the first place, so drop the packet instead. PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [ 176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [ 176.292101] Mem abort info: [ 176.292184] ESR = 0x0000000096000004 [ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits [ 176.292530] SET = 0, FnV = 0 [ 176.292709] EA = 0, S1PTW = 0 [ 176.292862] FSC = 0x04: level 0 translation fault [ 176.293013] Data abort info: [ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [ 176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [ 176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [ 176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [ 176.296314] Hardware name: linux,dummy-virt (DT) [ 176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [ 176.297636] sp : ffff800080003630 [ 176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [ 176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [ 176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [ 176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [ 176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [ 176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [ 176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [ 176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [ 176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [ 176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [ 176.300889] Call trace: [ 176.301123] br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.301411] br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [ 176.301703] nf_hook_slow+0x48/0x124 [ 176.302060] br_forward_finish+0xc8/0xe8 [bridge] [ 176.302371] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.302605] br_nf_forward_finish+0x118/0x22c [br_netfilter] [ 176.302824] br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [ 176.303136] br_nf_forward+0x2b8/0x4e0 [br_netfilter] [ 176.303359] nf_hook_slow+0x48/0x124 [ 176.303803] __br_forward+0xc4/0x194 [bridge] [ 176.304013] br_flood+0xd4/0x168 [bridge] [ 176.304300] br_handle_frame_finish+0x1d4/0x5c4 [bridge] [ 176.304536] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.304978] br_nf_pre_routing_finish+0x29c/0x494 [br_netfilter] [ 176.305188] br_nf_pre_routing+0x250/0x524 [br_netfilter] [ 176.305428] br_handle_frame+0x244/0x3cc [bridge] [ 176.305695] __netif_receive_skb_core.constprop.0+0x33c/0xecc [ 176.306080] __netif_receive_skb_one_core+0x40/0x8c [ 176.306197] __netif_receive_skb+0x18/0x64 [ 176.306369] process_backlog+0x80/0x124 [ 176.306540] __napi_poll+0x38/0x17c [ 176.306636] net_rx_action+0x124/0x26c [ 176.306758] __do_softirq+0x100/0x26c [ 176.307051] ____do_softirq+0x10/0x1c [ 176.307162] call_on_irq_stack+0x24/0x4c [ 176.307289] do_softirq_own_stack+0x1c/0x2c [ 176.307396] do_softirq+0x54/0x6c [ 176.307485] __local_bh_enable_ip+0x8c/0x98 [ 176.307637] __dev_queue_xmit+0x22c/0xd28 [ 176.307775] neigh_resolve_output+0xf4/0x1a0 [ 176.308018] ip_finish_output2+0x1c8/0x628 [ 176.308137] ip_do_fragment+0x5b4/0x658 [ 176.308279] ip_fragment.constprop.0+0x48/0xec [ 176.308420] __ip_finish_output+0xa4/0x254 [ 176.308593] ip_finish_output+0x34/0x130 [ 176.308814] ip_output+0x6c/0x108 [ 176.308929] ip_send_skb+0x50/0xf0 [ 176.309095] ip_push_pending_frames+0x30/0x54 [ 176.309254] raw_sendmsg+0x758/0xaec [ 176.309568] inet_sendmsg+0x44/0x70 [ 176.309667] __sys_sendto+0x110/0x178 [ 176.309758] __arm64_sys_sendto+0x28/0x38 [ 176.309918] invoke_syscall+0x48/0x110 [ 176.310211] el0_svc_common.constprop.0+0x40/0xe0 [ 176.310353] do_el0_svc+0x1c/0x28 [ 176.310434] el0_svc+0x34/0xb4 [ 176.310551] el0t_64_sync_handler+0x120/0x12c [ 176.310690] el0t_64_sync+0x190/0x194 [ 176.311066] Code: f9402e61 79402aa2 927ff821 f9400023 (f9408860) [ 176.315743] ---[ end trace 0000000000000000 ]--- [ 176.316060] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 176.316371] Kernel Offset: 0x37e0e3000000 from 0xffff800080000000 [ 176.316564] PHYS_OFFSET: 0xffff97d780000000 [ 176.316782] CPU features: 0x0,88000203,3c020000,0100421b [ 176.317210] Memory Limit: none [ 176.317527] ---[ end Kernel panic - not syncing: Oops: Fatal Exception in interrupt ]---\ Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths") Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Signed-off-by: Andy Roulin <aroulin(a)nvidia.com> Acked-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20241001154400.22787-2-aroulin@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bridge/br_netfilter_hooks.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c index 68d553861303..a1cfa75bbadb 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -33,6 +33,7 @@ #include <net/ip.h> #include <net/ipv6.h> #include <net/addrconf.h> +#include <net/dst_metadata.h> #include <net/route.h> #include <net/netfilter/br_netfilter.h> #include <net/netns/generic.h> @@ -871,6 +872,10 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff return br_dev_queue_push_xmit(net, sk, skb); } + /* Fragmentation on metadata/template dst is not supported */ + if (unlikely(!skb_valid_dst(skb))) + goto drop; + /* This is wrong! We should preserve the original fragment * boundaries by preserving frag_list rather than refragmenting. */ -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: br_netfilter: fix panic with metadata_dst skb
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Andy Roulin <aroulin(a)nvidia.com> stable inclusion from stable-v5.10.227 commit cce8419b8168f6e7eb637103a47f916f3de8bc81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYREA CVE: CVE-2024-50045 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f9ff7665cd128012868098bbd07e28993e314fdb ] Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit. It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge-nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL. Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu. The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst->dev, thus the crash. This case was never supported in the first place, so drop the packet instead. PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [ 176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [ 176.292101] Mem abort info: [ 176.292184] ESR = 0x0000000096000004 [ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits [ 176.292530] SET = 0, FnV = 0 [ 176.292709] EA = 0, S1PTW = 0 [ 176.292862] FSC = 0x04: level 0 translation fault [ 176.293013] Data abort info: [ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [ 176.294166] [0000000000000110] pgd=0000000000000000, p4d=0000000000000000 [ 176.294827] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 176.295252] Modules linked in: vxlan ip6_udp_tunnel udp_tunnel veth br_netfilter bridge stp llc ipv6 crct10dif_ce [ 176.295923] CPU: 0 PID: 188 Comm: ping Not tainted 6.8.0-rc3-g5b3fbd61b9d1 #2 [ 176.296314] Hardware name: linux,dummy-virt (DT) [ 176.296535] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 176.296808] pc : br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.297382] lr : br_nf_dev_queue_xmit+0x2ac/0x4ec [br_netfilter] [ 176.297636] sp : ffff800080003630 [ 176.297743] x29: ffff800080003630 x28: 0000000000000008 x27: ffff6828c49ad9f8 [ 176.298093] x26: ffff6828c49ad000 x25: 0000000000000000 x24: 00000000000003e8 [ 176.298430] x23: 0000000000000000 x22: ffff6828c4960b40 x21: ffff6828c3b16d28 [ 176.298652] x20: ffff6828c3167048 x19: ffff6828c3b16d00 x18: 0000000000000014 [ 176.298926] x17: ffffb0476322f000 x16: ffffb7e164023730 x15: 0000000095744632 [ 176.299296] x14: ffff6828c3f1c880 x13: 0000000000000002 x12: ffffb7e137926a70 [ 176.299574] x11: 0000000000000001 x10: ffff6828c3f1c898 x9 : 0000000000000000 [ 176.300049] x8 : ffff6828c49bf070 x7 : 0008460f18d5f20e x6 : f20e0100bebafeca [ 176.300302] x5 : ffff6828c7f918fe x4 : ffff6828c49bf070 x3 : 0000000000000000 [ 176.300586] x2 : 0000000000000000 x1 : ffff6828c3c7ad00 x0 : ffff6828c7f918f0 [ 176.300889] Call trace: [ 176.301123] br_nf_dev_queue_xmit+0x390/0x4ec [br_netfilter] [ 176.301411] br_nf_post_routing+0x2a8/0x3e4 [br_netfilter] [ 176.301703] nf_hook_slow+0x48/0x124 [ 176.302060] br_forward_finish+0xc8/0xe8 [bridge] [ 176.302371] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.302605] br_nf_forward_finish+0x118/0x22c [br_netfilter] [ 176.302824] br_nf_forward_ip.part.0+0x264/0x290 [br_netfilter] [ 176.303136] br_nf_forward+0x2b8/0x4e0 [br_netfilter] [ 176.303359] nf_hook_slow+0x48/0x124 [ 176.303803] __br_forward+0xc4/0x194 [bridge] [ 176.304013] br_flood+0xd4/0x168 [bridge] [ 176.304300] br_handle_frame_finish+0x1d4/0x5c4 [bridge] [ 176.304536] br_nf_hook_thresh+0x124/0x134 [br_netfilter] [ 176.304978] br_nf_pre_routing_finish+0x29c/0x494 [br_netfilter] [ 176.305188] br_nf_pre_routing+0x250/0x524 [br_netfilter] [ 176.305428] br_handle_frame+0x244/0x3cc [bridge] [ 176.305695] __netif_receive_skb_core.constprop.0+0x33c/0xecc [ 176.306080] __netif_receive_skb_one_core+0x40/0x8c [ 176.306197] __netif_receive_skb+0x18/0x64 [ 176.306369] process_backlog+0x80/0x124 [ 176.306540] __napi_poll+0x38/0x17c [ 176.306636] net_rx_action+0x124/0x26c [ 176.306758] __do_softirq+0x100/0x26c [ 176.307051] ____do_softirq+0x10/0x1c [ 176.307162] call_on_irq_stack+0x24/0x4c [ 176.307289] do_softirq_own_stack+0x1c/0x2c [ 176.307396] do_softirq+0x54/0x6c [ 176.307485] __local_bh_enable_ip+0x8c/0x98 [ 176.307637] __dev_queue_xmit+0x22c/0xd28 [ 176.307775] neigh_resolve_output+0xf4/0x1a0 [ 176.308018] ip_finish_output2+0x1c8/0x628 [ 176.308137] ip_do_fragment+0x5b4/0x658 [ 176.308279] ip_fragment.constprop.0+0x48/0xec [ 176.308420] __ip_finish_output+0xa4/0x254 [ 176.308593] ip_finish_output+0x34/0x130 [ 176.308814] ip_output+0x6c/0x108 [ 176.308929] ip_send_skb+0x50/0xf0 [ 176.309095] ip_push_pending_frames+0x30/0x54 [ 176.309254] raw_sendmsg+0x758/0xaec [ 176.309568] inet_sendmsg+0x44/0x70 [ 176.309667] __sys_sendto+0x110/0x178 [ 176.309758] __arm64_sys_sendto+0x28/0x38 [ 176.309918] invoke_syscall+0x48/0x110 [ 176.310211] el0_svc_common.constprop.0+0x40/0xe0 [ 176.310353] do_el0_svc+0x1c/0x28 [ 176.310434] el0_svc+0x34/0xb4 [ 176.310551] el0t_64_sync_handler+0x120/0x12c [ 176.310690] el0t_64_sync+0x190/0x194 [ 176.311066] Code: f9402e61 79402aa2 927ff821 f9400023 (f9408860) [ 176.315743] ---[ end trace 0000000000000000 ]--- [ 176.316060] Kernel panic - not syncing: Oops: Fatal exception in interrupt [ 176.316371] Kernel Offset: 0x37e0e3000000 from 0xffff800080000000 [ 176.316564] PHYS_OFFSET: 0xffff97d780000000 [ 176.316782] CPU features: 0x0,88000203,3c020000,0100421b [ 176.317210] Memory Limit: none [ 176.317527] ---[ end Kernel panic - not syncing: Oops: Fatal Exception in interrupt ]---\ Fixes: 11538d039ac6 ("bridge: vlan dst_metadata hooks in ingress and egress paths") Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Signed-off-by: Andy Roulin <aroulin(a)nvidia.com> Acked-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20241001154400.22787-2-aroulin@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bridge/br_netfilter_hooks.c [br_nf_dev_queue_xmit() line num in the patch is different from that in the current version.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bridge/br_netfilter_hooks.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c index a65a77eb740d..56bf93358974 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -33,6 +33,7 @@ #include <net/ip.h> #include <net/ipv6.h> #include <net/addrconf.h> +#include <net/dst_metadata.h> #include <net/route.h> #include <net/netfilter/br_netfilter.h> #include <net/netns/generic.h> @@ -865,6 +866,10 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff return br_dev_queue_push_xmit(net, sk, skb); } + /* Fragmentation on metadata/template dst is not supported */ + if (unlikely(!skb_valid_dst(skb))) + goto drop; + /* This is wrong! We should preserve the original fragment * boundaries by preserving frag_list rather than refragmenting. */ -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] netfilter: nf_tables: prevent nf_skb_duplicated corruption
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit 531754952f5dfc4b141523088147071d6e6112c4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCL CVE: CVE-2024-49952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 92ceba94de6fb4cee2bf40b485979c342f44a492 ] syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1]. Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well. [1] BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK> Fixes: d877f07112f1 ("netfilter: nf_tables: add nft_dup expression") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +++++-- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/net/ipv4/netfilter/nf_dup_ipv4.c b/net/ipv4/netfilter/nf_dup_ipv4.c index 6cc5743c553a..9a21175693db 100644 --- a/net/ipv4/netfilter/nf_dup_ipv4.c +++ b/net/ipv4/netfilter/nf_dup_ipv4.c @@ -52,8 +52,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, { struct iphdr *iph; + local_bh_disable(); if (this_cpu_read(nf_skb_duplicated)) - return; + goto out; /* * Copy the skb, and route the copy. Will later return %XT_CONTINUE for * the original skb, which should continue on its way as if nothing has @@ -61,7 +62,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, */ skb = pskb_copy(skb, GFP_ATOMIC); if (skb == NULL) - return; + goto out; #if IS_ENABLED(CONFIG_NF_CONNTRACK) /* Avoid counting cloned packets towards the original connection. */ @@ -90,6 +91,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, } else { kfree_skb(skb); } +out: + local_bh_enable(); } EXPORT_SYMBOL_GPL(nf_dup_ipv4); diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c index a0a2de30be3e..0c39c77fe8a8 100644 --- a/net/ipv6/netfilter/nf_dup_ipv6.c +++ b/net/ipv6/netfilter/nf_dup_ipv6.c @@ -47,11 +47,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb, void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, const struct in6_addr *gw, int oif) { + local_bh_disable(); if (this_cpu_read(nf_skb_duplicated)) - return; + goto out; skb = pskb_copy(skb, GFP_ATOMIC); if (skb == NULL) - return; + goto out; #if IS_ENABLED(CONFIG_NF_CONNTRACK) nf_reset_ct(skb); @@ -69,6 +70,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, } else { kfree_skb(skb); } +out: + local_bh_enable(); } EXPORT_SYMBOL_GPL(nf_dup_ipv6); -- 2.25.1

