- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_resctrl.c:1741:19: warning: variable 'times' set but not used
by kernel test robot 07 Nov '24

07 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: e0aed913079d6b30aafeb50318f26d49bfb3d95b [1231/1231] arm64/mpam: resctrl: Add rmid file in resctrl sysfs config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241107/202411070826.nwr0luMf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241107/202411070826.nwr0luMf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411070826.nwr0luMf-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_resctrl.c:221:1: warning: conflicting types for 'mpam_get_raw_resctrl_resource' due to enum/integer mismatch; have 'struct raw_resctrl_resource *(enum resctrl_resource_level)' [-Wenum-int-mismatch] 221 | mpam_get_raw_resctrl_resource(enum resctrl_resource_level level) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/kernel/mpam/mpam_resctrl.c:48: arch/arm64/kernel/mpam/mpam_internal.h:327:1: note: previous declaration of 'mpam_get_raw_resctrl_resource' with type 'struct raw_resctrl_resource *(u32)' {aka 'struct raw_resctrl_resource *(unsigned int)'} 327 | mpam_get_raw_resctrl_resource(u32 level); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:525:5: warning: no previous prototype for 'closid_bitmap_init' [-Wmissing-prototypes] 525 | int closid_bitmap_init(void) | ^~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:1319:5: warning: no previous prototype for 'cpus_ctrl_write' [-Wmissing-prototypes] 1319 | int cpus_ctrl_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask, | ^~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:1374:5: warning: no previous prototype for 'cpus_mon_write' [-Wmissing-prototypes] 1374 | int cpus_mon_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask, | ^~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c: In function 'rdt_last_cmd_printf': arch/arm64/kernel/mpam/mpam_resctrl.c:1554:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 1554 | seq_buf_vprintf(&last_cmd_status, fmt, ap); | ^~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c: In function 'resctrl_group_rmid_show': >> arch/arm64/kernel/mpam/mpam_resctrl.c:1741:19: warning: variable 'times' set but not used [-Wunused-but-set-variable] 1741 | u32 flag, times; | ^~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c: In function 'mpam_resctrl_update_component_cfg': arch/arm64/kernel/mpam/mpam_resctrl.c:2083:25: warning: implicit conversion from 'enum resctrl_ctrl_type' to 'enum rdt_event_id' [-Wenum-conversion] 2083 | type, slave_mpam_cfg); | ^~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:570: warning: Function parameter or member 'cols' not described in 'rmid_transform' vim +/times +1741 arch/arm64/kernel/mpam/mpam_resctrl.c 1735 1736 static int resctrl_group_rmid_show(struct kernfs_open_file *of, 1737 struct seq_file *s, void *v) 1738 { 1739 int ret = 0; 1740 struct rdtgroup *rdtgrp; > 1741 u32 flag, times; 1742 1743 hw_alloc_times_validate(times, flag); 1744 1745 rdtgrp = resctrl_group_kn_lock_live(of->kn); 1746 if (rdtgrp) { 1747 if (flag) 1748 seq_printf(s, "%u-%u\n", rdtgrp->mon.rmid, 1749 rdtgrp->mon.rmid + 1); 1750 else 1751 seq_printf(s, "%u\n", rdtgrp->mon.rmid); 1752 } else 1753 ret = -ENOENT; 1754 resctrl_group_kn_unlock(of->kn); 1755 1756 return ret; 1757 } 1758 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1225/1225] drivers/base/regmap/regmap.o: warning: objtool: _regmap_raw_read()+0x247: unreachable instruction
by kernel test robot 07 Nov '24

07 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: d98c83e735e83721d3f995fe2bd190cf8aec8d78 [1225/1225] regmap: fix NULL deref on lookup config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241107/202411070506.bB360ucR-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241107/202411070506.bB360ucR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411070506.bB360ucR-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/base/regmap/regmap.o: warning: objtool: _regmap_raw_read()+0x247: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1225/1225] drivers/hwmon/k10temp.o: warning: objtool: read_tempreg_nb_zen()+0x11b: unreachable instruction
by kernel test robot 07 Nov '24

07 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: c230f66f19ad44afbef0bbf2a49c0168a5211f37 [1225/1225] hwmon: (k10temp) Create common functions and macros for Zen CPU families config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241107/202411070216.fFHEZGdK-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241107/202411070216.fFHEZGdK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411070216.fFHEZGdK-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/hwmon/k10temp.o: warning: objtool: read_tempreg_nb_zen()+0x11b: unreachable instruction drivers/hwmon/k10temp.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 99db8adce903def72c36be0dbc5a2f459422b9bc
by kernel test robot 07 Nov '24