2 3

[PATCH OLK-6.6] netfilter: nf_tables: prevent nf_skb_duplicated corruption
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.55 commit 4e3542f40f3a94efa59ea328e307c50601ed7065 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCL CVE: CVE-2024-49952 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 92ceba94de6fb4cee2bf40b485979c342f44a492 ] syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1]. Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well. [1] BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK> Fixes: d877f07112f1 ("netfilter: nf_tables: add nft_dup expression") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +++++-- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/net/ipv4/netfilter/nf_dup_ipv4.c b/net/ipv4/netfilter/nf_dup_ipv4.c index 6cc5743c553a..9a21175693db 100644 --- a/net/ipv4/netfilter/nf_dup_ipv4.c +++ b/net/ipv4/netfilter/nf_dup_ipv4.c @@ -52,8 +52,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, { struct iphdr *iph; + local_bh_disable(); if (this_cpu_read(nf_skb_duplicated)) - return; + goto out; /* * Copy the skb, and route the copy. Will later return %XT_CONTINUE for * the original skb, which should continue on its way as if nothing has @@ -61,7 +62,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, */ skb = pskb_copy(skb, GFP_ATOMIC); if (skb == NULL) - return; + goto out; #if IS_ENABLED(CONFIG_NF_CONNTRACK) /* Avoid counting cloned packets towards the original connection. */ @@ -90,6 +91,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, } else { kfree_skb(skb); } +out: + local_bh_enable(); } EXPORT_SYMBOL_GPL(nf_dup_ipv4); diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c index a0a2de30be3e..0c39c77fe8a8 100644 --- a/net/ipv6/netfilter/nf_dup_ipv6.c +++ b/net/ipv6/netfilter/nf_dup_ipv6.c @@ -47,11 +47,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb, void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, const struct in6_addr *gw, int oif) { + local_bh_disable(); if (this_cpu_read(nf_skb_duplicated)) - return; + goto out; skb = pskb_copy(skb, GFP_ATOMIC); if (skb == NULL) - return; + goto out; #if IS_ENABLED(CONFIG_NF_CONNTRACK) nf_reset_ct(skb); @@ -69,6 +70,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, } else { kfree_skb(skb); } +out: + local_bh_enable(); } EXPORT_SYMBOL_GPL(nf_dup_ipv6); -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: iwlwifi: mvm: avoid NULL pointer dereference
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> stable inclusion from stable-v6.6.55 commit 6dcadb2ed3b76623ab96e3e7fbeda1a374d01c28 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCA CVE: CVE-2024-49929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 557a6cd847645e667f3b362560bd7e7c09aac284 ] iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer. If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer. Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn't either. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Reviewed-by: Johannes Berg <johannes.berg(a)intel.com> Link: https://patch.msgid.link/20240825191257.880921ce23b7.I340052d70ab6d3410724c… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 3adb1acc0719..ce5f2bdde138 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -1145,6 +1145,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, bool is_ampdu = false; int hdrlen; + if (WARN_ON_ONCE(!sta)) + return -1; + mvmsta = iwl_mvm_sta_from_mac80211(sta); fc = hdr->frame_control; hdrlen = ieee80211_hdrlen(fc); @@ -1152,9 +1155,6 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc)) return -1; - if (WARN_ON_ONCE(!mvmsta)) - return -1; - if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_MVM_INVALID_STA)) return -1; @@ -1285,7 +1285,7 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, struct ieee80211_sta *sta) { - struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + struct iwl_mvm_sta *mvmsta; struct ieee80211_tx_info info; struct sk_buff_head mpdus_skbs; struct ieee80211_vif *vif; @@ -1294,9 +1294,11 @@ int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, struct sk_buff *orig_skb = skb; const u8 *addr3; - if (WARN_ON_ONCE(!mvmsta)) + if (WARN_ON_ONCE(!sta)) return -1; + mvmsta = iwl_mvm_sta_from_mac80211(sta); + if (WARN_ON_ONCE(mvmsta->deflink.sta_id == IWL_MVM_INVALID_STA)) return -1; -- 2.25.1

2 1

[PATCH OLK-5.10] wifi: iwlwifi: mvm: avoid NULL pointer dereference
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> mainline inclusion from mainline-v6.12-rc1 commit 557a6cd847645e667f3b362560bd7e7c09aac284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCA CVE: CVE-2024-49929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer. If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer. Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn't either. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Reviewed-by: Johannes Berg <johannes.berg(a)intel.com> Link: https://patch.msgid.link/20240825191257.880921ce23b7.I340052d70ab6d3410724c… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: drivers/net/wireless/intel/iwlwifi/mvm/tx.c [commit c8ee33e184e4("wifi: iwlwifi: mvm: sta preparation for MLO") add struct iwl_mvm_link_sta deflink to mvmsta, which not merged lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 99150fec151b..af9c55b57d25 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -1076,6 +1076,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, bool is_ampdu = false; int hdrlen; + if (WARN_ON_ONCE(!sta)) + return -1; + mvmsta = iwl_mvm_sta_from_mac80211(sta); fc = hdr->frame_control; hdrlen = ieee80211_hdrlen(fc); @@ -1083,9 +1086,6 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc)) return -1; - if (WARN_ON_ONCE(!mvmsta)) - return -1; - if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA)) return -1; @@ -1202,16 +1202,18 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, struct ieee80211_sta *sta) { - struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + struct iwl_mvm_sta *mvmsta; struct ieee80211_tx_info info; struct sk_buff_head mpdus_skbs; unsigned int payload_len; int ret; struct sk_buff *orig_skb = skb; - if (WARN_ON_ONCE(!mvmsta)) + if (WARN_ON_ONCE(!sta)) return -1; + mvmsta = iwl_mvm_sta_from_mac80211(sta); + if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA)) return -1; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: iwlwifi: mvm: avoid NULL pointer dereference
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> mainline inclusion from mainline-v6.12-rc1 commit 557a6cd847645e667f3b362560bd7e7c09aac284 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCA CVE: CVE-2024-49929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- iwl_mvm_tx_skb_sta() and iwl_mvm_tx_mpdu() verify that the mvmvsta pointer is not NULL. It retrieves this pointer using iwl_mvm_sta_from_mac80211, which is dereferencing the ieee80211_sta pointer. If sta is NULL, iwl_mvm_sta_from_mac80211 will dereference a NULL pointer. Fix this by checking the sta pointer before retrieving the mvmsta from it. If sta is not NULL, then mvmsta isn't either. Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Reviewed-by: Johannes Berg <johannes.berg(a)intel.com> Link: https://patch.msgid.link/20240825191257.880921ce23b7.I340052d70ab6d3410724c… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: drivers/net/wireless/intel/iwlwifi/mvm/tx.c [commit c8ee33e184e4("wifi: iwlwifi: mvm: sta preparation for MLO") add struct iwl_mvm_link_sta deflink to mvmsta, which not merged lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 7186e1dbbd6b..dd6de0b58988 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -1072,6 +1072,9 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, bool is_ampdu = false; int hdrlen; + if (WARN_ON_ONCE(!sta)) + return -1; + mvmsta = iwl_mvm_sta_from_mac80211(sta); fc = hdr->frame_control; hdrlen = ieee80211_hdrlen(fc); @@ -1079,9 +1082,6 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, if (IWL_MVM_NON_TRANSMITTING_AP && ieee80211_is_probe_resp(fc)) return -1; - if (WARN_ON_ONCE(!mvmsta)) - return -1; - if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA)) return -1; @@ -1198,15 +1198,17 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb, int iwl_mvm_tx_skb_sta(struct iwl_mvm *mvm, struct sk_buff *skb, struct ieee80211_sta *sta) { - struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + struct iwl_mvm_sta *mvmsta; struct ieee80211_tx_info info; struct sk_buff_head mpdus_skbs; unsigned int payload_len; int ret; - if (WARN_ON_ONCE(!mvmsta)) + if (WARN_ON_ONCE(!sta)) return -1; + mvmsta = iwl_mvm_sta_from_mac80211(sta); + if (WARN_ON_ONCE(mvmsta->sta_id == IWL_MVM_INVALID_STA)) return -1; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] xen-netfront: Fix NULL sring after live migration
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Lin Liu <lin.liu(a)citrix.com> stable inclusion from stable-v5.10.159 commit e6860c889f4ad50b6ab696f5ea154295d72cf27a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIT CVE: CVE-2022-48969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d50b7914fae04d840ce36491d22133070b18cca9 ] A NAPI is setup for each network sring to poll data to kernel The sring with source host is destroyed before live migration and new sring with target host is setup after live migration. The NAPI for the old sring is not deleted until setup new sring with target host after migration. With busy_poll/busy_read enabled, the NAPI can be polled before got deleted when resume VM. BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: xennet_poll+0xae/0xd20 PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI Call Trace: finish_task_switch+0x71/0x230 timerqueue_del+0x1d/0x40 hrtimer_try_to_cancel+0xb5/0x110 xennet_alloc_rx_buffers+0x2a0/0x2a0 napi_busy_loop+0xdb/0x270 sock_poll+0x87/0x90 do_sys_poll+0x26f/0x580 tracing_map_insert+0x1d4/0x2f0 event_hist_trigger+0x14a/0x260 finish_task_switch+0x71/0x230 __schedule+0x256/0x890 recalc_sigpending+0x1b/0x50 xen_sched_clock+0x15/0x20 __rb_reserve_next+0x12d/0x140 ring_buffer_lock_reserve+0x123/0x3d0 event_triggers_call+0x87/0xb0 trace_event_buffer_commit+0x1c4/0x210 xen_clocksource_get_cycles+0x15/0x20 ktime_get_ts64+0x51/0xf0 SyS_ppoll+0x160/0x1a0 SyS_ppoll+0x160/0x1a0 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x41/0xa6 ... RIP: xennet_poll+0xae/0xd20 RSP: ffffb4f041933900 CR2: 0000000000000008 ---[ end trace f8601785b354351c ]--- xen frontend should remove the NAPIs for the old srings before live migration as the bond srings are destroyed There is a tiny window between the srings are set to NULL and the NAPIs are disabled, It is safe as the NAPI threads are still frozen at that time Signed-off-by: Lin Liu <lin.liu(a)citrix.com> Fixes: 4ec2411980d0 ([NET]: Do not check netif_running() and carrier state in ->poll()) Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/xen-netfront.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index 823272838ed6..819b4e68afc1 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -1869,6 +1869,12 @@ static int netfront_resume(struct xenbus_device *dev) netif_tx_unlock_bh(info->netdev); xennet_disconnect_backend(info); + + rtnl_lock(); + if (info->queues) + xennet_destroy_queues(info); + rtnl_unlock(); + return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Chengchang Tang <tangchengchang(a)huawei.com> stable inclusion from stable-v5.10.227 commit 07f0f643d7e570dbe8ef6f5c3367a43e3086a335 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQRU CVE: CVE-2024-47735 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74d315b5af180220d561684d15897730135733a6 ] Fix missuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was hold. This was discovered through the lock debugging, and the corresponding log is as follows: raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 96 PID: 2074 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x30/0x40 ... Call trace: warn_bogus_irq_restore+0x30/0x40 _raw_spin_unlock_irqrestore+0x84/0xc8 add_qp_to_list+0x11c/0x148 [hns_roce_hw_v2] hns_roce_create_qp_common.constprop.0+0x240/0x780 [hns_roce_hw_v2] hns_roce_create_qp+0x98/0x160 [hns_roce_hw_v2] create_qp+0x138/0x258 ib_create_qp_kernel+0x50/0xe8 create_mad_qp+0xa8/0x128 ib_mad_port_open+0x218/0x448 ib_mad_init_device+0x70/0x1f8 add_client_context+0xfc/0x220 enable_device_and_get+0xd0/0x140 ib_register_device.part.0+0xf4/0x1c8 ib_register_device+0x34/0x50 hns_roce_register_device+0x174/0x3d0 [hns_roce_hw_v2] hns_roce_init+0xfc/0x2c0 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x7c/0x1d0 [hns_roce_hw_v2] hns_roce_hw_v2_init_instance+0x9c/0x180 [hns_roce_hw_v2] Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20240906093444.3571619-6-huangjunxian6@hisilicon.c… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_qp.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c index def237557a49..b81291a2eab7 100644 --- a/drivers/infiniband/hw/hns/hns_roce_qp.c +++ b/drivers/infiniband/hw/hns/hns_roce_qp.c @@ -1496,19 +1496,19 @@ void hns_roce_lock_cqs(struct hns_roce_cq *send_cq, struct hns_roce_cq *recv_cq) __acquire(&send_cq->lock); __acquire(&recv_cq->lock); } else if (unlikely(send_cq != NULL && recv_cq == NULL)) { - spin_lock_irq(&send_cq->lock); + spin_lock(&send_cq->lock); __acquire(&recv_cq->lock); } else if (unlikely(send_cq == NULL && recv_cq != NULL)) { - spin_lock_irq(&recv_cq->lock); + spin_lock(&recv_cq->lock); __acquire(&send_cq->lock); } else if (send_cq == recv_cq) { - spin_lock_irq(&send_cq->lock); + spin_lock(&send_cq->lock); __acquire(&recv_cq->lock); } else if (send_cq->cqn < recv_cq->cqn) { - spin_lock_irq(&send_cq->lock); + spin_lock(&send_cq->lock); spin_lock_nested(&recv_cq->lock, SINGLE_DEPTH_NESTING); } else { - spin_lock_irq(&recv_cq->lock); + spin_lock(&recv_cq->lock); spin_lock_nested(&send_cq->lock, SINGLE_DEPTH_NESTING); } } @@ -1528,13 +1528,13 @@ void hns_roce_unlock_cqs(struct hns_roce_cq *send_cq, spin_unlock(&recv_cq->lock); } else if (send_cq == recv_cq) { __release(&recv_cq->lock); - spin_unlock_irq(&send_cq->lock); + spin_unlock(&send_cq->lock); } else if (send_cq->cqn < recv_cq->cqn) { spin_unlock(&recv_cq->lock); - spin_unlock_irq(&send_cq->lock); + spin_unlock(&send_cq->lock); } else { spin_unlock(&send_cq->lock); - spin_unlock_irq(&recv_cq->lock); + spin_unlock(&recv_cq->lock); } } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Ding Hui <dinghui(a)sangfor.com.cn> stable inclusion from stable-v5.10.188 commit cd5ec3ee52ce4b7e283cc11facfa420c297c8065 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0UX CVE: CVE-2023-52885 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fc80fc2d4e39137869da3150ee169b40bf879287 upstream. After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock retaining a freed listener svc_sock in sk_user_data which cloning from parent. In the race window, if data is received on the newsock, we will observe use-after-free report in svc_tcp_listen_data_ready(). Reproduce by two tasks: 1. while :; do rpc.nfsd 0 ; rpc.nfsd; done 2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc] Read of size 8 at addr ffff888139d96228 by task nc/102553 CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <IRQ> dump_stack_lvl+0x33/0x50 print_address_description.constprop.0+0x27/0x310 print_report+0x3e/0x70 kasan_report+0xae/0xe0 svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc] tcp_data_queue+0x9f4/0x20e0 tcp_rcv_established+0x666/0x1f60 tcp_v4_do_rcv+0x51c/0x850 tcp_v4_rcv+0x23fc/0x2e80 ip_protocol_deliver_rcu+0x62/0x300 ip_local_deliver_finish+0x267/0x350 ip_local_deliver+0x18b/0x2d0 ip_rcv+0x2fb/0x370 __netif_receive_skb_one_core+0x166/0x1b0 process_backlog+0x24c/0x5e0 __napi_poll+0xa2/0x500 net_rx_action+0x854/0xc90 __do_softirq+0x1bb/0x5de do_softirq+0xcb/0x100 </IRQ> <TASK> ... </TASK> Allocated by task 102371: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7b/0x90 svc_setup_socket+0x52/0x4f0 [sunrpc] svc_addsock+0x20d/0x400 [sunrpc] __write_ports_addfd+0x209/0x390 [nfsd] write_ports+0x239/0x2c0 [nfsd] nfsctl_transaction_write+0xac/0x110 [nfsd] vfs_write+0x1c3/0xae0 ksys_write+0xed/0x1c0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 102551: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x106/0x190 __kmem_cache_free+0x133/0x270 svc_xprt_free+0x1e2/0x350 [sunrpc] svc_xprt_destroy_all+0x25a/0x440 [sunrpc] nfsd_put+0x125/0x240 [nfsd] nfsd_svc+0x2cb/0x3c0 [nfsd] write_threads+0x1ac/0x2a0 [nfsd] nfsctl_transaction_write+0xac/0x110 [nfsd] vfs_write+0x1c3/0xae0 ksys_write+0xed/0x1c0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Fix the UAF by simply doing nothing in svc_tcp_listen_data_ready() if state != TCP_LISTEN, that will avoid dereferencing svsk for all child socket. Link: https://lore.kernel.org/lkml/20230507091131.23540-1-dinghui@sangfor.com.cn/ Fixes: fa9251afc33c ("SUNRPC: Call the default socket callbacks instead of open coding") Signed-off-by: Ding Hui <dinghui(a)sangfor.com.cn> Cc: <stable(a)vger.kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/svcsock.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index 6d5bb8bfed38..3d5ee042c501 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -692,12 +692,6 @@ static void svc_tcp_listen_data_ready(struct sock *sk) { struct svc_sock *svsk = (struct svc_sock *)sk->sk_user_data; - if (svsk) { - /* Refer to svc_setup_socket() for details. */ - rmb(); - svsk->sk_odata(sk); - } - /* * This callback may called twice when a new connection * is established as a child socket inherits everything @@ -706,13 +700,18 @@ static void svc_tcp_listen_data_ready(struct sock *sk) * when one of child sockets become ESTABLISHED. * 2) data_ready method of the child socket may be called * when it receives data before the socket is accepted. - * In case of 2, we should ignore it silently. + * In case of 2, we should ignore it silently and DO NOT + * dereference svsk. */ - if (sk->sk_state == TCP_LISTEN) { - if (svsk) { - set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags); - svc_xprt_enqueue(&svsk->sk_xprt); - } + if (sk->sk_state != TCP_LISTEN) + return; + + if (svsk) { + /* Refer to svc_setup_socket() for details. */ + rmb(); + svsk->sk_odata(sk); + set_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags); + svc_xprt_enqueue(&svsk->sk_xprt); } } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] bonding: Fix CVE-2023-52784
by Dong Chenchen 22 Nov '24