07 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 99db8adce903def72c36be0dbc5a2f459422b9bc !13055 net: avoid potential underflow in qdisc_pkt_len_init() with UFO Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-003-20241106 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- x86_64-allyesconfig | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-buildonly-randconfig-001-20241106 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | `-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE |-- x86_64-buildonly-randconfig-002-20241106 | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init-Werror-Wimplicit-function-declaration | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20241106 | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-buildonly-randconfig-005-20241106 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-003-20241106 | |-- security-integrity-ima-ima.h:warning:struct-ima_digest-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement `-- x86_64-randconfig-006-20241106 `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used elapsed time: 723m configs tested: 23 configs skipped: 127 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241106 gcc-14.2.0 arm64 randconfig-002-20241106 gcc-14.2.0 arm64 randconfig-003-20241106 clang-20 arm64 randconfig-004-20241106 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241106 clang-19 x86_64 buildonly-randconfig-002-20241106 clang-19 x86_64 buildonly-randconfig-003-20241106 clang-19 x86_64 buildonly-randconfig-004-20241106 gcc-12 x86_64 buildonly-randconfig-005-20241106 gcc-12 x86_64 buildonly-randconfig-006-20241106 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241106 clang-19 x86_64 randconfig-002-20241106 gcc-11 x86_64 randconfig-003-20241106 gcc-12 x86_64 randconfig-004-20241106 gcc-12 x86_64 randconfig-005-20241106 clang-19 x86_64 randconfig-006-20241106 gcc-11 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_ctrlmon.c:560:5: warning: no previous prototype for 'resctrl_group_mondata_show'
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 6892e52d6ed229b7973aae9e1e98819867c34dd7 [1231/1231] arm64/mpam: Split header files into suitable location config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241106/202411062351.mcuwA9ll-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411062351.mcuwA9ll-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411062351.mcuwA9ll-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'add_schema': arch/arm64/kernel/mpam/mpam_ctrlmon.c:54:37: warning: variable 'sc_hdl' set but not used [-Wunused-but-set-variable] 54 | struct resctrl_schema_ctrl *sc_hdl = NULL; | ^~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c:53:37: warning: variable 'sc_pri' set but not used [-Wunused-but-set-variable] 53 | struct resctrl_schema_ctrl *sc_pri = NULL; | ^~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: At top level: >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:560:5: warning: no previous prototype for 'resctrl_group_mondata_show' [-Wmissing-prototypes] 560 | int resctrl_group_mondata_show(struct seq_file *m, void *arg) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_mkdir_mondata_all_subdir': arch/arm64/kernel/mpam/mpam_ctrlmon.c:745:54: warning: variable 'rr' set but not used [-Wunused-but-set-variable] 745 | struct raw_resctrl_resource *rr; | ^~ arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 's' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'r' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'schema_name' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'type' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'closid' not described in 'show_doms' vim +/resctrl_group_mondata_show +560 arch/arm64/kernel/mpam/mpam_ctrlmon.c d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 559 b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 @560 int resctrl_group_mondata_show(struct seq_file *m, void *arg) b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 561 { b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 562 struct kernfs_open_file *of = m->private; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 563 struct rdtgroup *rdtgrp; 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 564 struct rdt_domain *d; 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 565 struct resctrl_resource *r; f2a58a19ec564be arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 566 union mon_data_bits md; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 567 int ret = 0; 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 568 char *resname = get_resource_name(kernfs_node_name(of)); 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 569 u64 usage; 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 570 int pmg; 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 571 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 572 if (!resname) 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 573 return -ENOMEM; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 574 b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 575 rdtgrp = resctrl_group_kn_lock_live(of->kn); 0bf8b142ee73268 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 576 if (!rdtgrp) { 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 577 ret = -ENOENT; 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 578 goto out; 0bf8b142ee73268 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 579 } b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 580 f2a58a19ec564be arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 581 md.priv = of->kn->priv; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 582 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 583 r = mpam_resctrl_get_resource(md.u.rid); 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 584 b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 585 /* show monitor data */ 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 586 d = mpam_find_domain(r, md.u.domid, NULL); 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 587 if (IS_ERR_OR_NULL(d)) { 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 588 pr_warn("Could't find domain id %d\n", md.u.domid); 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 589 ret = -ENOENT; 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 590 goto out; 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 591 } 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 592 d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 593 usage = resctrl_dom_mon_data(r, d, md.priv); d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 594 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 595 /* 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 596 * if this rdtgroup is ctrlmon group, also collect it's 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 597 * mon groups' monitor data. 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 598 */ 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 599 if (rdtgrp->type == RDTCTRL_GROUP) { 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 600 struct list_head *head; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 601 struct rdtgroup *entry; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 602 hw_closid_t hw_closid; 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 603 hw_monid_t hw_monid; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 604 enum resctrl_conf_type type = CDP_CODE; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 605 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 606 resctrl_cdp_map(clos, rdtgrp->closid.reqpartid, 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 607 CDP_CODE, hw_closid); 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 608 /* CDP_CODE share the same closid with CDP_BOTH */ 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 609 if (md.u.partid != hw_closid_val(hw_closid)) 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 610 type = CDP_DATA; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 611 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 612 head = &rdtgrp->mon.crdtgrp_list; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 613 list_for_each_entry(entry, head, mon.crdtgrp_list) { 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 614 resctrl_cdp_map(clos, entry->closid.reqpartid, 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 615 type, hw_closid); 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 616 md.u.partid = hw_closid_val(hw_closid); 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 617 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 618 ret = mpam_rmid_to_partid_pmg(entry->mon.rmid, 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 619 NULL, &pmg); 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 620 if (ret) 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 621 return ret; 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 622 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 623 md.u.pmg = pmg; 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 624 resctrl_cdp_map(mon, get_rmid_mon(entry->mon.rmid, 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 625 r->rid), type, hw_monid); 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 626 md.u.mon = hw_monid_val(hw_monid); 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 627 d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 628 usage += resctrl_dom_mon_data(r, d, md.priv); 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 629 } 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 630 } 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 631 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 632 seq_printf(m, "%llu\n", usage); b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 633 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 634 out: 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 635 put_resource_name(resname); b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 636 resctrl_group_kn_unlock(of->kn); b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 637 return ret; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 638 } b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 639 :::::: The code at line 560 was first introduced by commit :::::: b4617397605d3b8842d9e39bb8921223eccc2f92 arm64/mpam: support mondata fields :::::: TO: Xie XiuQi <xiexiuqi(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1225/1225] mm/cma.o: warning: objtool: cma_activate_area()+0x1a9: unreachable instruction
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 5f0e34d2aceec67c169be7599d82f0e8519c37f7 [1225/1225] mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411062106.mPTnywkZ-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411062106.mPTnywkZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411062106.mPTnywkZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/cma.o: warning: objtool: cma_activate_area()+0x1a9: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] RDMA/hns: Fix DCA mmap area PUAF
by Chengchang Tang 06 Nov '24

06 Nov '24

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2DWH ---------------------------------------------------------------------- DCA mmap area would be freed after driver reseted or hot unplugged. At this time, the vma is still valid, which may lead to a PUAF. Using rdma_user_mmap_io() to remap this area to ensure the vma is zapped after dirver removal. Fixes: d3caaebdbfe9 ("RDMA/hns: Optimize user DCA perfermance by sharing DCA status") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_dca.c | 3 +- drivers/infiniband/hw/hns/hns_roce_main.c | 39 ++++------------------- 2 files changed, 9 insertions(+), 33 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index 91b6b65c83df..65ed7666a826 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -1181,7 +1181,8 @@ static void init_udca_status(struct hns_roce_ucontext *uctx, int udca_max_qps, return; ctx->dca_mmap_entry = hns_roce_user_mmap_entry_insert(ib_uctx, - (u64)kaddr, size, HNS_ROCE_MMAP_TYPE_DCA); + (u64)virt_to_phys(kaddr), size, + HNS_ROCE_MMAP_TYPE_DCA); if (!ctx->dca_mmap_entry) { free_pages_exact(kaddr, size); return; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 27b723a40abe..3872e777c74b 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -674,36 +674,6 @@ static void hns_roce_dealloc_ucontext(struct ib_ucontext *ibcontext) ida_free(&hr_dev->uar_ida.ida, (int)context->uar.logic_idx); } -static int mmap_dca(struct ib_ucontext *context, struct vm_area_struct *vma) -{ - struct hns_roce_ucontext *uctx = to_hr_ucontext(context); - struct hns_roce_dca_ctx *ctx = &uctx->dca_ctx; - struct page **pages; - unsigned long num; - int ret; - - if ((vma->vm_end - vma->vm_start != (ctx->status_npage * PAGE_SIZE) || - return -EINVAL; - - if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) - return -EPERM; - - if (!ctx->buf_status) - return -EOPNOTSUPP; - - pages = kcalloc(ctx->status_npage, sizeof(struct page *), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - for (num = 0; num < ctx->status_npage; num++) - pages[num] = virt_to_page(ctx->buf_status + num * PAGE_SIZE); - - ret = vm_insert_pages(vma, vma->vm_start, pages, &num); - kfree(pages); - return ret; -} - static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) { struct hns_roce_dev *hr_dev = to_hr_dev(uctx->device); @@ -728,8 +698,13 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; case HNS_ROCE_MMAP_TYPE_DCA: - ret = mmap_dca(uctx, vma); - goto out; + if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) { + ret = -EPERM; + goto out; + } + vma->vm_flags |= VM_DONTEXPAND; + prot = vma->vm_page_prot; + break; case HNS_ROCE_MMAP_TYPE_RESET: if (vma->vm_flags & (VM_WRITE | VM_EXEC)) { ret = -EINVAL; -- 2.33.0

2 1

[PATCH OLK-6.6] RDMA/hns: Fix DCA mmap area PUAF
by Chengchang Tang 06 Nov '24

06 Nov '24

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2H4P ---------------------------------------------------------------------- DCA mmap area would be freed after driver reseted or hot unplugged. At this time, the vma is still valid, which may lead to a PUAF. Using rdma_user_mmap_io() to remap this area to ensure the vma is zapped after dirver removal. Fixes: d3caaebdbfe9 ("RDMA/hns: Optimize user DCA perfermance by sharing DCA status") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_dca.c | 3 +- drivers/infiniband/hw/hns/hns_roce_main.c | 39 ++++------------------- 2 files changed, 9 insertions(+), 33 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index 49adf43261d6..4cef41591795 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -1132,7 +1132,8 @@ static void init_udca_status(struct hns_roce_ucontext *uctx, int udca_max_qps, return; ctx->dca_mmap_entry = hns_roce_user_mmap_entry_insert(ib_uctx, - (u64)kaddr, size, HNS_ROCE_MMAP_TYPE_DCA); + (u64)virt_to_phys(kaddr), size, + HNS_ROCE_MMAP_TYPE_DCA); if (!ctx->dca_mmap_entry) { free_pages_exact(kaddr, size); return; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 1302c58c3937..85223d25995d 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -644,36 +644,6 @@ static void hns_roce_dealloc_ucontext(struct ib_ucontext *ibcontext) ida_free(&hr_dev->uar_ida.ida, (int)context->uar.logic_idx); } -static int mmap_dca(struct ib_ucontext *context, struct vm_area_struct *vma) -{ - struct hns_roce_ucontext *uctx = to_hr_ucontext(context); - struct hns_roce_dca_ctx *ctx = &uctx->dca_ctx; - struct page **pages; - unsigned long num; - int ret; - - if ((vma->vm_end - vma->vm_start != (ctx->status_npage * PAGE_SIZE) || - return -EINVAL; - - if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) - return -EPERM; - - if (!ctx->buf_status) - return -EOPNOTSUPP; - - pages = kcalloc(ctx->status_npage, sizeof(struct page *), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - for (num = 0; num < ctx->status_npage; num++) - pages[num] = virt_to_page(ctx->buf_status + num * PAGE_SIZE); - - ret = vm_insert_pages(vma, vma->vm_start, pages, &num); - kfree(pages); - return ret; -} - static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) { struct hns_roce_dev *hr_dev = to_hr_dev(uctx->device); @@ -703,8 +673,13 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; case HNS_ROCE_MMAP_TYPE_DCA: - ret = mmap_dca(uctx, vma); - goto out; + if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) { + ret = -EPERM; + goto out; + } + vma->vm_flags |= VM_DONTEXPAND; + prot = vma->vm_page_prot; + break; case HNS_ROCE_MMAP_TYPE_RESET: if (vma->vm_flags & (VM_WRITE | VM_EXEC)) { ret = -EINVAL; -- 2.33.0

2 1

[PATCH OLK-6.6] drm/amd/display: Fix index out of bounds in degamma hardware format translation
by Liu Chuang 06 Nov '24

06 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v6.6.55 commit 122e3a7a8c7bcbe3aacddd6103f67f9f36bed473 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9A CVE: CVE-2024-49894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b7e99058eb2e86aabd7a10761e76cae33d22b49f ] Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c index c0372aa4ec83..684e30f9cf89 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c @@ -571,6 +571,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) { if (j == hw_points - 1) break; + if (i >= TRANSFER_FUNC_POINTS) + return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; -- 2.34.1

2 1

[Cancel] openEuler TC 临时会议
by openEuler conference 06 Nov '24

06 Nov '24

Sorry! The WeLink meeting will be held at 2024-11-09 10:00 scheduled by Kernel SIG has been cancelled.