22 Nov '24

Fix CVE-2023-52784. Eric Dumazet (1): bonding: stop the device in bond_setup_by_slave() Hangbin Liu (1): bonding: reset bond's flags when down link is P2P device drivers/net/bonding/bond_main.c | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] llc: verify mac len before reading mac header
by Dong Chenchen 22 Nov '24

22 Nov '24

From: Willem de Bruijn <willemb(a)google.com> stable inclusion from stable-v5.10.201 commit 3a2653828ffc6101aef80bf58d5b77484239f779 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RG0B CVE: CVE-2023-52843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7b3ba18703a63f6fd487183b9262b08e5632da1b ] LLC reads the mac header with eth_hdr without verifying that the skb has an Ethernet header. Syzbot was able to enter llc_rcv on a tun device. Tun can insert packets without mac len and with user configurable skb->protocol (passing a tun_pi header when not configuring IFF_NO_PI). BUG: KMSAN: uninit-value in llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline] BUG: KMSAN: uninit-value in llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111 llc_station_ac_send_test_r net/llc/llc_station.c:81 [inline] llc_station_rcv+0x6fb/0x1290 net/llc/llc_station.c:111 llc_rcv+0xc5d/0x14a0 net/llc/llc_input.c:218 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555 tun_get_user+0x54c5/0x69c0 drivers/net/tun.c:2002 Add a mac_len test before all three eth_hdr(skb) calls under net/llc. There are further uses in include/net/llc_pdu.h. All these are protected by a test skb->protocol == ETH_P_802_2. Which does not protect against this tun scenario. But the mac_len test added in this patch in llc_fixup_skb will indirectly protect those too. That is called from llc_rcv before any other LLC code. It is tempting to just add a blanket mac_len check in llc_rcv, but not sure whether that could break valid LLC paths that do not assume an Ethernet header. 802.2 LLC may be used on top of non-802.3 protocols in principle. The below referenced commit shows that used to, on top of Token Ring. At least one of the three eth_hdr uses goes back to before the start of git history. But the one that syzbot exercises is introduced in this commit. That commit is old enough (2008), that effectively all stable kernels should receive this. Fixes: f83f1768f833 ("[LLC]: skb allocation size for responses") Reported-by: syzbot+a8c7be6dee0de1b669cc(a)syzkaller.appspotmail.com Signed-off-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20231025234251.3796495-1-willemdebruijn.kernel@gm… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/llc/llc_input.c | 10 ++++++++-- net/llc/llc_s_ac.c | 3 +++ net/llc/llc_station.c | 3 +++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c index c309b72a5877..afb00bbfa9ea 100644 --- a/net/llc/llc_input.c +++ b/net/llc/llc_input.c @@ -127,8 +127,14 @@ static inline int llc_fixup_skb(struct sk_buff *skb) skb->transport_header += llc_len; skb_pull(skb, llc_len); if (skb->protocol == htons(ETH_P_802_2)) { - __be16 pdulen = eth_hdr(skb)->h_proto; - s32 data_size = ntohs(pdulen) - llc_len; + __be16 pdulen; + s32 data_size; + + if (skb->mac_len < ETH_HLEN) + return 0; + + pdulen = eth_hdr(skb)->h_proto; + data_size = ntohs(pdulen) - llc_len; if (data_size < 0 || !pskb_may_pull(skb, data_size)) diff --git a/net/llc/llc_s_ac.c b/net/llc/llc_s_ac.c index 9fa3342c7a82..df26557a0244 100644 --- a/net/llc/llc_s_ac.c +++ b/net/llc/llc_s_ac.c @@ -153,6 +153,9 @@ int llc_sap_action_send_test_r(struct llc_sap *sap, struct sk_buff *skb) int rc = 1; u32 data_size; + if (skb->mac_len < ETH_HLEN) + return 1; + llc_pdu_decode_sa(skb, mac_da); llc_pdu_decode_da(skb, mac_sa); llc_pdu_decode_ssap(skb, &dsap); diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c index c29170e767a8..64e2c67e16ba 100644 --- a/net/llc/llc_station.c +++ b/net/llc/llc_station.c @@ -77,6 +77,9 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb) u32 data_size; struct sk_buff *nskb; + if (skb->mac_len < ETH_HLEN) + goto out; + /* The test request command is type U (llc_len = 3) */ data_size = ntohs(eth_hdr(skb)->h_proto) - 3; nskb = llc_alloc_frame(NULL, skb->dev, LLC_PDU_TYPE_U, data_size); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: s5p-jpeg: prevent buffer overflows
by Zhang Kunbo 22 Nov '24

22 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> stable inclusion from stable-v4.19.324 commit c5f6fefcda8fac8f082b6c5bf416567f4e100c51 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQX CVE: CVE-2024-53061 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 14a22762c3daeac59a5a534e124acbb4d7a79b3a upstream. The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jacek Anaszewski <jacek.anaszewski(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c index 350afaa29a62..1cb5b6228214 100644 --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c @@ -803,11 +803,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr = 0; - word = 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size = (long)word - 2; + + if (word < 2) + jpeg_buffer.size = 0; + else + jpeg_buffer.size = (long)word - 2; + jpeg_buffer.data += 2; jpeg_buffer.curr = 0; @@ -1086,6 +1089,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) if (byte == -1) return -1; *word = (unsigned int)byte | temp; + return 0; } @@ -1173,7 +1177,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; sof = jpeg_buffer.curr; /* after 0xffc0 */ sof_len = length; @@ -1204,7 +1208,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dqt >= S5P_JPEG_MAX_MARKER) return false; @@ -1217,7 +1221,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dht >= S5P_JPEG_MAX_MARKER) return false; @@ -1242,6 +1246,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] media: s5p-jpeg: prevent buffer overflows
by Zhang Kunbo 22 Nov '24

22 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> stable inclusion from stable-v5.10.230 commit f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQX CVE: CVE-2024-53061 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 14a22762c3daeac59a5a534e124acbb4d7a79b3a upstream. The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jacek Anaszewski <jacek.anaszewski(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c index d515eb08c3ee..55d0ba45a970 100644 --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c @@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr = 0; - word = 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size = (long)word - 2; + + if (word < 2) + jpeg_buffer.size = 0; + else + jpeg_buffer.size = (long)word - 2; + jpeg_buffer.data += 2; jpeg_buffer.curr = 0; @@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) if (byte == -1) return -1; *word = (unsigned int)byte | temp; + return 0; } @@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; sof = jpeg_buffer.curr; /* after 0xffc0 */ sof_len = length; @@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dqt >= S5P_JPEG_MAX_MARKER) return false; @@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dht >= S5P_JPEG_MAX_MARKER) return false; @@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] btrfs: reinitialize delayed ref list after deleting it from the list
by Zizhi Wo 22 Nov '24

22 Nov '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-4.19.324 commit 2fd0948a483e9cb2d669c7199bc620a21c97673d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVH CVE: CVE-2024-50273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit c9a75ec45f1111ef530ab186c2a7684d0a0c9245 upstream. At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's ref_add_list using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively. If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref's add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise. So fix this by deleting from the list with list_del_init() instead. Fixes: 1d57ee941692 ("btrfs: improve delayed refs iterations") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/delayed-ref.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c index 7e5c81e80e15..a5fab1bc0e88 100644 --- a/fs/btrfs/delayed-ref.c +++ b/fs/btrfs/delayed-ref.c @@ -426,7 +426,7 @@ static int insert_delayed_ref(struct btrfs_trans_handle *trans, &href->ref_add_list); else if (ref->action == BTRFS_DROP_DELAYED_REF) { ASSERT(!list_empty(&exist->add_list)); - list_del(&exist->add_list); + list_del_init(&exist->add_list); } else { ASSERT(0); } -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS] nfs: Fix KMSAN warning in decode_getfattr_attrs()
by Zizhi Wo 22 Nov '24

22 Nov '24

From: Roberto Sassu <roberto.sassu(a)huawei.com> stable inclusion from stable-v4.19.324 commit 25ffd294fef81a7f3cd9528adf21560c04d98747 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQQ CVE: CVE-2024-53066 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit dc270d7159699ad6d11decadfce9633f0f71c1db upstream. Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_generic+0x806/0xb00 nfs4_xdr_dec_getattr+0x1de/0x240 rpcauth_unwrap_resp_decode+0xab/0x100 rpcauth_unwrap_resp+0x95/0xc0 call_decode+0x4ff/0xb50 __rpc_execute+0x57b/0x19d0 rpc_execute+0x368/0x5e0 rpc_run_task+0xcfe/0xee0 nfs4_proc_getattr+0x5b5/0x990 __nfs_revalidate_inode+0x477/0xd00 nfs_access_get_cached+0x1021/0x1cc0 nfs_do_access+0x9f/0xae0 nfs_permission+0x1e4/0x8c0 inode_permission+0x356/0x6c0 link_path_walk+0x958/0x1330 path_lookupat+0xce/0x6b0 filename_lookup+0x23e/0x770 vfs_statx+0xe7/0x970 vfs_fstatat+0x1f2/0x2c0 __se_sys_newfstatat+0x67/0x880 __x64_sys_newfstatat+0xbd/0x120 x64_sys_call+0x1826/0x3cf0 do_syscall_64+0xd0/0x1b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not initialized. Fix the issue by initializing fattr->mdsthreshold to NULL in nfs_fattr_init(). Cc: stable(a)vger.kernel.org # v3.5.x Fixes: 88034c3d88c2 ("NFSv4.1 mdsthreshold attribute xdr") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index 053e78d777f1..9437c2dd4514 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1484,6 +1484,7 @@ void nfs_fattr_init(struct nfs_fattr *fattr) fattr->gencount = nfs_inc_attr_generation_counter(); fattr->owner_name = NULL; fattr->group_name = NULL; + fattr->mdsthreshold = NULL; } EXPORT_SYMBOL_GPL(nfs_fattr_init); -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nfs: Fix KMSAN warning in decode_getfattr_attrs()
by Zizhi Wo 22 Nov '24

22 Nov '24

From: Roberto Sassu <roberto.sassu(a)huawei.com> stable inclusion from stable-v5.10.230 commit 8fc5ea9231af9122d227c9c13f5e578fca48d2e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQQ CVE: CVE-2024-53066 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit dc270d7159699ad6d11decadfce9633f0f71c1db upstream. Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_generic+0x806/0xb00 nfs4_xdr_dec_getattr+0x1de/0x240 rpcauth_unwrap_resp_decode+0xab/0x100 rpcauth_unwrap_resp+0x95/0xc0 call_decode+0x4ff/0xb50 __rpc_execute+0x57b/0x19d0 rpc_execute+0x368/0x5e0 rpc_run_task+0xcfe/0xee0 nfs4_proc_getattr+0x5b5/0x990 __nfs_revalidate_inode+0x477/0xd00 nfs_access_get_cached+0x1021/0x1cc0 nfs_do_access+0x9f/0xae0 nfs_permission+0x1e4/0x8c0 inode_permission+0x356/0x6c0 link_path_walk+0x958/0x1330 path_lookupat+0xce/0x6b0 filename_lookup+0x23e/0x770 vfs_statx+0xe7/0x970 vfs_fstatat+0x1f2/0x2c0 __se_sys_newfstatat+0x67/0x880 __x64_sys_newfstatat+0xbd/0x120 x64_sys_call+0x1826/0x3cf0 do_syscall_64+0xd0/0x1b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not initialized. Fix the issue by initializing fattr->mdsthreshold to NULL in nfs_fattr_init(). Cc: stable(a)vger.kernel.org # v3.5.x Fixes: 88034c3d88c2 ("NFSv4.1 mdsthreshold attribute xdr") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index 0d06ec25e21e..d82eb1b2164f 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1532,6 +1532,7 @@ void nfs_fattr_init(struct nfs_fattr *fattr) fattr->gencount = nfs_inc_attr_generation_counter(); fattr->owner_name = NULL; fattr->group_name = NULL; + fattr->mdsthreshold = NULL; } EXPORT_SYMBOL_GPL(nfs_fattr_init); -- 2.46.1

2 1

[PATCH OLK-5.10] nfs: Fix KMSAN warning in decode_getfattr_attrs()
by Zizhi Wo 22 Nov '24

22 Nov '24

From: Roberto Sassu <roberto.sassu(a)huawei.com> stable inclusion from stable-v5.10.230 commit 8fc5ea9231af9122d227c9c13f5e578fca48d2e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQQ CVE: CVE-2024-53066 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit dc270d7159699ad6d11decadfce9633f0f71c1db upstream. Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_generic+0x806/0xb00 nfs4_xdr_dec_getattr+0x1de/0x240 rpcauth_unwrap_resp_decode+0xab/0x100 rpcauth_unwrap_resp+0x95/0xc0 call_decode+0x4ff/0xb50 __rpc_execute+0x57b/0x19d0 rpc_execute+0x368/0x5e0 rpc_run_task+0xcfe/0xee0 nfs4_proc_getattr+0x5b5/0x990 __nfs_revalidate_inode+0x477/0xd00 nfs_access_get_cached+0x1021/0x1cc0 nfs_do_access+0x9f/0xae0 nfs_permission+0x1e4/0x8c0 inode_permission+0x356/0x6c0 link_path_walk+0x958/0x1330 path_lookupat+0xce/0x6b0 filename_lookup+0x23e/0x770 vfs_statx+0xe7/0x970 vfs_fstatat+0x1f2/0x2c0 __se_sys_newfstatat+0x67/0x880 __x64_sys_newfstatat+0xbd/0x120 x64_sys_call+0x1826/0x3cf0 do_syscall_64+0xd0/0x1b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not initialized. Fix the issue by initializing fattr->mdsthreshold to NULL in nfs_fattr_init(). Cc: stable(a)vger.kernel.org # v3.5.x Fixes: 88034c3d88c2 ("NFSv4.1 mdsthreshold attribute xdr") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfs/inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index 0d06ec25e21e..d82eb1b2164f 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1532,6 +1532,7 @@ void nfs_fattr_init(struct nfs_fattr *fattr) fattr->gencount = nfs_inc_attr_generation_counter(); fattr->owner_name = NULL; fattr->group_name = NULL; + fattr->mdsthreshold = NULL; } EXPORT_SYMBOL_GPL(nfs_fattr_init); -- 2.46.1

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: reinitialize delayed ref list after deleting it from the list
by Zizhi Wo 22 Nov '24

22 Nov '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v5.10.230 commit bf0b0c6d159767c0d1c21f793950d78486690ee0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVH CVE: CVE-2024-50273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit c9a75ec45f1111ef530ab186c2a7684d0a0c9245 upstream. At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's ref_add_list using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively. If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref's add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise. So fix this by deleting from the list with list_del_init() instead. Fixes: 1d57ee941692 ("btrfs: improve delayed refs iterations") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/delayed-ref.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c index 30883b9a26d8..e2309bc9e45d 100644 --- a/fs/btrfs/delayed-ref.c +++ b/fs/btrfs/delayed-ref.c @@ -620,7 +620,7 @@ static int insert_delayed_ref(struct btrfs_trans_handle *trans, &href->ref_add_list); else if (ref->action == BTRFS_DROP_DELAYED_REF) { ASSERT(!list_empty(&exist->add_list)); - list_del(&exist->add_list); + list_del_init(&exist->add_list); } else { ASSERT(0); } -- 2.46.1

2 1

[PATCH OLK-5.10] media: s5p-jpeg: prevent buffer overflows
by Zhang Kunbo 22 Nov '24

22 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> stable inclusion from stable-v5.10.230 commit f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQX CVE: CVE-2024-53061 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 14a22762c3daeac59a5a534e124acbb4d7a79b3a upstream. The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jacek Anaszewski <jacek.anaszewski(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c index d515eb08c3ee..55d0ba45a970 100644 --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c @@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr = 0; - word = 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size = (long)word - 2; + + if (word < 2) + jpeg_buffer.size = 0; + else + jpeg_buffer.size = (long)word - 2; + jpeg_buffer.data += 2; jpeg_buffer.curr = 0; @@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) if (byte == -1) return -1; *word = (unsigned int)byte | temp; + return 0; } @@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; sof = jpeg_buffer.curr; /* after 0xffc0 */ sof_len = length; @@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dqt >= S5P_JPEG_MAX_MARKER) return false; @@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dht >= S5P_JPEG_MAX_MARKER) return false; @@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; } -- 2.34.1

2 1

[PATCH OLK-5.10] btrfs: reinitialize delayed ref list after deleting it from the list
by Zizhi Wo 22 Nov '24