1 0

[PATCH OLK-6.6] ksmbd: add refcnt to ksmbd_conn struct
by Long Li 06 Nov '24

06 Nov '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.10-rc2 commit ee426bfb9d09b29987369b897fe9b6485ac2be27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCR CVE: CVE-2024-49988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used. Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/connection.c | 4 ++- fs/smb/server/connection.h | 1 + fs/smb/server/oplock.c | 55 +++++++++++--------------------------- fs/smb/server/vfs_cache.c | 3 +++ 4 files changed, 23 insertions(+), 40 deletions(-) diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c index 7889df8112b4..cac80e7bfefc 100644 --- a/fs/smb/server/connection.c +++ b/fs/smb/server/connection.c @@ -39,7 +39,8 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) xa_destroy(&conn->sessions); kvfree(conn->request_buf); kfree(conn->preauth_info); - kfree(conn); + if (atomic_dec_and_test(&conn->refcnt)) + kfree(conn); } /** @@ -68,6 +69,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) conn->um = NULL; atomic_set(&conn->req_running, 0); atomic_set(&conn->r_count, 0); + atomic_set(&conn->refcnt, 1); conn->total_credits = 1; conn->outstanding_credits = 0; diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h index b93e5437793e..82343afc8d04 100644 --- a/fs/smb/server/connection.h +++ b/fs/smb/server/connection.h @@ -106,6 +106,7 @@ struct ksmbd_conn { bool signing_negotiated; __le16 signing_algorithm; bool binding; + atomic_t refcnt; }; struct ksmbd_conn_ops { diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c index e546ffa57b55..8ee86478287f 100644 --- a/fs/smb/server/oplock.c +++ b/fs/smb/server/oplock.c @@ -51,6 +51,7 @@ static struct oplock_info *alloc_opinfo(struct ksmbd_work *work, init_waitqueue_head(&opinfo->oplock_brk); atomic_set(&opinfo->refcount, 1); atomic_set(&opinfo->breaking_cnt, 0); + atomic_inc(&opinfo->conn->refcnt); return opinfo; } @@ -124,6 +125,8 @@ static void free_opinfo(struct oplock_info *opinfo) { if (opinfo->is_lease) free_lease(opinfo); + if (opinfo->conn && atomic_dec_and_test(&opinfo->conn->refcnt)) + kfree(opinfo->conn); kfree(opinfo); } @@ -163,9 +166,7 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) !atomic_inc_not_zero(&opinfo->refcount)) opinfo = NULL; else { - atomic_inc(&opinfo->conn->r_count); if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); atomic_dec(&opinfo->refcount); opinfo = NULL; } @@ -177,26 +178,11 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) return opinfo; } -static void opinfo_conn_put(struct oplock_info *opinfo) +void opinfo_put(struct oplock_info *opinfo) { - struct ksmbd_conn *conn; - if (!opinfo) return; - conn = opinfo->conn; - /* - * Checking waitqueue to dropping pending requests on - * disconnection. waitqueue_active is safe because it - * uses atomic operation for condition. - */ - if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) - wake_up(&conn->r_count_q); - opinfo_put(opinfo); -} - -void opinfo_put(struct oplock_info *opinfo) -{ if (!atomic_dec_and_test(&opinfo->refcount)) return; @@ -1127,14 +1113,11 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - atomic_inc(&opinfo->conn->r_count); - if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); + if (ksmbd_conn_releasing(opinfo->conn)) continue; - } oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); - opinfo_conn_put(opinfo); + opinfo_put(opinfo); } } up_read(&p_ci->m_lock); @@ -1167,13 +1150,10 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - atomic_inc(&opinfo->conn->r_count); - if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); + if (ksmbd_conn_releasing(opinfo->conn)) continue; - } oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); - opinfo_conn_put(opinfo); + opinfo_put(opinfo); } } up_read(&p_ci->m_lock); @@ -1252,7 +1232,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, prev_opinfo = opinfo_get_list(ci); if (!prev_opinfo || (prev_opinfo->level == SMB2_OPLOCK_LEVEL_NONE && lctx)) { - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto set_lev; } prev_op_has_lease = prev_opinfo->is_lease; @@ -1262,19 +1242,19 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, if (share_ret < 0 && prev_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) { err = share_ret; - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto err_out; } if (prev_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH && prev_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) { - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto op_break_not_needed; } list_add(&work->interim_entry, &prev_opinfo->interim_list); err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II); - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); if (err == -ENOENT) goto set_lev; /* Check all oplock was freed by close */ @@ -1337,14 +1317,14 @@ static void smb_break_all_write_oplock(struct ksmbd_work *work, return; if (brk_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH && brk_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) { - opinfo_conn_put(brk_opinfo); + opinfo_put(brk_opinfo); return; } brk_opinfo->open_trunc = is_trunc; list_add(&work->interim_entry, &brk_opinfo->interim_list); oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II); - opinfo_conn_put(brk_opinfo); + opinfo_put(brk_opinfo); } /** @@ -1376,11 +1356,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, if (!atomic_inc_not_zero(&brk_op->refcount)) continue; - atomic_inc(&brk_op->conn->r_count); - if (ksmbd_conn_releasing(brk_op->conn)) { - atomic_dec(&brk_op->conn->r_count); + if (ksmbd_conn_releasing(brk_op->conn)) continue; - } rcu_read_unlock(); if (brk_op->is_lease && (brk_op->o_lease->state & @@ -1411,7 +1388,7 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, brk_op->open_trunc = is_trunc; oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); next: - opinfo_conn_put(brk_op); + opinfo_put(brk_op); rcu_read_lock(); } rcu_read_unlock(); diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c index 8b2e37c8716e..271a23abc82f 100644 --- a/fs/smb/server/vfs_cache.c +++ b/fs/smb/server/vfs_cache.c @@ -710,6 +710,8 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon, list_for_each_entry_rcu(op, &ci->m_op_list, op_entry) { if (op->conn != conn) continue; + if (op->conn && atomic_dec_and_test(&op->conn->refcnt)) + kfree(op->conn); op->conn = NULL; } up_write(&ci->m_lock); @@ -807,6 +809,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp) if (op->conn) continue; op->conn = fp->conn; + atomic_inc(&op->conn->refcnt); } up_write(&ci->m_lock); -- 2.39.2

2 1

openEuler TC 临时会议
by openEuler conference 06 Nov '24

06 Nov '24

您好！ Kernel 邀请您参加 2024-11-09 10:00 召开的WeLink会议(自动录制) 会议主题：openEuler TC 临时会议会议链接：https://meeting.huaweicloud.com:36443/#/j/983087267 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-11-09 10:00, The subject of the conference is openEuler TC 临时会议, You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/983087267. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH v4 OLK-5.10 0/7] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Changelog since v3: - backport bugfix commit 88e4f525002b ("mm/hugetlb: add missing VM_FAULT_SET_HINDEX in hugetlb_wp") Changelog since v1: - fix incorrect patch format Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Oscar Salvador (1): mm/hugetlb: add missing VM_FAULT_SET_HINDEX in hugetlb_wp Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6] sched/fair: Take the scheduling domain into account in select_idle_smt()
by Wenyu Huang 06 Nov '24

06 Nov '24

From: Keisuke Nishimura <keisuke.nishimura(a)inria.fr> stable inclusion from stable-v6.6.23 commit 495b7cb952003973ff1fe4f70639bf3df91fbfb1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2B23 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 8aeaffef8c6eceab0e1498486fdd4f3dc3b7066c ] When picking a CPU on task wakeup, select_idle_smt() has to take into account the scheduling domain of @target. This is because the "isolcpus" kernel command line option can remove CPUs from the domain to isolate them from other SMT siblings. This fix checks if the candidate CPU is in the target scheduling domain. Commit: df3cb4ea1fb6 ("sched/fair: Fix wrong cpu selecting from isolated domain") ... originally introduced this fix by adding the check of the scheduling domain in the loop. However, commit: 3e6efe87cd5cc ("sched/fair: Remove redundant check in select_idle_smt()") ... accidentally removed the check. Bring it back. Fixes: 3e6efe87cd5c ("sched/fair: Remove redundant check in select_idle_smt()") Signed-off-by: Keisuke Nishimura <keisuke.nishimura(a)inria.fr> Signed-off-by: Julia Lawall <julia.lawall(a)inria.fr> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Vincent Guittot <vincent.guittot(a)linaro.org> Link: https://lore.kernel.org/r/20240110131707.437301-1-keisuke.nishimura@inria.fr Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- kernel/sched/fair.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 4ef95b2210b5e..d5ae744deb39d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8070,7 +8070,7 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu /* * Scan the local SMT mask for idle CPUs. */ -static int select_idle_smt(struct task_struct *p, int target) +static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) { int cpu; @@ -8081,6 +8081,12 @@ static int select_idle_smt(struct task_struct *p, int target) #endif if (cpu == target) continue; + /* + * Check if the CPU is in the LLC scheduling domain of @target. + * Due to isolcpus, there is no guarantee that all the siblings are in the domain. + */ + if (!cpumask_test_cpu(cpu, sched_domain_span(sd))) + continue; if (available_idle_cpu(cpu) || sched_idle_cpu(cpu)) return cpu; } @@ -8104,7 +8110,7 @@ static inline int select_idle_core(struct task_struct *p, int core, struct cpuma return __select_idle_cpu(core, p); } -static inline int select_idle_smt(struct task_struct *p, int target) +static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) { return -1; } @@ -8441,7 +8447,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target) has_idle_core = test_idle_cores(target); if (!has_idle_core && cpus_share_cache(prev, target)) { - i = select_idle_smt(p, prev); + i = select_idle_smt(p, sd, prev); if ((unsigned int)i < nr_cpumask_bits) return i; } -- 2.34.1

2 1

[PATCH OLK-5.10] serial: core: Fix atomicity violation in uart_tiocmget
by Yi Yang 06 Nov '24