22 Nov '24

From: Filipe Manana <fdmanana(a)suse.com> stable inclusion from stable-v5.10.230 commit bf0b0c6d159767c0d1c21f793950d78486690ee0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVH CVE: CVE-2024-50273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit c9a75ec45f1111ef530ab186c2a7684d0a0c9245 upstream. At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's ref_add_list using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively. If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref's add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise. So fix this by deleting from the list with list_del_init() instead. Fixes: 1d57ee941692 ("btrfs: improve delayed refs iterations") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/delayed-ref.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c index 30883b9a26d8..e2309bc9e45d 100644 --- a/fs/btrfs/delayed-ref.c +++ b/fs/btrfs/delayed-ref.c @@ -620,7 +620,7 @@ static int insert_delayed_ref(struct btrfs_trans_handle *trans, &href->ref_add_list); else if (ref->action == BTRFS_DROP_DELAYED_REF) { ASSERT(!list_empty(&exist->add_list)); - list_del(&exist->add_list); + list_del_init(&exist->add_list); } else { ASSERT(0); } -- 2.46.1

2 1

[PATCH OLK-6.6] perf: Add PMCG platform information for HiSilicon HIP09A
by Yushan Wang 22 Nov '24

22 Nov '24

From: Qinxin Xia <xiaqinxin(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB5WVR CVE: NA ---------------------------------------------------------------------- Bugfix or Feature: Bugfix Description: HiSilicon HIP09A platforms using the same SMMU PMCG with HIP09 and thus suffers the same erratum. List them in the PMCG platform information list without introducing a new SMMU PMCG Model. Fixes: 0785c8a6d09e ("ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11") Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: zhangqz <14294317+zhangqizhi3(a)user.noreply.gitee.com> --- Documentation/arm64/silicon-errata.rst | 5 +++-- drivers/acpi/arm64/iort.c | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index 77ba5531e0ee..29287a91bbb7 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -147,8 +147,9 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | +----------------+-----------------+-----------------+-----------------------------+ -| Hisilicon | Hip{08,09,10,10C| #162001900 | N/A | -| | ,11} SMMU PMCG | | | +| Hisilicon | Hip{08,09,09A, | #162001900 | N/A | +| | 10,10C,11} | | | +| | SMMU PMCG | | | +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | TSV{110,200} | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index a0786cd8ca83..a86f65e47d17 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1481,6 +1481,8 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, -- 2.33.0

2 1

[openeuler:OLK-6.6 1513/1513] drivers/crypto/montage/tsse/tsse_ipc_api.c:62:36: warning: variable 'device_handle' is uninitialized when used here
by kernel test robot 22 Nov '24

22 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dccd6d8473b2f20aaa76e23820a3bf4934fc8d36 commit: 914854f2adb6988ac3b6521088ec96833d6743e2 [1513/1513] driver: crypto - update support for Mont-TSSE Driver config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241122/202411221252.PUnKjTWH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411221252.PUnKjTWH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411221252.PUnKjTWH-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/crypto/montage/tsse/tsse_ipc_api.c:10: In file included from drivers/crypto/montage/tsse/tsse_dev.h:13: In file included from include/linux/pci.h:1669: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2243: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/crypto/montage/tsse/tsse_ipc_api.c:62:36: warning: variable 'device_handle' is uninitialized when used here [-Wuninitialized] 62 | service_instance->device_handle = device_handle; | ^~~~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc_api.c:56:19: note: initialize the variable 'device_handle' to silence this warning 56 | int device_handle; | ^ | = 0 6 warnings generated. vim +/device_handle +62 drivers/crypto/montage/tsse/tsse_ipc_api.c 41 42 /** 43 * tsse_im_service_handle_alloc() - Allocate IPC Message service handle for specific service. 44 * @name: IPC Message service name 45 * @cb: request callback for the service 46 * @handle: function output for the service handle 47 * Return: 0 if allocated successfully, other values for failure 48 */ 49 int tsse_im_service_handle_alloc( 50 const char *name, 51 tsse_im_cb_func cb, 52 tsse_im_service_handle *handle) 53 { 54 struct tsse_service_instance *service_instance; 55 int ret; 56 int device_handle; 57 58 service_instance = kzalloc(sizeof(struct tsse_service_instance), GFP_ATOMIC); 59 if (!service_instance) 60 return -ENOMEM; 61 service_instance->service_opened = 0; > 62 service_instance->device_handle = device_handle; 63 service_instance->cb = cb; 64 strscpy(service_instance->service_name, name, TSSE_IM_SERVICE_NAME_LEN); 65 66 ret = tsse_schedule_device_handle(service_instance); 67 if (ret) { 68 kfree(service_instance); 69 return ret; 70 } 71 72 ret = tsse_service_open(service_instance); 73 if (ret) { 74 pr_err("%s(): open service: %s failed: %d\n", 75 __func__, service_instance->service_name, ret); 76 kfree(service_instance); 77 return ret; 78 } 79 *handle = service_instance; 80 return 0; 81 } 82 EXPORT_SYMBOL_GPL(tsse_im_service_handle_alloc); 83 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1304/1304] kernel/sched/core.c:5845:2: error: implicit declaration of function 'tg_update_affinity_domains'
by kernel test robot 22 Nov '24

22 Nov '24

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 713cfd2684fa5ea08b144d92b9858b932c0f1705 [1304/1304] sched: Introduce smart grid scheduling strategy for cfs config: x86_64-randconfig-002-20241122 (https://download.01.org/0day-ci/archive/20241122/202411221242.ljLHS46N-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411221242.ljLHS46N-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411221242.ljLHS46N-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/core.c:8: In file included from kernel/sched/sched.h:39: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/core.c:8: kernel/sched/sched.h:1249:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1249 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:1587:6: warning: no previous prototype for function 'sched_set_stop_task' [-Wmissing-prototypes] 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ kernel/sched/core.c:1587:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ | static kernel/sched/core.c:2741:10: warning: cast from 'void (*)(struct callback_head *)' to 'void (*)(struct rq *)' converts to incompatible function type [-Wcast-function-type-strict] 2741 | func = (void (*)(struct rq *))head->func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:3632:35: warning: no previous prototype for function 'schedule_user' [-Wmissing-prototypes] 3632 | asmlinkage __visible void __sched schedule_user(void) | ^ kernel/sched/core.c:3632:22: note: declare 'static' if the function is not intended to be used outside of this translation unit 3632 | asmlinkage __visible void __sched schedule_user(void) | ^ | static kernel/sched/core.c:3771:35: warning: no previous prototype for function 'preempt_schedule_irq' [-Wmissing-prototypes] 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ kernel/sched/core.c:3771:22: note: declare 'static' if the function is not intended to be used outside of this translation unit 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ | static >> kernel/sched/core.c:5845:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5845 | tg_update_affinity_domains(cpu, 1); | ^ kernel/sched/core.c:5904:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5904 | tg_update_affinity_domains(cpu, 0); | ^ kernel/sched/core.c:5976:2: error: implicit declaration of function 'init_auto_affinity' [-Werror,-Wimplicit-function-declaration] 5976 | init_auto_affinity(&root_task_group); | ^ kernel/sched/core.c:5976:2: note: did you mean 'irq_set_affinity'? include/linux/interrupt.h:292:1: note: 'irq_set_affinity' declared here 292 | irq_set_affinity(unsigned int irq, const struct cpumask *cpumask) | ^ kernel/sched/core.c:5976:22: error: use of undeclared identifier 'root_task_group'; did you mean 'task_group'? 5976 | init_auto_affinity(&root_task_group); | ^~~~~~~~~~~~~~~ | task_group kernel/sched/sched.h:1444:34: note: 'task_group' declared here 1444 | static inline struct task_group *task_group(struct task_struct *p) | ^ kernel/sched/core.c:6029:32: warning: variable 'ptr' set but not used [-Wunused-but-set-variable] 6029 | unsigned long alloc_size = 0, ptr; | ^ 7 warnings and 4 errors generated. vim +/tg_update_affinity_domains +5845 kernel/sched/core.c 5831 5832 int sched_cpu_activate(unsigned int cpu) 5833 { 5834 struct rq *rq = cpu_rq(cpu); 5835 struct rq_flags rf; 5836 5837 #ifdef CONFIG_SCHED_SMT 5838 /* 5839 * When going up, increment the number of cores with SMT present. 5840 */ 5841 if (cpumask_weight(cpu_smt_mask(cpu)) == 2) 5842 static_branch_inc_cpuslocked(&sched_smt_present); 5843 #endif 5844 set_cpu_active(cpu, true); > 5845 tg_update_affinity_domains(cpu, 1); 5846 5847 if (sched_smp_initialized) { 5848 sched_domains_numa_masks_set(cpu); 5849 cpuset_cpu_active(); 5850 } 5851 5852 /* 5853 * Put the rq online, if not already. This happens: 5854 * 5855 * 1) In the early boot process, because we build the real domains 5856 * after all CPUs have been brought up. 5857 * 5858 * 2) At runtime, if cpuset_cpu_active() fails to rebuild the 5859 * domains. 5860 */ 5861 rq_lock_irqsave(rq, &rf); 5862 if (rq->rd) { 5863 BUG_ON(!cpumask_test_cpu(cpu, rq->rd->span)); 5864 set_rq_online(rq); 5865 } 5866 rq_unlock_irqrestore(rq, &rf); 5867 5868 update_max_interval(); 5869 5870 return 0; 5871 } 5872 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tpm: Lock TPM chip in tpm_pm_suspend() first
by Chen Zhongjin 22 Nov '24

22 Nov '24

From: Jarkko Sakkinen <jarkko(a)kernel.org> mainline inclusion from mainline-v6.12-rc1 commit 9265fed6db601ee2ec47577815387458ef4f047a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KRG CVE: CVE-2024-53085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour. Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved. Cc: stable(a)vger.kernel.org # v6.4+ Fixes: 99d464506255 ("tpm: Prevent hwrng from activating during resume") Reported-by: Mike Seo <mikeseohyungjin(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219383 Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Tested-by: Mike Seo <mikeseohyungjin(a)gmail.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Conflicts: drivers/char/tpm/tpm-interface.c [df745e25098d ("tpm: Lazily flush the auth session") is not merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/char/tpm/tpm-chip.c | 4 ---- drivers/char/tpm/tpm-interface.c | 29 +++++++++++++++++++++-------- 2 files changed, 21 insertions(+), 12 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 42b1062e33cd5..78999f7f248cb 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -519,10 +519,6 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) { struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng); - /* Give back zero bytes, as TPM chip has not yet fully resumed: */ - if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) - return 0; - return tpm_get_random(chip, data, max); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 66b16d26eecc7..c8ea52dfa5567 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -394,6 +394,13 @@ int tpm_pm_suspend(struct device *dev) if (!chip) return -ENODEV; + rc = tpm_try_get_ops(chip); + if (rc) { + /* Can be safely set out of locks, as no action cannot race: */ + chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED) goto suspended; @@ -401,19 +408,18 @@ int tpm_pm_suspend(struct device *dev) !pm_suspend_via_firmware()) goto suspended; - rc = tpm_try_get_ops(chip); - if (!rc) { - if (chip->flags & TPM_CHIP_FLAG_TPM2) - tpm2_shutdown(chip, TPM2_SU_STATE); - else - rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); - - tpm_put_ops(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) { + tpm2_shutdown(chip, TPM2_SU_STATE); + goto suspended; } + rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); + suspended: chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + tpm_put_ops(chip); +out: if (rc) dev_err(dev, "Ignoring error %d while suspending\n", rc); return 0; @@ -462,11 +468,18 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max) if (!chip) return -ENODEV; + /* Give back zero bytes, as TPM chip has not yet fully resumed: */ + if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) { + rc = 0; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_TPM2) rc = tpm2_get_random(chip, out, max); else rc = tpm1_get_random(chip, out, max); +out: tpm_put_ops(chip); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] ext4: fix potential memory exposure issues during truncate in iomap
by Yongjian Sun 22 Nov '24

22 Nov '24

*** BLURB HERE *** Yongjian Sun (2): ext4: do not always order data when partial zeroing out a block ext4: fix potential memory exposure issues during truncate in iomap mode. fs/ext4/inode.c | 75 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 59 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 V1] sched/topology: Prevent race condition in sched_domain topology
by Zicheng Qu 22 Nov '24

22 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB485D -------------------------------- A race condition in `build_sched_domains() -> build_sched_domain() -> sd_init()` can lead to a null pointer dereference when `tl->data` is accessed. This occurs because `build_sched_domains() -> alloc_state()` may skip memory allocation for `tl->data` based on `tl->flags` and `SDTL_SKIP`, which can be influenced by concurrent modifications through `sched_cluster_handler()`, supported by the feature named "scheduler: Add runtime knob sysctl_sched_cluster". The issue arises when `sysctl_sched_cluster()` is modified via `/proc/sys/kernel/sched_cluster`, affecting `tl->flags` through `sched_cluster_handler() -> set_sched_cluster()`. This can lead to an inconsistent state where `tl->data` is expected to be non-null in `sd_init()`, but was not allocated in `alloc_state()` before `sd_init()`. To resolve this, lock `sched_domains_mutex` before calling `set_sched_cluster()`. This ensures that changes to `tl->flags` do not interfere with the memory allocation process in `build_sched_domains()`. Fixes: 8ce3e706b314 ("scheduler: Add runtime knob sysctl_sched_cluster") Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- kernel/sched/topology.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 4bf575e4e7fc..3a8673a1a3fc 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -1722,7 +1722,13 @@ int sched_cluster_handler(struct ctl_table *table, int write, ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); if (!ret && write) { if (oldval != sysctl_sched_cluster) { + /* + * Here may have raced with partition_sched_domains_locked, + * it needs to be protected with sched_domains_mutex. + */ + mutex_lock(&sched_domains_mutex); set_sched_cluster(); + mutex_unlock(&sched_domains_mutex); arch_rebuild_cpu_topology(); } } -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 V1] udf: fix uninit-value use in udf_get_fileshortad
by Zicheng Qu 22 Nov '24

22 Nov '24

From: Gianfranco Trad <gianf.trad(a)gmail.com> stable inclusion from stable-v5.15.170 commit 4fc0d8660e391dcd8dde23c44d702be1f6846c61 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SWN CVE: CVE-2024-50143 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 264db9d666ad9a35075cc9ed9ec09d021580fbb1 ] Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000 Reported-by: syzbot+8901c4560b7ab5c2f9df(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df Tested-by: syzbot+8901c4560b7ab5c2f9df(a)syzkaller.appspotmail.com Suggested-by: Jan Kara <jack(a)suse.com> Signed-off-by: Gianfranco Trad <gianf.trad(a)gmail.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240925074613.8475-3-gianf.trad@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/udf/inode.c [The stable version 5.10 is missing patch 4fc0d8660e391dcd8dde23c44d702be1f6846c61, which was pulled from 5.15. The current version of check_add_overflow() lacks the relevant commit d219d2a9a92e39aa92799efe8f2aa21259b6dd82 ("overflow: Allow mixed type arguments"). Therefore, it is necessary to cast the arguments to int.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- fs/udf/inode.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 3ae9955c42b0..1198d27552b5 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2182,12 +2182,15 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, alen = udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc; } else { + struct allocExtDesc *header = + (struct allocExtDesc *)epos->bh->b_data; + if (!epos->offset) epos->offset = sizeof(struct allocExtDesc); ptr = epos->bh->b_data + epos->offset; - alen = sizeof(struct allocExtDesc) + - le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> - lengthAllocDescs); + if (check_add_overflow((int)sizeof(struct allocExtDesc), + (int)le32_to_cpu(header->lengthAllocDescs), &alen)) + return -1; } switch (iinfo->i_alloc_type) { -- 2.34.1

2 1

[PATCH OLK-5.10 V1] udf: fix uninit-value use in udf_get_fileshortad
by Zicheng Qu 22 Nov '24

22 Nov '24

From: Gianfranco Trad <gianf.trad(a)gmail.com> stable inclusion from stable-v5.15.170 commit 4fc0d8660e391dcd8dde23c44d702be1f6846c61 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SWN CVE: CVE-2024-50143 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 264db9d666ad9a35075cc9ed9ec09d021580fbb1 ] Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000 Reported-by: syzbot+8901c4560b7ab5c2f9df(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df Tested-by: syzbot+8901c4560b7ab5c2f9df(a)syzkaller.appspotmail.com Suggested-by: Jan Kara <jack(a)suse.com> Signed-off-by: Gianfranco Trad <gianf.trad(a)gmail.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20240925074613.8475-3-gianf.trad@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/udf/inode.c [The stable version 5.10 is missing patch 4fc0d8660e391dcd8dde23c44d702be1f6846c61, which was pulled from 5.15. The current version of check_add_overflow() lacks the relevant commit d219d2a9a92e39aa92799efe8f2aa21259b6dd82 ("overflow: Allow mixed type arguments"). Therefore, it is necessary to cast the arguments to int.] Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com> --- fs/udf/inode.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index a8105eded07e..6ff9cc8adb26 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2184,12 +2184,15 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, alen = udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc; } else { + struct allocExtDesc *header = + (struct allocExtDesc *)epos->bh->b_data; + if (!epos->offset) epos->offset = sizeof(struct allocExtDesc); ptr = epos->bh->b_data + epos->offset; - alen = sizeof(struct allocExtDesc) + - le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> - lengthAllocDescs); + if (check_add_overflow((int)sizeof(struct allocExtDesc), + (int)le32_to_cpu(header->lengthAllocDescs), &alen)) + return -1; } switch (iinfo->i_alloc_type) { -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1304/1304] drivers/regulator/qcom-rpmh-regulator.c:742:34: warning: 'rpmh_regulator_match_table' defined but not used
by kernel test robot 22 Nov '24

22 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 46fc033eba42f5a4fb583b2ab53f0a9918468452 [1304/1304] regulator: add QCOM RPMh regulator driver config: x86_64-buildonly-randconfig-004-20241122 (https://download.01.org/0day-ci/archive/20241122/202411221130.VOHt3QyY-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411221130.VOHt3QyY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411221130.VOHt3QyY-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/regulator/qcom-rpmh-regulator.c:742:34: warning: 'rpmh_regulator_match_table' defined but not used [-Wunused-const-variable=] 742 | static const struct of_device_id rpmh_regulator_match_table[] = { | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/regulator/qcom-rpmh-regulator.c:33: warning: Enum value 'VRM' not described in enum 'rpmh_regulator_type' drivers/regulator/qcom-rpmh-regulator.c:33: warning: Enum value 'XOB' not described in enum 'rpmh_regulator_type' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'vreg' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'dev' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'node' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'pmic_id' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'pmic_rpmh_data' not described in 'rpmh_regulator_init_vreg' vim +/rpmh_regulator_match_table +742 drivers/regulator/qcom-rpmh-regulator.c 741 > 742 static const struct of_device_id rpmh_regulator_match_table[] = { 743 { 744 .compatible = "qcom,pm8998-rpmh-regulators", 745 .data = pm8998_vreg_data, 746 }, 747 { 748 .compatible = "qcom,pmi8998-rpmh-regulators", 749 .data = pmi8998_vreg_data, 750 }, 751 { 752 .compatible = "qcom,pm8005-rpmh-regulators", 753 .data = pm8005_vreg_data, 754 }, 755 {} 756 }; 757 MODULE_DEVICE_TABLE(of, rpmh_regulator_match_table); 758 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/19] blk-mq/scsi: tracking device queue depth via sbitmap
by Zheng Qixing 22 Nov '24

22 Nov '24

Linux mainline-5.13 uses sbitmap to track the queue depth of SCSI devices. This patch set backports the mainline patches to OLK-5.10 and fixes some KABI issues. Tests on scsi_debug show that this method can improve IO performance by more than 30%. Bart Van Assche (2): scsi: sbitmap: Silence a debug kernel warning triggered by sbitmap_put() scsi: core: Fix scsi_device_max_queue_depth() Kashyap Desai (1): scsi: megaraid_sas: Replace sdev_busy with local counter Ming Lei (13): scsi: sbitmap: Remove sbitmap_clear_bit_unlock scsi: sbitmap: Maintain allocation round_robin in sbitmap scsi: sbitmap: Add helpers for updating allocation hint scsi: sbitmap: Move allocation hint into sbitmap scsi: sbitmap: Export sbitmap_weight scsi: sbitmap: Add sbitmap_calculate_shift() helper scsi: blk-mq: Add callbacks for storing & retrieving budget token scsi: blk-mq: Return budget token from .get_budget callback scsi: core: Put hot fields of scsi_host_template in one cacheline scsi: core: Add scsi_device_busy() wrapper scsi: core: Make sure sdev->queue_depth is <= max(shost->can_queue, 1024) scsi: core: Replace sdev->device_busy with sbitmap scsi: blk-mq: Fix build warning when making htmldocs Pavel Begunkov (1): sbitmap: optimise sbitmap_deferred_clear() Zheng Qixing (2): sbitmap: fix kabi broken by adding struct sbitmap_extend sbitmap: fix kabi broken in struct scsi_device block/blk-mq-sched.c | 17 +- block/blk-mq.c | 38 ++- block/blk-mq.h | 25 +- block/kyber-iosched.c | 3 +- drivers/message/fusion/mptsas.c | 2 +- drivers/scsi/megaraid/megaraid_sas.h | 2 + drivers/scsi/megaraid/megaraid_sas_fusion.c | 47 +++- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/scsi.c | 13 ++ drivers/scsi/scsi_lib.c | 71 ++++-- drivers/scsi/scsi_priv.h | 3 + drivers/scsi/scsi_scan.c | 45 +++- drivers/scsi/scsi_sysfs.c | 4 +- drivers/scsi/sg.c | 2 +- drivers/vhost/scsi.c | 4 +- include/linux/blk-mq.h | 13 +- include/linux/sbitmap.h | 91 ++++++-- include/scsi/scsi_cmnd.h | 2 + include/scsi/scsi_device.h | 13 +- include/scsi/scsi_host.h | 72 +++--- lib/sbitmap.c | 243 +++++++++++--------- 21 files changed, 486 insertions(+), 226 deletions(-) -- 2.39.2

2 20

[PATCH OLK-6.6] bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
by Xiaomeng Zhang 22 Nov '24

22 Nov '24

From: Kuan-Wei Chiu <visitorckw(a)gmail.com> stable inclusion from stable-v6.6.55 commit c2d9f9a7837ab29ccae0c42252f17d436bf0a501 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0MX4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f04e2ad394e2755d0bb2d858ecb5598718bf00d5 ] When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null Although the C standard does not explicitly state whether calling qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of library functions) mentions: "Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined." To avoid this, add an early return when nf_link_info is NULL to prevent calling qsort with a NULL pointer. Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Reviewed-by: Quentin Monnet <qmo(a)kernel.org> Link: https://lore.kernel.org/bpf/20240910150207.3179306-1-visitorckw@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wen Zhiwei <wenzhiwei(a)kylinos.cn> --- tools/bpf/bpftool/net.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c index fd54ff436493..28e9417a5c2e 100644 --- a/tools/bpf/bpftool/net.c +++ b/tools/bpf/bpftool/net.c @@ -819,6 +819,9 @@ static void show_link_netfilter(void) nf_link_count++; } + if (!nf_link_info) + return; + qsort(nf_link_info, nf_link_count, sizeof(*nf_link_info), netfilter_link_compar); for (id = 0; id < nf_link_count; id++) { -- 2.34.1

2 1

[openeuler:OLK-6.6 1513/1513] drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type
by kernel test robot 22 Nov '24