06 Nov '24

From: Gui-Dong Han <2045gemini(a)gmail.com> mainline inclusion from mainline-v6.8-rc3 commit 30926783a46841c2d1bbf3f74067ba85d304fd0d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MRY CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In uart_tiocmget(): result = uport->mctrl; uart_port_lock_irq(uport); result |= uport->ops->get_mctrl(uport); uart_port_unlock_irq(uport); ... return result; In uart_update_mctrl(): uart_port_lock_irqsave(port, &flags); ... port->mctrl = (old & ~clear) | set; ... port->ops->set_mctrl(port, port->mctrl); ... uart_port_unlock_irqrestore(port, flags); An atomicity violation is identified due to the concurrent execution of uart_tiocmget() and uart_update_mctrl(). After assigning result = uport->mctrl, the mctrl value may change in uart_update_mctrl(), leading to a mismatch between the value returned by uport->ops->get_mctrl(uport) and the mctrl value previously read. This can result in uart_tiocmget() returning an incorrect value. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To address this issue, it is suggested to move the line result = uport->mctrl inside the uart_port_lock block to ensure atomicity and prevent the mctrl value from being altered during the execution of uart_tiocmget(). With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the absence of the requisite hardware, we are unable to conduct runtime testing of the patch. Therefore, our verification is solely based on code logic analysis. [1] https://sites.google.com/view/basscheck/ Fixes: c5f4644e6c8b ("[PATCH] Serial: Adjust serial locking") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Link: https://lore.kernel.org/r/20240112113624.17048-1-2045gemini@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/serial_core.c [Commit 559c7ff4e324("serial: core: Use port lock wrappers") not merged, no functional change.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index c7adcf97e2a3..f86bef623953 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -1092,8 +1092,8 @@ static int uart_tiocmget(struct tty_struct *tty) goto out; if (!tty_io_error(tty)) { - result = uport->mctrl; spin_lock_irq(&uport->lock); + result = uport->mctrl; result |= uport->ops->get_mctrl(uport); spin_unlock_irq(&uport->lock); } -- 2.25.1

2 1

[PATCH OLK-6.6] serial: core: Fix atomicity violation in uart_tiocmget
by Yi Yang 06 Nov '24

06 Nov '24

From: Gui-Dong Han <2045gemini(a)gmail.com> mainline inclusion from mainline-v6.8-rc3 commit 30926783a46841c2d1bbf3f74067ba85d304fd0d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MRY CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In uart_tiocmget(): result = uport->mctrl; uart_port_lock_irq(uport); result |= uport->ops->get_mctrl(uport); uart_port_unlock_irq(uport); ... return result; In uart_update_mctrl(): uart_port_lock_irqsave(port, &flags); ... port->mctrl = (old & ~clear) | set; ... port->ops->set_mctrl(port, port->mctrl); ... uart_port_unlock_irqrestore(port, flags); An atomicity violation is identified due to the concurrent execution of uart_tiocmget() and uart_update_mctrl(). After assigning result = uport->mctrl, the mctrl value may change in uart_update_mctrl(), leading to a mismatch between the value returned by uport->ops->get_mctrl(uport) and the mctrl value previously read. This can result in uart_tiocmget() returning an incorrect value. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To address this issue, it is suggested to move the line result = uport->mctrl inside the uart_port_lock block to ensure atomicity and prevent the mctrl value from being altered during the execution of uart_tiocmget(). With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the absence of the requisite hardware, we are unable to conduct runtime testing of the patch. Therefore, our verification is solely based on code logic analysis. [1] https://sites.google.com/view/basscheck/ Fixes: c5f4644e6c8b ("[PATCH] Serial: Adjust serial locking") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Link: https://lore.kernel.org/r/20240112113624.17048-1-2045gemini@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/serial_core.c [Commit 559c7ff4e324("serial: core: Use port lock wrappers") not merged, no functional change.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 5d5570bebfeb..938e36b6cd4f 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -1105,8 +1105,8 @@ static int uart_tiocmget(struct tty_struct *tty) goto out; if (!tty_io_error(tty)) { - result = uport->mctrl; spin_lock_irq(&uport->lock); + result = uport->mctrl; result |= uport->ops->get_mctrl(uport); spin_unlock_irq(&uport->lock); } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1225/1225] mm/memory.o: warning: objtool: __apply_to_page_range()+0x67c: unreachable instruction
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: dd365884b743523ae70dbbf469bca8168f40ba93 [1225/1225] mm/memory.c: add apply_to_existing_page_range() helper config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411061528.694k8VkC-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411061528.694k8VkC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411061528.694k8VkC-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory.c:47: In file included from include/linux/hugetlb.h:44: In file included from include/linux/mempolicy.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/memory.c:4707:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct cgp_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] 4707 | DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 4708 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. >> mm/memory.o: warning: objtool: __apply_to_page_range()+0x67c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v3 OLK-5.10 0/6] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Changelog since v1: - fix incorrect patch format Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 7

[PATCH v2 OLK-5.10 0/6] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Changelog since v1: - fix incorrect patch format Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 7

[openeuler:openEuler-1.0-LTS 1218/1218] drivers/pci/pcie/dpc.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 58d584102f06f870f118644f1022c751e015e7bb [1218/1218] PCI: portdrv: Initialize service drivers directly config: x86_64-buildonly-randconfig-006-20241024 (https://download.01.org/0day-ci/archive/20241106/202411061521.R0Vz05vu-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411061521.R0Vz05vu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411061521.R0Vz05vu-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/pci/pcie/dpc.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION e33ed48bc600febcdca9e71e43cf224934dadc4f
by kernel test robot 06 Nov '24