22 Nov '24

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ab293c3a32ba6594fd24cd7ecd4a4a00ede0cd65 commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [1513/1513] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: arm64-randconfig-004-20241122 (https://download.01.org/0day-ci/archive/20241122/202411221143.jAhVHv3i-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411221143.jAhVHv3i-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411221143.jAhVHv3i-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/hinic/hinic_tx.c:39: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:913:5: warning: no previous prototype for 'hinic_setup_tx_wqe' [-Wmissing-prototypes] 913 | int hinic_setup_tx_wqe(struct hinic_txq *txq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1100:5: warning: no previous prototype for 'hinic_stop_sq' [-Wmissing-prototypes] 1100 | int hinic_stop_sq(struct hinic_txq *txq) | ^~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_sriov.c:25: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:28: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:698:5: warning: no previous prototype for 'get_pfc_info' [-Wmissing-prototypes] 698 | int get_pfc_info(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:720:5: warning: no previous prototype for 'set_pfc_control' [-Wmissing-prototypes] 720 | int set_pfc_control(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:752:5: warning: no previous prototype for 'set_ets' [-Wmissing-prototypes] 752 | int set_ets(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:827:5: warning: no previous prototype for 'get_support_up' [-Wmissing-prototypes] 827 | int get_support_up(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:855:5: warning: no previous prototype for 'get_support_tc' [-Wmissing-prototypes] 855 | int get_support_tc(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:875:5: warning: no previous prototype for 'get_ets_info' [-Wmissing-prototypes] 875 | int get_ets_info(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:893:5: warning: no previous prototype for 'set_pfc_priority' [-Wmissing-prototypes] 893 | int set_pfc_priority(struct hinic_nic_dev *nic_dev, void *buf_in, | ^~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:34: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:271:5: warning: no previous prototype for 'hinic_get_io_stats_size' [-Wmissing-prototypes] 271 | u32 hinic_get_io_stats_size(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:318:6: warning: no previous prototype for 'hinic_get_io_stats' [-Wmissing-prototypes] 318 | void hinic_get_io_stats(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c:1858:6: warning: no previous prototype for 'hinic_lp_test' [-Wmissing-prototypes] 1858 | void hinic_lp_test(struct net_device *netdev, struct ethtool_test *eth_test, | ^~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_dcb.c:32: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: warning: no previous prototype for 'hinic_dcb_config_init' [-Wmissing-prototypes] 62 | void hinic_dcb_config_init(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:95:6: warning: no previous prototype for 'hinic_init_ieee_settings' [-Wmissing-prototypes] 95 | void hinic_init_ieee_settings(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_init_ieee_settings': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 103 | memset(ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:105:12: error: invalid use of undefined type 'struct ieee_ets' 105 | ets->ets_cap = dcb_cfg->pg_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:108:20: error: invalid use of undefined type 'struct ieee_ets' 108 | ets->tc_tsa[i] = tc_attr->prio_type ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:110:20: error: invalid use of undefined type 'struct ieee_ets' 110 | ets->tc_tx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_TX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:111:20: error: invalid use of undefined type 'struct ieee_ets' 111 | ets->tc_rx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_RX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:112:20: error: invalid use of undefined type 'struct ieee_ets' 112 | ets->prio_tc[i] = hinic_dcb_get_tc(dcb_cfg, | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:115:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 115 | memcpy(&nic_dev->hinic_ieee_ets, ets, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_pfc' 117 | memset(pfc, 0x0, sizeof(struct ieee_pfc)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:118:12: error: invalid use of undefined type 'struct ieee_pfc' 118 | pfc->pfc_cap = dcb_cfg->pfc_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:121:28: error: invalid use of undefined type 'struct ieee_pfc' 121 | pfc->pfc_en |= (u8)BIT(i); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcb_init': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: note: each undeclared identifier is reported only once for each function it appears in drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:49: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:258:6: warning: no previous prototype for 'hinic_set_prio_tc_map' [-Wmissing-prototypes] 258 | void hinic_set_prio_tc_map(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_state': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:380:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 380 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_tx': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:475:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 475 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_rx': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:507:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 507 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_getcap': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:689:14: error: 'DCB_CAP_ATTR_PG' undeclared (first use in this function) 689 | case DCB_CAP_ATTR_PG: | ^~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:692:14: error: 'DCB_CAP_ATTR_PFC' undeclared (first use in this function) 692 | case DCB_CAP_ATTR_PFC: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:695:14: error: 'DCB_CAP_ATTR_UP2TC' undeclared (first use in this function) 695 | case DCB_CAP_ATTR_UP2TC: | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:698:14: error: 'DCB_CAP_ATTR_PG_TCS' undeclared (first use in this function) 698 | case DCB_CAP_ATTR_PG_TCS: | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:701:14: error: 'DCB_CAP_ATTR_PFC_TCS' undeclared (first use in this function) 701 | case DCB_CAP_ATTR_PFC_TCS: | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:704:14: error: 'DCB_CAP_ATTR_GSP' undeclared (first use in this function) 704 | case DCB_CAP_ATTR_GSP: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:707:14: error: 'DCB_CAP_ATTR_BCN' undeclared (first use in this function) 707 | case DCB_CAP_ATTR_BCN: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:710:14: error: 'DCB_CAP_ATTR_DCBX' undeclared (first use in this function) 710 | case DCB_CAP_ATTR_DCBX: | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function '__set_hw_ets': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1026:42: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1026 | if ((nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) { | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1027:44: error: invalid use of undefined type 'struct ieee_ets' 1027 | up_tc[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1028:46: error: invalid use of undefined type 'struct ieee_ets' 1028 | up_pgid[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1031:40: error: invalid use of undefined type 'struct ieee_ets' 1031 | (my_ets->tc_tsa[cos] == IEEE8021Q_TSA_STRICT) ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1049:42: error: invalid use of undefined type 'struct ieee_ets' 1049 | pg_bw[i] = my_ets->tc_tx_bw[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_df_ieee_cfg': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:16: error: variable 'pfc' has initializer but incomplete type 1126 | struct ieee_pfc pfc = {0}; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: warning: excess elements in struct initializer 1126 | struct ieee_pfc pfc = {0}; | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: note: (near initialization for 'pfc') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: error: storage size of 'pfc' isn't known 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1131:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1131 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1134:48: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1134 | if (memcmp(my_ets, ets_default, sizeof(struct ieee_ets))) | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1137:19: error: invalid use of undefined type 'struct ieee_pfc' 1137 | if (my_pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1149:52: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1149 | memcpy(my_ets, ets_default, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1153:23: error: invalid use of undefined type 'struct ieee_pfc' 1153 | my_pfc->pfc_en = 0; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: warning: unused variable 'pfc' [-Wunused-variable] 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1201:4: warning: no previous prototype for 'hinic_dcbnl_set_all' [-Wmissing-prototypes] 1201 | u8 hinic_dcbnl_set_all(struct net_device *netdev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_all': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1208:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 1208 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_get_ets': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:12: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:30: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:37: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:59: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1281:19: error: invalid use of undefined type 'struct ieee_ets' 1281 | memcpy(ets->tc_rx_bw, my_ets->tc_rx_bw, sizeof(ets->tc_rx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1281:37: error: invalid use of undefined type 'struct ieee_ets' 1281 | memcpy(ets->tc_rx_bw, my_ets->tc_rx_bw, sizeof(ets->tc_rx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1281:59: error: invalid use of undefined type 'struct ieee_ets' 1281 | memcpy(ets->tc_rx_bw, my_ets->tc_rx_bw, sizeof(ets->tc_rx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1282:19: error: invalid use of undefined type 'struct ieee_ets' 1282 | memcpy(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1282:36: error: invalid use of undefined type 'struct ieee_ets' 1282 | memcpy(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1282:57: error: invalid use of undefined type 'struct ieee_ets' 1282 | memcpy(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1283:19: error: invalid use of undefined type 'struct ieee_ets' 1283 | memcpy(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1283:35: error: invalid use of undefined type 'struct ieee_ets' 1283 | memcpy(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1283:55: error: invalid use of undefined type 'struct ieee_ets' 1283 | memcpy(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_set_ets': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1294:25: error: storage size of 'back_ets' isn't known 1294 | struct ieee_ets back_ets; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1299:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1299 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1302:24: error: invalid use of undefined type 'struct ieee_ets' 1302 | if (!memcmp(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1302:42: error: invalid use of undefined type 'struct ieee_ets' 1302 | if (!memcmp(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1302:64: error: invalid use of undefined type 'struct ieee_ets' 1302 | if (!memcmp(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1303:24: error: invalid use of undefined type 'struct ieee_ets' 1303 | !memcmp(ets->tc_rx_bw, my_ets->tc_rx_bw, sizeof(ets->tc_rx_bw)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1303:42: error: invalid use of undefined type 'struct ieee_ets' 1303 | !memcmp(ets->tc_rx_bw, my_ets->tc_rx_bw, sizeof(ets->tc_rx_bw)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1303:64: error: invalid use of undefined type 'struct ieee_ets' 1303 | !memcmp(ets->tc_rx_bw, my_ets->tc_rx_bw, sizeof(ets->tc_rx_bw)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1304:24: error: invalid use of undefined type 'struct ieee_ets' 1304 | !memcmp(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1304:41: error: invalid use of undefined type 'struct ieee_ets' 1304 | !memcmp(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1304:62: error: invalid use of undefined type 'struct ieee_ets' 1304 | !memcmp(ets->prio_tc, my_ets->prio_tc, sizeof(ets->prio_tc)) && | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1305:24: error: invalid use of undefined type 'struct ieee_ets' 1305 | !memcmp(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa))) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1305:40: error: invalid use of undefined type 'struct ieee_ets' 1305 | !memcmp(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa))) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1305:60: error: invalid use of undefined type 'struct ieee_ets' 1305 | !memcmp(ets->tc_tsa, my_ets->tc_tsa, sizeof(ets->tc_tsa))) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1309:32: error: invalid use of undefined type 'struct ieee_ets' 1309 | total_bw += ets->tc_tx_bw[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1314:24: error: invalid use of undefined type 'struct ieee_ets' 1314 | if (ets->prio_tc[i] > max_tc) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1315:37: error: invalid use of undefined type 'struct ieee_ets' 1315 | max_tc = ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1324:42: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1324 | memcpy(&back_ets, my_ets, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1325:22: error: invalid use of undefined type 'struct ieee_ets' 1325 | memcpy(my_ets->tc_tx_bw, ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1325:37: error: invalid use of undefined type 'struct ieee_ets' 1325 | memcpy(my_ets->tc_tx_bw, ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1325:59: error: invalid use of undefined type 'struct ieee_ets' 1325 | memcpy(my_ets->tc_tx_bw, ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1326:22: error: invalid use of undefined type 'struct ieee_ets' 1326 | memcpy(my_ets->tc_rx_bw, ets->tc_rx_bw, sizeof(ets->tc_rx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1326:37: error: invalid use of undefined type 'struct ieee_ets' 1326 | memcpy(my_ets->tc_rx_bw, ets->tc_rx_bw, sizeof(ets->tc_rx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1326:59: error: invalid use of undefined type 'struct ieee_ets' 1326 | memcpy(my_ets->tc_rx_bw, ets->tc_rx_bw, sizeof(ets->tc_rx_bw)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1327:22: error: invalid use of undefined type 'struct ieee_ets' 1327 | memcpy(my_ets->prio_tc, ets->prio_tc, sizeof(ets->prio_tc)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1327:36: error: invalid use of undefined type 'struct ieee_ets' 1327 | memcpy(my_ets->prio_tc, ets->prio_tc, sizeof(ets->prio_tc)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1327:57: error: invalid use of undefined type 'struct ieee_ets' 1327 | memcpy(my_ets->prio_tc, ets->prio_tc, sizeof(ets->prio_tc)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:22: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:35: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:55: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1336:58: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1336 | memcpy(my_ets, &back_ets, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1294:25: warning: unused variable 'back_ets' [-Wunused-variable] 1294 | struct ieee_ets back_ets; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_get_pfc': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1360:12: error: invalid use of undefined type 'struct ieee_pfc' 1360 | pfc->pfc_en = my_pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1360:29: error: invalid use of undefined type 'struct ieee_pfc' 1360 | pfc->pfc_en = my_pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1361:12: error: invalid use of undefined type 'struct ieee_pfc' 1361 | pfc->pfc_cap = my_pfc->pfc_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1361:30: error: invalid use of undefined type 'struct ieee_pfc' 1361 | pfc->pfc_cap = my_pfc->pfc_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_set_pfc': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1378:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1378 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1381:19: error: invalid use of undefined type 'struct ieee_pfc' 1381 | if (my_pfc->pfc_en == pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1381:34: error: invalid use of undefined type 'struct ieee_pfc' 1381 | if (my_pfc->pfc_en == pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1384:22: error: invalid use of undefined type 'struct ieee_pfc' 1384 | pfc_map = pfc->pfc_en & nic_dev->up_valid_bitmap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1385:30: error: invalid use of undefined type 'struct ieee_pfc' 1385 | outof_range_pfc = pfc->pfc_en & (~nic_dev->up_valid_bitmap); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1400:27: error: invalid use of undefined type 'struct ieee_ets' 1400 | if (my_ets->prio_tc[i] > max_tc) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1401:40: error: invalid use of undefined type 'struct ieee_ets' 1401 | max_tc = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1415:15: error: invalid use of undefined type 'struct ieee_pfc' 1415 | my_pfc->pfc_en = pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1415:29: error: invalid use of undefined type 'struct ieee_pfc' 1415 | my_pfc->pfc_en = pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_getnumtcs': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1432:14: error: 'DCB_NUMTCS_ATTR_PG' undeclared (first use in this function) 1432 | case DCB_NUMTCS_ATTR_PG: | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1435:14: error: 'DCB_NUMTCS_ATTR_PFC' undeclared (first use in this function) 1435 | case DCB_NUMTCS_ATTR_PFC: | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_setdcbx': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1476:22: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1476 | if (((mode & DCB_CAP_DCBX_VER_IEEE) && (mode & DCB_CAP_DCBX_VER_CEE)) || | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1476:56: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 1476 | if (((mode & DCB_CAP_DCBX_VER_IEEE) && (mode & DCB_CAP_DCBX_VER_CEE)) || | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1477:22: error: 'DCB_CAP_DCBX_LLD_MANAGED' undeclared (first use in this function) 1477 | ((mode & DCB_CAP_DCBX_LLD_MANAGED) && | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1478:23: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) 1478 | (!(mode & DCB_CAP_DCBX_HOST)))) { | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1519:14: error: variable 'hinic_dcbnl_ops' has initializer but incomplete type 1519 | const struct dcbnl_rtnl_ops hinic_dcbnl_ops = { | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getets' 1521 | .ieee_getets = hinic_dcbnl_ieee_get_ets, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:27: warning: excess elements in struct initializer 1521 | .ieee_getets = hinic_dcbnl_ieee_get_ets, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setets' 1522 | .ieee_setets = hinic_dcbnl_ieee_set_ets, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:27: warning: excess elements in struct initializer 1522 | .ieee_setets = hinic_dcbnl_ieee_set_ets, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getpfc' 1523 | .ieee_getpfc = hinic_dcbnl_ieee_get_pfc, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:27: warning: excess elements in struct initializer 1523 | .ieee_getpfc = hinic_dcbnl_ieee_get_pfc, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setpfc' 1524 | .ieee_setpfc = hinic_dcbnl_ieee_set_pfc, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:27: warning: excess elements in struct initializer 1524 | .ieee_setpfc = hinic_dcbnl_ieee_set_pfc, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getstate' 1527 | .getstate = hinic_dcbnl_get_state, | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:27: warning: excess elements in struct initializer 1527 | .getstate = hinic_dcbnl_get_state, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setstate' 1528 | .setstate = hinic_dcbnl_set_state, | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:27: warning: excess elements in struct initializer 1528 | .setstate = hinic_dcbnl_set_state, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpermhwaddr' 1529 | .getpermhwaddr = hinic_dcbnl_get_perm_hw_addr, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:27: warning: excess elements in struct initializer 1529 | .getpermhwaddr = hinic_dcbnl_get_perm_hw_addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgtx' 1530 | .setpgtccfgtx = hinic_dcbnl_set_pg_tc_cfg_tx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:27: warning: excess elements in struct initializer 1530 | .setpgtccfgtx = hinic_dcbnl_set_pg_tc_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgtx' 1531 | .setpgbwgcfgtx = hinic_dcbnl_set_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:27: warning: excess elements in struct initializer 1531 | .setpgbwgcfgtx = hinic_dcbnl_set_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgrx' 1532 | .setpgtccfgrx = hinic_dcbnl_set_pg_tc_cfg_rx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:27: warning: excess elements in struct initializer 1532 | .setpgtccfgrx = hinic_dcbnl_set_pg_tc_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgrx' 1533 | .setpgbwgcfgrx = hinic_dcbnl_set_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:27: warning: excess elements in struct initializer 1533 | .setpgbwgcfgrx = hinic_dcbnl_set_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgtx' 1534 | .getpgtccfgtx = hinic_dcbnl_get_pg_tc_cfg_tx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:27: warning: excess elements in struct initializer 1534 | .getpgtccfgtx = hinic_dcbnl_get_pg_tc_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgtx' 1535 | .getpgbwgcfgtx = hinic_dcbnl_get_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:27: warning: excess elements in struct initializer 1535 | .getpgbwgcfgtx = hinic_dcbnl_get_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:27: note: (near initialization for 'hinic_dcbnl_ops') .. vim +/hinic_ieee_ets_default +210 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h 153 154 struct hinic_nic_dev { 155 struct pci_dev *pdev; 156 struct net_device *netdev; 157 void *hwdev; 158 159 int poll_weight; 160 161 unsigned long *vlan_bitmap; 162 163 u16 num_qps; 164 u16 max_qps; 165 166 u32 msg_enable; 167 unsigned long flags; 168 169 u16 sq_depth; 170 u16 rq_depth; 171 172 /* mapping from priority */ 173 u8 sq_cos_mapping[HINIC_DCB_UP_MAX]; 174 u8 default_cos_id; 175 struct hinic_txq *txqs; 176 struct hinic_rxq *rxqs; 177 178 struct nic_service_cap nic_cap; 179 180 struct irq_info *qps_irq_info; 181 struct hinic_irq *irq_cfg; 182 struct work_struct rx_mode_work; 183 struct delayed_work moderation_task; 184 struct workqueue_struct *workq; 185 186 struct list_head uc_filter_list; 187 struct list_head mc_filter_list; 188 unsigned long rx_mod_state; 189 int netdev_uc_cnt; 190 int netdev_mc_cnt; 191 int lb_test_rx_idx; 192 int lb_pkt_len; 193 u8 *lb_test_rx_buf; 194 195 u8 rss_tmpl_idx; 196 u16 num_rss; 197 u16 rss_limit; 198 u8 rss_hash_engine; 199 struct nic_rss_type rss_type; 200 u8 *rss_hkey_user; 201 /* hkey in big endian */ 202 u32 *rss_hkey_user_be; 203 u32 *rss_indir_user; 204 205 u8 dcbx_cap; 206 u32 dcb_changes; 207 u8 max_cos; 208 u8 up_valid_bitmap; 209 u8 up_cos[HINIC_DCB_UP_MAX]; > 210 struct ieee_ets hinic_ieee_ets_default; > 211 struct ieee_ets hinic_ieee_ets; 212 struct ieee_pfc hinic_ieee_pfc; 213 struct hinic_dcb_config dcb_cfg; 214 struct hinic_dcb_config tmp_dcb_cfg; 215 struct hinic_dcb_config save_dcb_cfg; 216 unsigned long dcb_flags; 217 int disable_port_cnt; 218 /* lock for disable or enable traffic flow */ 219 struct semaphore dcb_sem; 220 221 bool heart_status; 222 223 struct hinic_intr_coal_info *intr_coalesce; 224 unsigned long last_moder_jiffies; 225 u32 adaptive_rx_coal; 226 u8 intr_coal_set_flag; 227 u32 his_link_speed; 228 /* interrupt coalesce must be different in virtual machine */ 229 bool in_vm; 230 bool is_vm_slave; 231 int is_bm_slave; 232 struct hinic_nic_stats stats; 233 /* lock for nic resource */ 234 struct mutex nic_mutex; 235 bool force_port_disable; 236 struct semaphore port_state_sem; 237 u8 link_status; 238 239 struct hinic_environment_info env_info; 240 struct hinic_adaptive_cfg adaptive_cfg; 241 242 /* pangea cpu affinity setting */ 243 bool force_affinity; 244 cpumask_t affinity_mask; 245 246 u32 lro_replenish_thld; 247 u16 rx_buff_len; 248 u32 page_order; 249 }; 250 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] rseq/mm_cid: change KABI consistency interface
by He Yujie 22 Nov '24

22 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB1OJX -------------------------------- The KABI consistency interface of the mmcid data structure is changed from KABI_REPLACE to KABI_DEPRECATE. Fixes: 7a35fa06727d ("rseq/mm_cid: change the mm_cid macro default status and keep KABI consistent") Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- include/linux/mm_types.h | 5 ++--- include/linux/sched.h | 11 +++++------ 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index fdc047bdbc49..4b9a8723d3eb 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -788,9 +788,8 @@ struct mm_struct { */ unsigned long mm_cid_next_scan; #else - KABI_REPLACE(struct mm_cid __percpu *pcpu_cid, - struct mm_cid __percpu *pcpu_cid) - KABI_REPLACE(unsigned long mm_cid_next_scan, unsigned long mm_cid_next_scan) + KABI_DEPRECATE(struct mm_cid __percpu *, pcpu_cid) + KABI_DEPRECATE(unsigned long, mm_cid_next_scan) #endif #ifdef CONFIG_MMU atomic_long_t pgtables_bytes; /* size of all page tables */ diff --git a/include/linux/sched.h b/include/linux/sched.h index b8be76b0c120..b8abb84382db 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1358,12 +1358,11 @@ struct task_struct { int mm_cid_active; /* Whether cid bitmap is active */ struct callback_head cid_work; #else - KABI_REPLACE(int mm_cid, int mm_cid) - KABI_REPLACE(int last_mm_cid, int last_mm_cid) - KABI_REPLACE(int migrate_from_cpu, int migrate_from_cpu) - KABI_REPLACE(int mm_cid_active, int mm_cid_active) - KABI_REPLACE(struct callback_head cid_work, - struct callback_head cid_work) + KABI_DEPRECATE(int, mm_cid) + KABI_DEPRECATE(int, last_mm_cid) + KABI_DEPRECATE(int, migrate_from_cpu) + KABI_DEPRECATE(int, mm_cid_active) + KABI_DEPRECATE(struct callback_head, cid_work) #endif struct tlbflush_unmap_batch tlb_ubc; -- 2.34.1

2 1

[PATCH OLK-6.6] ima: rot: remove misguiding message printing
by GONG Ruiqi 22 Nov '24

22 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB5YWN CVE: NA -------------------------------- Remove the ".. failed to self-initialize" printing following the failure of an RoT candidate's initialization, as it may raise unnessary concerns from users, who may be misguided and think this message indicates some sort of serious problems. Fixes: 036012386e44 ("ima: rot: Introduce basic framework") Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- security/integrity/ima/ima_rot.c | 1 - 1 file changed, 1 deletion(-) diff --git a/security/integrity/ima/ima_rot.c b/security/integrity/ima/ima_rot.c index 45d2ea314790..9c73389e2220 100644 --- a/security/integrity/ima/ima_rot.c +++ b/security/integrity/ima/ima_rot.c @@ -79,7 +79,6 @@ struct ima_rot * __init ima_rot_init(void) pr_info("%s initialized and taken as IMA RoT\n", ima_rots[i].name); return &ima_rots[i]; } - pr_info("%s failed to self-initialize\n", ima_rots[i].name); } return NULL; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1304/1304] drivers/mailbox/qcom-apcs-ipc-mailbox.c:65:35: warning: 'apcs_clk_match_table' defined but not used
by kernel test robot 22 Nov '24

22 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: c41cf355c959721c7269cc5ee7c6901cb47424a7 [1304/1304] mbox: qcom: add APCS child device for QCS404 config: x86_64-buildonly-randconfig-001-20241122 (https://download.01.org/0day-ci/archive/20241122/202411220931.AgGtoYjF-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411220931.AgGtoYjF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411220931.AgGtoYjF-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/mailbox/qcom-apcs-ipc-mailbox.c: In function 'qcom_apcs_ipc_probe': drivers/mailbox/qcom-apcs-ipc-mailbox.c:65:35: warning: unused variable 'apcs_clk_match_table' [-Wunused-variable] 65 | const struct of_device_id apcs_clk_match_table[] = { | ^~~~~~~~~~~~~~~~~~~~ drivers/mailbox/qcom-apcs-ipc-mailbox.c: At top level: >> drivers/mailbox/qcom-apcs-ipc-mailbox.c:65:35: warning: 'apcs_clk_match_table' defined but not used [-Wunused-const-variable=] vim +/apcs_clk_match_table +65 drivers/mailbox/qcom-apcs-ipc-mailbox.c 55 56 static int qcom_apcs_ipc_probe(struct platform_device *pdev) 57 { 58 struct qcom_apcs_ipc *apcs; 59 struct regmap *regmap; 60 struct resource *res; 61 unsigned long offset; 62 void __iomem *base; 63 unsigned long i; 64 int ret; > 65 const struct of_device_id apcs_clk_match_table[] = { 66 { .compatible = "qcom,msm8916-apcs-kpss-global", }, 67 { .compatible = "qcom,qcs404-apcs-apps-global", }, 68 {} 69 }; 70 71 apcs = devm_kzalloc(&pdev->dev, sizeof(*apcs), GFP_KERNEL); 72 if (!apcs) 73 return -ENOMEM; 74 75 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 76 base = devm_ioremap_resource(&pdev->dev, res); 77 if (IS_ERR(base)) 78 return PTR_ERR(base); 79 80 regmap = devm_regmap_init_mmio(&pdev->dev, base, &apcs_regmap_config); 81 if (IS_ERR(regmap)) 82 return PTR_ERR(regmap); 83 84 offset = (unsigned long)of_device_get_match_data(&pdev->dev); 85 86 apcs->regmap = regmap; 87 apcs->offset = offset; 88 89 /* Initialize channel identifiers */ 90 for (i = 0; i < ARRAY_SIZE(apcs->mbox_chans); i++) 91 apcs->mbox_chans[i].con_priv = (void *)i; 92 93 apcs->mbox.dev = &pdev->dev; 94 apcs->mbox.ops = &qcom_apcs_ipc_ops; 95 apcs->mbox.chans = apcs->mbox_chans; 96 apcs->mbox.num_chans = ARRAY_SIZE(apcs->mbox_chans); 97 98 ret = mbox_controller_register(&apcs->mbox); 99 if (ret) { 100 dev_err(&pdev->dev, "failed to register APCS IPC controller\n"); 101 return ret; 102 } 103 104 if (of_match_device(apcs_clk_match_table, &pdev->dev)) { 105 apcs->clk = platform_device_register_data(&pdev->dev, 106 "qcom-apcs-msm8916-clk", 107 -1, NULL, 0); 108 if (IS_ERR(apcs->clk)) 109 dev_err(&pdev->dev, "failed to register APCS clk\n"); 110 } 111 112 platform_set_drvdata(pdev, apcs); 113 114 return 0; 115 } 116 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 81e029d5dd0cae934243168eee37ef303ebcce38
by kernel test robot 22 Nov '24