06 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: e33ed48bc600febcdca9e71e43cf224934dadc4f !13007 CVE-2024-49950 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411060227.oM4HzgsK-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060503.rYM2XmVn-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060705.6jumqar7-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060729.yZ0sshJi-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060820.ye1y82tJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411061140.gNjqbgZ7-lkp@intel.com arch/arm64/kernel/mpam/mpam_mon.c:48: warning: Cannot understand * @rmid_mon_exclusive_all List of allocated RMIDs with arch/arm64/kernel/mpam/mpam_mon.c:54: warning: Cannot understand * @rmid_mon_wait_all List of allocated RMIDs with default arch/arm64/kernel/mpam/mpam_mon.c:62: warning: Cannot understand * @rmid_entry - The entry in the mon list. Unverified Error/Warning (likely false positive, kindly check if interested): drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:1024:20: warning: 'new_state' may be used uninitialized [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241029 | |-- arch-arm64-kernel-mpam-mpam_mon.c:warning:Cannot-understand-rmid_entry-The-entry-in-the-mon-list. | |-- arch-arm64-kernel-mpam-mpam_mon.c:warning:Cannot-understand-rmid_mon_exclusive_all-List-of-allocated-RMIDs-with | `-- arch-arm64-kernel-mpam-mpam_mon.c:warning:Cannot-understand-rmid_mon_wait_all-List-of-allocated-RMIDs-with-default |-- arm64-randconfig-001-20241106 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-002-20241106 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-003-20241106 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-004-20241106 | |-- arch-arm64-kernel-smp.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-allyesconfig | |-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241025 | `-- drivers-crypto-hisilicon-sec-sec_drv.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241030 | `-- drivers-usb-dwc3-.tmp_dwc3-qcom.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241106 | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-002-20241028 | |-- drivers-hwtracing-intel_th-msu-sink.o:warning:objtool:missing-symbol-for-section-.init.text | `-- kernel-kprobes.o:warning:objtool:register_kprobe:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20241029 | `-- drivers-spi-spi-uniphier.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20241106 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-buildonly-randconfig-003-20241029 | |-- drivers-media-i2c-.tmp_ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-net-can-usb-kvaser_usb-kvaser_usb_hydra.c:warning:new_state-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-003-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-buildonly-randconfig-004-20241106 | |-- drivers-gpu-drm-nouveau-nvkm-subdev-bios-dp.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-iommu-amd_iommu_debugfs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-pci-controller-dwc-pci-exynos.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-dwc3-debugfs.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-core-sound_oss.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-006-20241024 | `-- drivers-media-usb-dvb-usb-v2-anysee.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-002-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-003-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-004-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-006-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-011-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-012-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-015-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-016-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-071-20241106 | `-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init |-- x86_64-randconfig-072-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-073-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-074-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-075-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-076-20241106 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 744m configs tested: 35 configs skipped: 118 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241106 gcc-14.1.0 arm64 randconfig-002-20241106 gcc-14.1.0 arm64 randconfig-003-20241106 gcc-14.1.0 arm64 randconfig-004-20241106 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241106 clang-19 x86_64 buildonly-randconfig-002-20241106 clang-19 x86_64 buildonly-randconfig-003-20241106 clang-19 x86_64 buildonly-randconfig-004-20241106 gcc-12 x86_64 buildonly-randconfig-005-20241106 gcc-12 x86_64 buildonly-randconfig-006-20241106 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241106 clang-19 x86_64 randconfig-002-20241106 gcc-11 x86_64 randconfig-003-20241106 gcc-12 x86_64 randconfig-004-20241106 gcc-12 x86_64 randconfig-005-20241106 clang-19 x86_64 randconfig-006-20241106 gcc-11 x86_64 randconfig-011-20241106 gcc-11 x86_64 randconfig-012-20241106 gcc-12 x86_64 randconfig-013-20241106 clang-19 x86_64 randconfig-014-20241106 gcc-12 x86_64 randconfig-015-20241106 gcc-12 x86_64 randconfig-016-20241106 gcc-12 x86_64 randconfig-071-20241106 gcc-12 x86_64 randconfig-072-20241106 gcc-12 x86_64 randconfig-073-20241106 clang-19 x86_64 randconfig-074-20241106 gcc-12 x86_64 randconfig-075-20241106 clang-19 x86_64 randconfig-076-20241106 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/6] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 7

[openeuler:OLK-5.10] BUILD REGRESSION f705e909a01ee9ae75542457ca95b055dae177a0
by kernel test robot 06 Nov '24

06 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: f705e909a01ee9ae75542457ca95b055dae177a0 !13009 CVE-2024-49950 Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/ast/ast_mm.c:116 ast_pci_host_is_5c01() error: we previously assumed 'child' could be null (see line 109) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PCI_IOV-when-selected-by-CRYPTO_DEV_HISI_MIGRATION | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- arm64-randconfig-003-20241106 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- x86_64-allyesconfig | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-buildonly-randconfig-001-20241106 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | `-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE |-- x86_64-buildonly-randconfig-002-20241028 | `-- fs-crypto-fname.o:warning:objtool:fscrypt_fname_encrypt:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20241106 | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init-Werror-Wimplicit-function-declaration | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20241106 | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-buildonly-randconfig-005-20241106 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-003-20241106 | |-- security-integrity-ima-ima.h:warning:struct-ima_digest-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement |-- x86_64-randconfig-006-20241106 | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-randconfig-013-20241106 | `-- drivers-gpu-drm-nouveau-nvkm-subdev-clk-pllnv04.o:warning:objtool:nv04_pll_calc-falls-through-to-next-function-asanmodule_ctor() |-- x86_64-randconfig-014-20241106 | `-- drivers-usb-cdns3-debug.h:warning:sprintf-argument-may-overlap-destination-object-field |-- x86_64-randconfig-015-20241106 | |-- arch-x86-events-zhaoxin-uncore.c:warning:cluster_id-is-used-uninitialized | |-- arch-x86-events-zhaoxin-uncore.c:warning:subnode_id-is-used-uninitialized | |-- security-integrity-ima-ima.h:warning:struct-ima_digest-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement |-- x86_64-randconfig-074-20241106 | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used `-- x86_64-randconfig-161-20241029 `-- drivers-gpu-drm-ast-ast_mm.c-ast_pci_host_is_5c01()-error:we-previously-assumed-child-could-be-null-(see-line-) elapsed time: 754m configs tested: 35 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241106 gcc-14.1.0 arm64 randconfig-002-20241106 gcc-14.1.0 arm64 randconfig-003-20241106 clang-20 arm64 randconfig-004-20241106 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241106 clang-19 x86_64 buildonly-randconfig-002-20241106 clang-19 x86_64 buildonly-randconfig-003-20241106 clang-19 x86_64 buildonly-randconfig-004-20241106 gcc-12 x86_64 buildonly-randconfig-005-20241106 gcc-12 x86_64 buildonly-randconfig-006-20241106 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241106 clang-19 x86_64 randconfig-002-20241106 gcc-11 x86_64 randconfig-003-20241106 gcc-12 x86_64 randconfig-004-20241106 gcc-12 x86_64 randconfig-005-20241106 clang-19 x86_64 randconfig-006-20241106 gcc-11 x86_64 randconfig-011-20241106 gcc-11 x86_64 randconfig-012-20241106 gcc-12 x86_64 randconfig-013-20241106 clang-19 x86_64 randconfig-014-20241106 gcc-12 x86_64 randconfig-015-20241106 gcc-12 x86_64 randconfig-016-20241106 gcc-12 x86_64 randconfig-071-20241106 gcc-12 x86_64 randconfig-072-20241106 gcc-12 x86_64 randconfig-073-20241106 clang-19 x86_64 randconfig-074-20241106 gcc-12 x86_64 randconfig-075-20241106 clang-19 x86_64 randconfig-076-20241106 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] selinux: clarify return code in filename_trans_read_helper_compat()
by Yi Yang 06 Nov '24

06 Nov '24

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v6.10-rc1 commit 4e551db0426472ca305a2f3284b25af763bfe57d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MNX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For the "conflicting/duplicate rules" branch in filename_trans_read_helper_compat() the Smatch static checker reports: security/selinux/ss/policydb.c:1953 filename_trans_read_helper_compat() warn: missing error code 'rc' While the value of rc will already always be zero here, it is not obvious that it's the case and that it's the intended return value (Smatch expects rc to be assigned within 5 lines from the goto). Therefore, add an explicit assignment just before the goto to make the intent more clear and the code less error-prone. Fixes: c3a276111ea2 ("selinux: optimize storage of filename transitions") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/selinux/722b90c4-1f4b-42ff-a6c2-108ea262bd10@moroto… Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/selinux/ss/policydb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 2d528f699a22..f70399373588 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -1921,6 +1921,7 @@ static int filename_trans_read_helper_compat(struct policydb *p, void *fp) if (unlikely(ebitmap_get_bit(&datum->stypes, stype - 1))) { /* conflicting/duplicate rules are ignored */ datum = NULL; + rc = 0; goto out; } if (likely(datum->otype == otype)) -- 2.25.1