22 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 81e029d5dd0cae934243168eee37ef303ebcce38 !13346 nilfs2: propagate directory read errors from nilfs_find_entry() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411212153.Ajpai55I-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411220134.YWoog3yH-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411220413.5RZED7zc-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411220702.De8xAify-lkp@intel.com drivers/regulator/qcom-rpmh-regulator.c:742:34: warning: unused variable 'rpmh_regulator_match_table' [-Wunused-const-variable] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-001-20241121 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- arm64-randconfig-002-20241121 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- include-linux-uaccess.h:warning:sve-may-be-used-uninitialized |-- arm64-randconfig-003-20241121 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- arm64-randconfig-004-20241121 | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- x86_64-allyesconfig | |-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241122 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-002-20241117 | `-- drivers-gpu-drm-amd-amdgpu-..-display-amdgpu_dm-.tmp_amdgpu_dm_crc.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-002-20241122 | |-- sound-isa-gus-gus_io.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-isa-gus-gus_volume.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20241122 | |-- crypto-cts.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- crypto-lzo.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-cpufreq-cpufreq_conservative.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-fpga-socfpga-a10.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-hwtracing-intel_th-core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-hwtracing-intel_th-gth.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-hwtracing-intel_th-msu-sink.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-hwtracing-intel_th-pti.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-i2c-busses-i2c-dln2.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-i2c-busses-i2c-jz4780.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-adc-axp288_adc.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-adc-qcom-pm8xxx-xoadc.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-dac-stm32-dac-core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-dac-stm32-dac.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-humidity-hts221_i2c.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-light-adjd_s311.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-light-tcs3472.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-pressure-ms5611_i2c.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-proximity-sx9500.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-iio-temperature-tmp006.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-joydev.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-axp2-pek.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-cm109.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-e3x0-button.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-gpio-beeper.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-mc13783-pwrbutton.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-pm8xxx-vibrator.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-pmic8xxx-pwrkey.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-tps65218-pwrbutton.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-twl4030-pwrbutton.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-input-misc-wm831x-on.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-leds-leds-as3645a.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-leds-leds-lp5521.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-leds-uleds.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-mailbox-mailbox-test.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-mfd-bcm59x.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-mtd-redboot.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-mtd-tests-mtd_nandecctest.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-mtd-tests-pagetest.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-mtd-tests-stresstest.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-phy-samsung-phy-exynos-dp-video.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-pinctrl-pinctrl-axp209.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-power-supply-bq27xxx_battery_i2c.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-power-supply-ltc2941-battery-gauge.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-regulator-max8952.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-regulator-mc13892-regulator.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-regulator-pv88080-regulator.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-regulator-tps65217-regulator.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-slimbus-qcom-ctrl.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-ssb-main.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-thermal-rockchip_thermal.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-host-ehci-platform.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-host-r8a66597-hcd.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-host-ssb-hcd.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-misc-ehset.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-misc-sisusbvga-sisusb.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-misc-yurex.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-phy-phy-generic.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-typec-tps6598x.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-w1-slaves-w1_ds2405.o:warning:objtool:missing-symbol-for-section-.exit.text | `-- samples-rpmsg-rpmsg_client_sample.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-004-20241117 | |-- drivers-mfd-rohm-bd718x7.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-watchdog-menz69_wdt.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-004-20241122 | |-- drivers-dax-bus.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-005-20241117 | |-- drivers-char-hw_random-zhaoxin-rng.o:warning:objtool:missing-symbol-for-section-.exit.text | `-- drivers-hwtracing-intel_th-msu-sink.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-005-20241122 | `-- drivers-regulator-qcom-rpmh-regulator.c:warning:unused-variable-rpmh_regulator_match_table |-- x86_64-buildonly-randconfig-006-20241118 | `-- drivers-spi-spi-uniphier.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20241122 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-001-20241122 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-002-20241122 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-003-20241122 | `-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init |-- x86_64-randconfig-004-20241122 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-006-20241122 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-011-20241122 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-161-20241122 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4 | |-- drivers-net-can-usb-kvaser_usb-kvaser_usb_hydra.c:warning:new_state-may-be-used-uninitialized | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-9.4-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-9.4-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 772m configs tested: 26 configs skipped: 138 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241121 gcc-14.2.0 arm64 randconfig-002-20241121 gcc-14.2.0 arm64 randconfig-003-20241121 gcc-14.2.0 arm64 randconfig-004-20241121 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241122 gcc-12 x86_64 buildonly-randconfig-002-20241122 clang-19 x86_64 buildonly-randconfig-003-20241122 gcc-12 x86_64 buildonly-randconfig-004-20241122 gcc-12 x86_64 buildonly-randconfig-005-20241122 clang-19 x86_64 buildonly-randconfig-006-20241122 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241122 gcc-12 x86_64 randconfig-002-20241122 clang-19 x86_64 randconfig-003-20241122 gcc-12 x86_64 randconfig-004-20241122 clang-19 x86_64 randconfig-005-20241122 gcc-12 x86_64 randconfig-006-20241122 clang-19 x86_64 randconfig-011-20241122 clang-19 x86_64 rhel-9.4 gcc-12 x86_64 rhel-9.4-func gcc-12 x86_64 rhel-9.4-kselftests gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1304/1304] drivers/regulator/qcom-rpmh-regulator.c:742:34: warning: unused variable 'rpmh_regulator_match_table'
by kernel test robot 22 Nov '24

22 Nov '24

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 46fc033eba42f5a4fb583b2ab53f0a9918468452 [1304/1304] regulator: add QCOM RPMh regulator driver config: x86_64-buildonly-randconfig-005-20241122 (https://download.01.org/0day-ci/archive/20241122/202411220702.De8xAify-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411220702.De8xAify-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411220702.De8xAify-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/regulator/qcom-rpmh-regulator.c:742:34: warning: unused variable 'rpmh_regulator_match_table' [-Wunused-const-variable] 742 | static const struct of_device_id rpmh_regulator_match_table[] = { | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. drivers/regulator/qcom-rpmh-regulator.c:33: warning: Enum value 'VRM' not described in enum 'rpmh_regulator_type' drivers/regulator/qcom-rpmh-regulator.c:33: warning: Enum value 'XOB' not described in enum 'rpmh_regulator_type' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'vreg' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'dev' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'node' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'pmic_id' not described in 'rpmh_regulator_init_vreg' drivers/regulator/qcom-rpmh-regulator.c:402: warning: Function parameter or member 'pmic_rpmh_data' not described in 'rpmh_regulator_init_vreg' vim +/rpmh_regulator_match_table +742 drivers/regulator/qcom-rpmh-regulator.c 741 > 742 static const struct of_device_id rpmh_regulator_match_table[] = { 743 { 744 .compatible = "qcom,pm8998-rpmh-regulators", 745 .data = pm8998_vreg_data, 746 }, 747 { 748 .compatible = "qcom,pmi8998-rpmh-regulators", 749 .data = pmi8998_vreg_data, 750 }, 751 { 752 .compatible = "qcom,pm8005-rpmh-regulators", 753 .data = pm8005_vreg_data, 754 }, 755 {} 756 }; 757 MODULE_DEVICE_TABLE(of, rpmh_regulator_match_table); 758 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 22 Nov '24

22 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 050ff2f361bf733d1dde505dea8b0f5ecb23507c [1297/1297] hwrng: Add Zhaoxin rng driver config: x86_64-buildonly-randconfig-005-20241117 (https://download.01.org/0day-ci/archive/20241122/202411220413.5RZED7zc-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411220413.5RZED7zc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411220413.5RZED7zc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2462/2462] drivers/firmware/efi/libstub/../../../../lib/decompress_unlzo.c:46:12: warning: variable 'level' set but not used
by kernel test robot 22 Nov '24

22 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e4ad5a7cc835421f3f2799db98ef2f9d5143f076 commit: e467807275555a062593aa1e89f3201644ef0ea5 [2462/2462] efi/libstub: implement generic EFI zboot config: arm64-randconfig-003-20241121 (https://download.01.org/0day-ci/archive/20241122/202411220334.X00IT0yA-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411220334.X00IT0yA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411220334.X00IT0yA-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/firmware/efi/libstub/zboot.c:21: drivers/firmware/efi/libstub/../../../../lib/decompress_unlzo.c: In function 'parse_header': >> drivers/firmware/efi/libstub/../../../../lib/decompress_unlzo.c:46:12: warning: variable 'level' set but not used [-Wunused-but-set-variable] 46 | u8 level = 0; | ^~~~~ drivers/firmware/efi/libstub/zboot.c: At top level: drivers/firmware/efi/libstub/zboot.c:162:1: warning: no previous prototype for 'efi_zboot_entry' [-Wmissing-prototypes] 162 | efi_zboot_entry(efi_handle_t handle, efi_system_table_t *systab) | ^~~~~~~~~~~~~~~ vim +/level +46 drivers/firmware/efi/libstub/../../../../lib/decompress_unlzo.c 7dd65feb6c603e Albin Tonnerre 2010-01-08 40 d97b07c54f34e8 Yinghai Lu 2014-08-08 41 STATIC inline long INIT parse_header(u8 *input, long *skip, long in_len) 7dd65feb6c603e Albin Tonnerre 2010-01-08 42 { 7dd65feb6c603e Albin Tonnerre 2010-01-08 43 int l; 7dd65feb6c603e Albin Tonnerre 2010-01-08 44 u8 *parse = input; 5a3f81a7029daf Lasse Collin 2011-01-12 45 u8 *end = input + in_len; 7dd65feb6c603e Albin Tonnerre 2010-01-08 @46 u8 level = 0; 7dd65feb6c603e Albin Tonnerre 2010-01-08 47 u16 version; 7dd65feb6c603e Albin Tonnerre 2010-01-08 48 5a3f81a7029daf Lasse Collin 2011-01-12 49 /* 5a3f81a7029daf Lasse Collin 2011-01-12 50 * Check that there's enough input to possibly have a valid header. 5a3f81a7029daf Lasse Collin 2011-01-12 51 * Then it is possible to parse several fields until the minimum 5a3f81a7029daf Lasse Collin 2011-01-12 52 * size may have been used. 5a3f81a7029daf Lasse Collin 2011-01-12 53 */ 5a3f81a7029daf Lasse Collin 2011-01-12 54 if (in_len < HEADER_SIZE_MIN) 5a3f81a7029daf Lasse Collin 2011-01-12 55 return 0; 5a3f81a7029daf Lasse Collin 2011-01-12 56 7dd65feb6c603e Albin Tonnerre 2010-01-08 57 /* read magic: 9 first bits */ 7dd65feb6c603e Albin Tonnerre 2010-01-08 58 for (l = 0; l < 9; l++) { 7dd65feb6c603e Albin Tonnerre 2010-01-08 59 if (*parse++ != lzop_magic[l]) 7dd65feb6c603e Albin Tonnerre 2010-01-08 60 return 0; 7dd65feb6c603e Albin Tonnerre 2010-01-08 61 } 7dd65feb6c603e Albin Tonnerre 2010-01-08 62 /* get version (2bytes), skip library version (2), 7dd65feb6c603e Albin Tonnerre 2010-01-08 63 * 'need to be extracted' version (2) and 7dd65feb6c603e Albin Tonnerre 2010-01-08 64 * method (1) */ 7dd65feb6c603e Albin Tonnerre 2010-01-08 65 version = get_unaligned_be16(parse); 7dd65feb6c603e Albin Tonnerre 2010-01-08 66 parse += 7; 7dd65feb6c603e Albin Tonnerre 2010-01-08 67 if (version >= 0x0940) 7dd65feb6c603e Albin Tonnerre 2010-01-08 68 level = *parse++; 7dd65feb6c603e Albin Tonnerre 2010-01-08 69 if (get_unaligned_be32(parse) & HEADER_HAS_FILTER) 7dd65feb6c603e Albin Tonnerre 2010-01-08 70 parse += 8; /* flags + filter info */ 7dd65feb6c603e Albin Tonnerre 2010-01-08 71 else 7dd65feb6c603e Albin Tonnerre 2010-01-08 72 parse += 4; /* flags */ 7dd65feb6c603e Albin Tonnerre 2010-01-08 73 5a3f81a7029daf Lasse Collin 2011-01-12 74 /* 5a3f81a7029daf Lasse Collin 2011-01-12 75 * At least mode, mtime_low, filename length, and checksum must 5a3f81a7029daf Lasse Collin 2011-01-12 76 * be left to be parsed. If also mtime_high is present, it's OK 5a3f81a7029daf Lasse Collin 2011-01-12 77 * because the next input buffer check is after reading the 5a3f81a7029daf Lasse Collin 2011-01-12 78 * filename length. 5a3f81a7029daf Lasse Collin 2011-01-12 79 */ 5a3f81a7029daf Lasse Collin 2011-01-12 80 if (end - parse < 8 + 1 + 4) 5a3f81a7029daf Lasse Collin 2011-01-12 81 return 0; 5a3f81a7029daf Lasse Collin 2011-01-12 82 7dd65feb6c603e Albin Tonnerre 2010-01-08 83 /* skip mode and mtime_low */ 7dd65feb6c603e Albin Tonnerre 2010-01-08 84 parse += 8; 7dd65feb6c603e Albin Tonnerre 2010-01-08 85 if (version >= 0x0940) 7dd65feb6c603e Albin Tonnerre 2010-01-08 86 parse += 4; /* skip mtime_high */ 7dd65feb6c603e Albin Tonnerre 2010-01-08 87 7dd65feb6c603e Albin Tonnerre 2010-01-08 88 l = *parse++; 7dd65feb6c603e Albin Tonnerre 2010-01-08 89 /* don't care about the file name, and skip checksum */ 5a3f81a7029daf Lasse Collin 2011-01-12 90 if (end - parse < l + 4) 5a3f81a7029daf Lasse Collin 2011-01-12 91 return 0; 7dd65feb6c603e Albin Tonnerre 2010-01-08 92 parse += l + 4; 7dd65feb6c603e Albin Tonnerre 2010-01-08 93 7dd65feb6c603e Albin Tonnerre 2010-01-08 94 *skip = parse - input; 7dd65feb6c603e Albin Tonnerre 2010-01-08 95 return 1; 7dd65feb6c603e Albin Tonnerre 2010-01-08 96 } 7dd65feb6c603e Albin Tonnerre 2010-01-08 97 :::::: The code at line 46 was first introduced by commit :::::: 7dd65feb6c603e13eba501c34c662259ab38e70e lib: add support for LZO-compressed kernels :::::: TO: Albin Tonnerre <albin.tonnerre(a)free-electrons.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1513/1513] mm/memory.c:5277:17: warning: variable 'nr_pages' set but not used
by kernel test robot 22 Nov '24