2 1

[PATCH OLK-5.10] selinux: clarify return code in filename_trans_read_helper_compat()
by Yi Yang 06 Nov '24

06 Nov '24

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v6.10-rc1 commit 4e551db0426472ca305a2f3284b25af763bfe57d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MNX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For the "conflicting/duplicate rules" branch in filename_trans_read_helper_compat() the Smatch static checker reports: security/selinux/ss/policydb.c:1953 filename_trans_read_helper_compat() warn: missing error code 'rc' While the value of rc will already always be zero here, it is not obvious that it's the case and that it's the intended return value (Smatch expects rc to be assigned within 5 lines from the goto). Therefore, add an explicit assignment just before the goto to make the intent more clear and the code less error-prone. Fixes: c3a276111ea2 ("selinux: optimize storage of filename transitions") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/selinux/722b90c4-1f4b-42ff-a6c2-108ea262bd10@moroto… Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/selinux/ss/policydb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 82cfeab16217..2f15ab8534b2 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -1923,6 +1923,7 @@ static int filename_trans_read_helper_compat(struct policydb *p, void *fp) if (unlikely(ebitmap_get_bit(&datum->stypes, stype - 1))) { /* conflicting/duplicate rules are ignored */ datum = NULL; + rc = 0; goto out; } if (likely(datum->otype == otype)) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_mon.c:48: warning: Cannot understand * @rmid_mon_exclusive_all List of allocated RMIDs with
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 0f728d63ce7a19f1dd0dbde79197248e7c4accf6 [1231/1231] arm64/mpam: Add wait queue for monitor alloc and free config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241106/202411061140.gNjqbgZ7-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411061140.gNjqbgZ7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411061140.gNjqbgZ7-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/mpam/mpam_mon.c:48: warning: Cannot understand * @rmid_mon_exclusive_all List of allocated RMIDs with on line 48 - I thought it was a doc line >> arch/arm64/kernel/mpam/mpam_mon.c:54: warning: Cannot understand * @rmid_mon_wait_all List of allocated RMIDs with default on line 54 - I thought it was a doc line >> arch/arm64/kernel/mpam/mpam_mon.c:62: warning: Cannot understand * @rmid_entry - The entry in the mon list. on line 62 - I thought it was a doc line vim +48 arch/arm64/kernel/mpam/mpam_mon.c 46 47 /** > 48 * @rmid_mon_exclusive_all List of allocated RMIDs with 49 * exclusive available mon. 50 */ 51 static LIST_HEAD(rmid_mon_exclusive_all); 52 53 /** > 54 * @rmid_mon_wait_all List of allocated RMIDs with default 55 * 0 mon and wait for exclusive available mon. 56 */ 57 static LIST_HEAD(rmid_mon_wait_all); 58 59 static u32 rmid_ptrs_len; 60 61 /** > 62 * @rmid_entry - The entry in the mon list. 63 */ 64 static struct rmid_entry *rmid_ptrs; 65 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] static_call: Handle module init failure correctly in static_call_del_module()
by Gu Bowen 06 Nov '24

06 Nov '24

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v6.1.113 commit b566c7d8a2de403ccc9d8a06195e19bbb386d0e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8E CVE: CVE-2024-50002 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4b30051c4864234ec57290c3d142db7c88f10d8a ] Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain. If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod. The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and dereferences the pointer to the list of built-in call sites, which is obviously bogus. Cure it by checking whether the key has a sites or a mods pointer. If it's a sites pointer then the key is not to be touched. As the sites are walked in the same order as in __static_call_init() the site walk can be terminated because all subsequent sites have not been touched by the init code due to the error exit. If it was converted before the allocation fail, then the inner loop which searches for a module match will find nothing. A fail in the second allocation in __static_call_init() is harmless and does not require special treatment. The first allocation succeeded and converted the key to a module chain. That first entry has mod::mod == NULL and mod::next == NULL, so the inner loop of static_call_del_module() will neither find a module match nor a module chain. The next site in the walk was either already converted, but can't match the module, or it will exit the outer loop because it has a static_call_site pointer and not a static_call_mod pointer. Fixes: 9183c3f9ed71 ("static_call: Add inline static call infrastructure") Closes: https://lore.kernel.org/all/20230915082126.4187913-1-ruanjinjie@huawei.com Reported-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Link: https://lore.kernel.org/r/87zfon6b0s.ffs@tglx Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/static_call.c kernel/static_call_inline.c [Commit 8fd4ddda2f49(static_call: Don't make __static_call_return0 static) rename kernel/static_call.c to kernel/static_call_inline.c which not merge] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- kernel/static_call.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kernel/static_call.c b/kernel/static_call.c index a5df28b2bc1b..63e7c2efc5cd 100644 --- a/kernel/static_call.c +++ b/kernel/static_call.c @@ -406,6 +406,17 @@ static void static_call_del_module(struct module *mod) for (site = start; site < stop; site++) { key = static_call_key(site); + + /* + * If the key was not updated due to a memory allocation + * failure in __static_call_init() then treating key::sites + * as key::mods in the code below would cause random memory + * access and #GP. In that case all subsequent sites have + * not been touched either, so stop iterating. + */ + if (!static_call_key_has_mods(key)) + break; + if (key == prev_key) continue; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] f2fs: fix to check atomic_file in f2fs ioctl interfaces
by Gu Bowen 06 Nov '24

06 Nov '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.1.113 commit 26b07bd2e1f124b0e430c8d250023f7205c549c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSF CVE: CVE-2024-49859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bfe5c02654261bfb8bd9cb174a67f3279ea99e58 upstream. Some f2fs ioctl interfaces like f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range() missed to check atomic_write status, which may cause potential race issue, fix it. Cc: stable(a)vger.kernel.org Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/f2fs/file.c [There is context conflicts due to commit d6dd477436957(f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED) not merge in f2fs_defragment_range().] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- fs/f2fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index 0b355f00225b..12351851cb2e 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -2614,6 +2614,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, inode_lock(inode); + if (f2fs_is_atomic_file(inode)) { + err = -EINVAL; + goto out; + } + /* writeback all dirty pages in the range */ err = filemap_write_and_wait_range(inode->i_mapping, range->start, range->start + range->len - 1); @@ -2821,6 +2826,11 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in, goto out; } + if (f2fs_is_atomic_file(src) || f2fs_is_atomic_file(dst)) { + ret = -EINVAL; + goto out_unlock; + } + ret = -EINVAL; if (pos_in + len > src->i_size || pos_in + len < pos_in) goto out_unlock; @@ -3267,6 +3277,11 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg) goto out; } + if (f2fs_is_atomic_file(inode)) { + ret = -EINVAL; + goto out; + } + if (!pin) { clear_inode_flag(inode, FI_PIN_FILE); f2fs_i_gc_failures_write(inode, 0); -- 2.25.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 06 Nov '24