22 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ab293c3a32ba6594fd24cd7ecd4a4a00ede0cd65 commit: 3bfa35ccde9e52ca74fed047eb4d89be32dd9e5e [1513/1513] mm/numa: no task_numa_fault() call if PTE is changed config: x86_64-kexec (https://download.01.org/0day-ci/archive/20241122/202411220229.ELIipVRO-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411220229.ELIipVRO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411220229.ELIipVRO-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory.c:43: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/memory.c:44: include/linux/mm_inline.h:47:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 47 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:49:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 49 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/memory.c:5277:17: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 5277 | int flags = 0, nr_pages; | ^ 8 warnings generated. vim +/nr_pages +5277 mm/memory.c f569661eacc258 Baolin Wang 2024-05-11 5266 2b7403035459c7 Souptick Joarder 2018-08-23 5267 static vm_fault_t do_numa_page(struct vm_fault *vmf) d10e63f29488b0 Mel Gorman 2012-10-25 5268 { 82b0f8c39a3869 Jan Kara 2016-12-14 5269 struct vm_area_struct *vma = vmf->vma; d5e6c8d5790088 Kefeng Wang 2023-11-27 5270 struct folio *folio = NULL; d5e6c8d5790088 Kefeng Wang 2023-11-27 5271 int nid = NUMA_NO_NODE; 2cb37064a2b82c Baolin Wang 2024-06-22 5272 bool writable = false, ignore_writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5273 bool pte_write_upgrade = vma_wants_manual_pte_write_upgrade(vma); 90572890d20252 Peter Zijlstra 2013-10-07 5274 int last_cpupid; cbee9f88ec1b8d Peter Zijlstra 2012-10-25 5275 int target_nid; 04a8645304500b Aneesh Kumar K.V 2019-03-05 5276 pte_t pte, old_pte; 2cb37064a2b82c Baolin Wang 2024-06-22 @5277 int flags = 0, nr_pages; d10e63f29488b0 Mel Gorman 2012-10-25 5278 d10e63f29488b0 Mel Gorman 2012-10-25 5279 /* e2491c31fb10ae John Hubbard 2024-05-25 5280 * The pte cannot be used safely until we verify, while holding the page e2491c31fb10ae John Hubbard 2024-05-25 5281 * table lock, that its contents have not changed during fault handling. d10e63f29488b0 Mel Gorman 2012-10-25 5282 */ 82b0f8c39a3869 Jan Kara 2016-12-14 5283 spin_lock(vmf->ptl); e2491c31fb10ae John Hubbard 2024-05-25 5284 /* Read the live PTE from the page tables: */ e2491c31fb10ae John Hubbard 2024-05-25 5285 old_pte = ptep_get(vmf->pte); e2491c31fb10ae John Hubbard 2024-05-25 5286 e2491c31fb10ae John Hubbard 2024-05-25 5287 if (unlikely(!pte_same(old_pte, vmf->orig_pte))) { 82b0f8c39a3869 Jan Kara 2016-12-14 5288 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5289 return 0; 4daae3b4b9e49b Mel Gorman 2012-11-02 5290 } 4daae3b4b9e49b Mel Gorman 2012-11-02 5291 04a8645304500b Aneesh Kumar K.V 2019-03-05 5292 pte = pte_modify(old_pte, vma->vm_page_prot); d10e63f29488b0 Mel Gorman 2012-10-25 5293 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5294 /* 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5295 * Detect now whether the PTE could be writable; this information 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5296 * is only valid while holding the PT lock. 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5297 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5298 writable = pte_write(pte); 2cb37064a2b82c Baolin Wang 2024-06-22 5299 if (!writable && pte_write_upgrade && 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5300 can_change_pte_writable(vma, vmf->address, pte)) 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5301 writable = true; 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5302 d5e6c8d5790088 Kefeng Wang 2023-11-27 5303 folio = vm_normal_folio(vma, vmf->address, pte); d5e6c8d5790088 Kefeng Wang 2023-11-27 5304 if (!folio || folio_is_zone_device(folio)) b99a342d4f11a5 Huang Ying 2021-04-29 5305 goto out_map; d10e63f29488b0 Mel Gorman 2012-10-25 5306 6688cc05473b36 Peter Zijlstra 2013-10-07 5307 /* bea66fbd11af1c Mel Gorman 2015-03-25 5308 * Avoid grouping on RO pages in general. RO pages shouldn't hurt as bea66fbd11af1c Mel Gorman 2015-03-25 5309 * much anyway since they can be in shared cache state. This misses bea66fbd11af1c Mel Gorman 2015-03-25 5310 * the case where a mapping is writable but the process never writes bea66fbd11af1c Mel Gorman 2015-03-25 5311 * to it but pte_write gets cleared during protection updates and bea66fbd11af1c Mel Gorman 2015-03-25 5312 * pte_dirty has unpredictable behaviour between PTE scan updates, bea66fbd11af1c Mel Gorman 2015-03-25 5313 * background writeback, dirty balancing and application behaviour. bea66fbd11af1c Mel Gorman 2015-03-25 5314 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5315 if (!writable) 6688cc05473b36 Peter Zijlstra 2013-10-07 5316 flags |= TNF_NO_GROUP; 6688cc05473b36 Peter Zijlstra 2013-10-07 5317 dabe1d992414a6 Rik van Riel 2013-10-07 5318 /* d5e6c8d5790088 Kefeng Wang 2023-11-27 5319 * Flag if the folio is shared between multiple address spaces. This dabe1d992414a6 Rik van Riel 2013-10-07 5320 * is later used when determining whether to group tasks together dabe1d992414a6 Rik van Riel 2013-10-07 5321 */ b8eba2d7e4a309 David Hildenbrand 2024-05-11 5322 if (folio_likely_mapped_shared(folio) && (vma->vm_flags & VM_SHARED)) dabe1d992414a6 Rik van Riel 2013-10-07 5323 flags |= TNF_SHARED; dabe1d992414a6 Rik van Riel 2013-10-07 5324 d5e6c8d5790088 Kefeng Wang 2023-11-27 5325 nid = folio_nid(folio); 2cb37064a2b82c Baolin Wang 2024-06-22 5326 nr_pages = folio_nr_pages(folio); 33024536bafd91 Huang Ying 2022-07-13 5327 /* 33024536bafd91 Huang Ying 2022-07-13 5328 * For memory tiering mode, cpupid of slow memory page is used 33024536bafd91 Huang Ying 2022-07-13 5329 * to record page access time. So use default value. 33024536bafd91 Huang Ying 2022-07-13 5330 */ 33024536bafd91 Huang Ying 2022-07-13 5331 if ((sysctl_numa_balancing_mode & NUMA_BALANCING_MEMORY_TIERING) && d5e6c8d5790088 Kefeng Wang 2023-11-27 5332 !node_is_toptier(nid)) 33024536bafd91 Huang Ying 2022-07-13 5333 last_cpupid = (-1 & LAST_CPUPID_MASK); 33024536bafd91 Huang Ying 2022-07-13 5334 else 28e1ec746768bb Kefeng Wang 2023-11-27 5335 last_cpupid = folio_last_cpupid(folio); bf7c2ab764599b Kefeng Wang 2023-11-27 5336 target_nid = numa_migrate_prep(folio, vma, vmf->address, nid, &flags); 98fa15f34cb379 Anshuman Khandual 2019-03-05 5337 if (target_nid == NUMA_NO_NODE) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5338 folio_put(folio); b99a342d4f11a5 Huang Ying 2021-04-29 5339 goto out_map; 4daae3b4b9e49b Mel Gorman 2012-11-02 5340 } b99a342d4f11a5 Huang Ying 2021-04-29 5341 pte_unmap_unlock(vmf->pte, vmf->ptl); 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5342 writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5343 ignore_writable = true; 4daae3b4b9e49b Mel Gorman 2012-11-02 5344 4daae3b4b9e49b Mel Gorman 2012-11-02 5345 /* Migrate to the requested node */ d5e6c8d5790088 Kefeng Wang 2023-11-27 5346 if (migrate_misplaced_folio(folio, vma, target_nid)) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5347 nid = target_nid; 6688cc05473b36 Peter Zijlstra 2013-10-07 5348 flags |= TNF_MIGRATED; 3bfa35ccde9e52 Zi Yan 2024-08-09 5349 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5350 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5351 } 3bfa35ccde9e52 Zi Yan 2024-08-09 5352 074c238177a75f Mel Gorman 2015-03-25 5353 flags |= TNF_MIGRATE_FAIL; c7ad08804fae5b Hugh Dickins 2023-06-08 5354 vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, c7ad08804fae5b Hugh Dickins 2023-06-08 5355 vmf->address, &vmf->ptl); c7ad08804fae5b Hugh Dickins 2023-06-08 5356 if (unlikely(!vmf->pte)) 3bfa35ccde9e52 Zi Yan 2024-08-09 5357 return 0; c33c794828f212 Ryan Roberts 2023-06-12 5358 if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) { b99a342d4f11a5 Huang Ying 2021-04-29 5359 pte_unmap_unlock(vmf->pte, vmf->ptl); d10e63f29488b0 Mel Gorman 2012-10-25 5360 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5361 } b99a342d4f11a5 Huang Ying 2021-04-29 5362 out_map: b99a342d4f11a5 Huang Ying 2021-04-29 5363 /* b99a342d4f11a5 Huang Ying 2021-04-29 5364 * Make it present again, depending on how arch implements b99a342d4f11a5 Huang Ying 2021-04-29 5365 * non-accessible ptes, some can allow access by kernel mode. b99a342d4f11a5 Huang Ying 2021-04-29 5366 */ 2cb37064a2b82c Baolin Wang 2024-06-22 5367 if (folio && folio_test_large(folio)) 2cb37064a2b82c Baolin Wang 2024-06-22 5368 numa_rebuild_large_mapping(vmf, vma, folio, pte, ignore_writable, 2cb37064a2b82c Baolin Wang 2024-06-22 5369 pte_write_upgrade); 2cb37064a2b82c Baolin Wang 2024-06-22 5370 else 2cb37064a2b82c Baolin Wang 2024-06-22 5371 numa_rebuild_single_mapping(vmf, vma, vmf->address, vmf->pte, 2cb37064a2b82c Baolin Wang 2024-06-22 5372 writable); b99a342d4f11a5 Huang Ying 2021-04-29 5373 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5374 3bfa35ccde9e52 Zi Yan 2024-08-09 5375 if (nid != NUMA_NO_NODE) 3bfa35ccde9e52 Zi Yan 2024-08-09 5376 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5377 return 0; d10e63f29488b0 Mel Gorman 2012-10-25 5378 } d10e63f29488b0 Mel Gorman 2012-10-25 5379 :::::: The code at line 5277 was first introduced by commit :::::: 2cb37064a2b82cd8ebeeaaed21259b5912dff51d mm: support multi-size THP numa balancing :::::: TO: Baolin Wang <baolin.wang(a)linux.alibaba.com> :::::: CC: Liu Shixin <liushixin2(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 22 Nov '24

22 Nov '24

Hi Johannes, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 81ceed41d0c2b2c9300de7bc30c1451680257f52 [1297/1297] watchdog: add driver for the MEN 16z069 IP-Core config: x86_64-buildonly-randconfig-004-20241117 (https://download.01.org/0day-ci/archive/20241122/202411220134.YWoog3yH-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411220134.YWoog3yH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411220134.YWoog3yH-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/watchdog/menz69_wdt.c:10: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'men_z069_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1558:1: note: in expansion of macro 'module_exit' 1558 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/mcb.h:126:9: note: in expansion of macro 'module_driver' 126 | module_driver(__mcb_driver, mcb_register_driver, mcb_unregister_driver); | ^~~~~~~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/mcb.h:15, from drivers/watchdog/menz69_wdt.c:9: drivers/watchdog/menz69_wdt.c:166:19: note: 'cleanup_module' target declared here 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1554:20: note: in definition of macro 'module_driver' 1554 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'men_z069_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1553:1: note: in expansion of macro 'module_init' 1553 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/mcb.h:126:9: note: in expansion of macro 'module_driver' 126 | module_driver(__mcb_driver, mcb_register_driver, mcb_unregister_driver); | ^~~~~~~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ drivers/watchdog/menz69_wdt.c:166:19: note: 'init_module' target declared here 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1549:19: note: in definition of macro 'module_driver' 1549 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tpm: Lock TPM chip in tpm_pm_suspend() first
by Chen Zhongjin 21 Nov '24

21 Nov '24

From: Jarkko Sakkinen <jarkko(a)kernel.org> mainline inclusion from mainline-v6.12-rc1 commit 9265fed6db601ee2ec47577815387458ef4f047a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KRG CVE: CVE-2024-53085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour. Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved. Cc: stable(a)vger.kernel.org # v6.4+ Fixes: 99d464506255 ("tpm: Prevent hwrng from activating during resume") Reported-by: Mike Seo <mikeseohyungjin(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219383 Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Tested-by: Mike Seo <mikeseohyungjin(a)gmail.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Conflicts: drivers/char/tpm/tpm-interface.c [df745e25098d ("tpm: Lazily flush the auth session") is not merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/char/tpm/tpm-chip.c | 4 ---- drivers/char/tpm/tpm-interface.c | 28 ++++++++++++++++++++-------- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 42b1062e33cd5..78999f7f248cb 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -519,10 +519,6 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) { struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng); - /* Give back zero bytes, as TPM chip has not yet fully resumed: */ - if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) - return 0; - return tpm_get_random(chip, data, max); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 66b16d26eecc7..9789aad5dd0df 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -394,6 +394,13 @@ int tpm_pm_suspend(struct device *dev) if (!chip) return -ENODEV; + rc = tpm_try_get_ops(chip); + if (rc) { + /* Can be safely set out of locks, as no action cannot race: */ + chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED) goto suspended; @@ -401,18 +408,16 @@ int tpm_pm_suspend(struct device *dev) !pm_suspend_via_firmware()) goto suspended; - rc = tpm_try_get_ops(chip); - if (!rc) { - if (chip->flags & TPM_CHIP_FLAG_TPM2) - tpm2_shutdown(chip, TPM2_SU_STATE); - else - rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); - - tpm_put_ops(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) { + tpm2_shutdown(chip, TPM2_SU_STATE); + goto suspended; } + rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); + suspended: chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + tpm_put_ops(chip); if (rc) dev_err(dev, "Ignoring error %d while suspending\n", rc); @@ -462,11 +467,18 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max) if (!chip) return -ENODEV; + /* Give back zero bytes, as TPM chip has not yet fully resumed: */ + if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) { + rc = 0; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_TPM2) rc = tpm2_get_random(chip, out, max); else rc = tpm1_get_random(chip, out, max); +out: tpm_put_ops(chip); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6] bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
by Xiaomeng Zhang 21 Nov '24

21 Nov '24

From: Kuan-Wei Chiu <visitorckw(a)gmail.com> stable inclusion from stable-v6.6.55 commit c2d9f9a7837ab29ccae0c42252f17d436bf0a501 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0MX4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f04e2ad394e2755d0bb2d858ecb5598718bf00d5 ] When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null Although the C standard does not explicitly state whether calling qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of library functions) mentions: "Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined." To avoid this, add an early return when nf_link_info is NULL to prevent calling qsort with a NULL pointer. Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Reviewed-by: Quentin Monnet <qmo(a)kernel.org> Link: https://lore.kernel.org/bpf/20240910150207.3179306-1-visitorckw@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wen Zhiwei <wenzhiwei(a)kylinos.cn> --- tools/bpf/bpftool/net.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c index fd54ff436493..28e9417a5c2e 100644 --- a/tools/bpf/bpftool/net.c +++ b/tools/bpf/bpftool/net.c @@ -819,6 +819,9 @@ static void show_link_netfilter(void) nf_link_count++; } + if (!nf_link_info) + return; + qsort(nf_link_info, nf_link_count, sizeof(*nf_link_info), netfilter_link_compar); for (id = 0; id < nf_link_count; id++) { -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 21 Nov '24

21 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 4d516770f81434cde260d33430626e3880b9902e [1297/1297] intel_th: msu-sink: An example msu buffer "sink" config: x86_64-buildonly-randconfig-005-20241117 (https://download.01.org/0day-ci/archive/20241121/202411212153.Ajpai55I-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241121/202411212153.Ajpai55I-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411212153.Ajpai55I-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/amdgpu: add missing size check in
by Wang Jinchao 21 Nov '24

21 Nov '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v6.1.117 commit 25d7e84343e1235b667cf5226c3934fdf36f0df6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AT9 CVE: CVE-2024-50282 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 4d75b9468021c73108b4439794d69e892b1d24e3 upstream. Avoid a possible buffer overflow if size is larger than 4K. Reviewed-by: Yang Wang <kevinyang.wang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434) Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Jinchao <wangjinchao(a)xfusion.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index 3cca3f07f34d..a8dd63f270c3 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -419,7 +419,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user ssize_t result = 0; int r; - if (size & 0x3 || *pos & 0x3) + if (size > 4096 || size & 0x3 || *pos & 0x3) return -EINVAL; r = pm_runtime_get_sync(adev_to_drm(adev)->dev); -- 2.47.0

2 1