06 Nov '24

您好！ Kernel 邀请您参加 2024-11-08 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 征集中（可回复本邮件申请，也可直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/983782327 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-11-08 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 征集中（可回复本邮件申请，也可直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/983782327. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] NFSD: Mark filecache "down" if init fails
by Li Lingfeng 06 Nov '24

06 Nov '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v6.6.57 commit 4ab072325c621e0e4fadff991c7a00379a16a037 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB22IQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dc0d0f885aa422f621bc1c2124133eff566b0bc8 ] NeilBrown says: > The handling of NFSD_FILE_CACHE_UP is strange. nfsd_file_cache_init() > sets it, but doesn't clear it on failure. So if nfsd_file_cache_init() > fails for some reason, nfsd_file_cache_shutdown() would still try to > clean up if it was called. Reported-by: NeilBrown <neilb(a)suse.de> Fixes: c7b824c3d06c ("NFSD: Replace the "init once" mechanism") Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/filecache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c index 5c9f8f8404d5..6f2bcbfde45e 100644 --- a/fs/nfsd/filecache.c +++ b/fs/nfsd/filecache.c @@ -718,7 +718,7 @@ nfsd_file_cache_init(void) ret = rhltable_init(&nfsd_file_rhltable, &nfsd_file_rhash_params); if (ret) - return ret; + goto out; ret = -ENOMEM; nfsd_filecache_wq = alloc_workqueue("nfsd_filecache", 0, 0); @@ -770,6 +770,8 @@ nfsd_file_cache_init(void) INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_gc_worker); out: + if (ret) + clear_bit(NFSD_FILE_CACHE_UP, &nfsd_file_flags); return ret; out_notifier: lease_unregister_notifier(&nfsd_file_lease_notifier); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] nfs: fix rpc_task use-after-free when open and close different files concurrently
by Li Lingfeng 06 Nov '24

06 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB20ED CVE: NA -------------------------------- Commit b5e9ee1ed8bb("[Huawei] NFSv4: release seqid when open failed for nfs4.0") describes a scenario where a file system is forcibly unmounted when different files are opened concurrently. There is another similar issue where performing concurrent operations of opening file B, closing file A, and unmounting while file A is open which can trigger a UAF of rpc_task. T1: OPEN fileB T2: CLOSE fileA nfs4_do_open ... .rpc_call_prepare nfs_wait_on_sequence // insert to sequence list(T1) // This is the first entry, // and continue. nfs4_do_close .rpc_call_prepare nfs_wait_on_sequence // insert to sequence list(T2) // This is the second entry, // and wait. [T3 wake up T2 here] ... rpc_put_task // finish rpc_task and free it .rpc_call_done nfs_release_seqid list_first_entry // get T1 from list rpc_wake_up_queued_task // wake up T1, UAF _nfs4_open_and_get_state _nfs4_open_and_get_state _nfs4_opendata_to_nfs4_state nfs_release_seqid // remove T1 from list T3: UMOUNT nfs_umount_begin rpc_killall_tasks rpc_signal_task // get T2 from clnt->cl_tasks rpc_wake_up_queued_task_set_status rpc_wake_up_task_queue_set_status_locked rpc_wake_up_task_on_wq_queue_action_locked __rpc_do_wake_up_task_on_wq rpc_make_runnable wake_up_bit // wake up T2 Although the rpc_task corresponding to T1 has been freed, its seqid has not been removed from the sequence list. Additionally, even though T2 is the last task in the list, the current logic of nfs_release_seqid allows T2 to access tasks inserted before it, which can trigger UAF. Fix it by using nfs_release_seqid_inorder instead of nfs_release_seqid in nfs4_close_done. Fixes: 72211dbe727f ("NFSv4: Release the sequence id before restarting a CLOSE rpc call") Link: https://lore.kernel.org/all/b9924cd2-253a-6c44-3331-56310f13df0b@huawei.com/ Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index b19a738dd2e1..94f73294b8d6 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -3403,7 +3403,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) res_stateid, calldata->arg.fmode); out_release: task->tk_status = 0; - nfs_release_seqid(calldata->arg.seqid); + nfs_release_seqid_inorder(calldata->arg.seqid); nfs_refresh_inode(calldata->inode, &calldata->fattr); dprintk("%s: done, ret = %d!\n", __func__, task->tk_status); return; -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] Fix UAF of rpc_task
by Li Lingfeng 06 Nov '24

06 Nov '24

Li Lingfeng (1): nfs: fix rpc_task use-after-free when open and close different files concurrently Yang Erkun (1): NFSv4: release seqid when open failed for nfs4.0 fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4proc.c | 4 +++- fs/nfs/nfs4state.c | 18 ++++++++++++++++++ 3 files changed, 22 insertions(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH OLK-6.6 0/2] Fix UAF of rpc_task
by Li Lingfeng 06 Nov '24

06 Nov '24

Li Lingfeng (1): nfs: fix rpc_task use-after-free when open and close different files concurrently Yang Erkun (1): NFSv4: release seqid when open failed for nfs4.0 fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4proc.c | 4 +++- fs/nfs/nfs4state.c | 18 ++++++++++++++++++ 3 files changed, 22 insertions(+), 1 deletion(-) -- 2.31.1

2 3

[openeuler:openEuler-1.0-LTS 1225/1225] drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

Hi Alexander, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 4d516770f81434cde260d33430626e3880b9902e [1225/1225] intel_th: msu-sink: An example msu buffer "sink" config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411060820.ye1y82tJ-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060820.ye1y82tJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060820.ye1y82tJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

Hi Mark, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: c1acb21b32a3bb601453764c9eac9fc8fbb3a81d [1231/1231] Merge branch 'spi-4.19' into spi-next config: x86_64-buildonly-randconfig-002-20241029 (https://download.01.org/0day-ci/archive/20241106/202411060705.6jumqar7-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060705.6jumqar7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060705.6jumqar7-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/spi/spi-uniphier.c:12: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1558:1: note: in expansion of macro 'module_exit' 1558 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/platform_device.h:14, from drivers/spi/spi-uniphier.c:13: drivers/spi/spi-uniphier.c:518:24: note: 'cleanup_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1554:20: note: in definition of macro 'module_driver' 1554 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1553:1: note: in expansion of macro 'module_init' 1553 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:24: note: 'init_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1549:19: note: in definition of macro 'module_driver' 1549 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1218/1218] drivers/media/usb/dvb-usb-v2/anysee.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 56bc1719652e7a937bc9856f76f0c0fbf8ce1b23 [1218/1218] objtool: Support GCC 9 cold subfunction naming scheme config: x86_64-buildonly-randconfig-006-20241024 (https://download.01.org/0day-ci/archive/20241106/202411060729.yZ0sshJi-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060729.yZ0sshJi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060729.yZ0sshJi-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/media/usb/dvb-usb-v2/anysee.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1219/1219] drivers/crypto/hisilicon/sec/sec_drv.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 915e4e8413dacc086efcef4de04fdfdca57e8b1c [1219/1219] crypto: hisilicon - SEC security accelerator driver config: x86_64-buildonly-randconfig-001-20241025 (https://download.01.org/0day-ci/archive/20241106/202411060503.rYM2XmVn-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060503.rYM2XmVn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060503.rYM2XmVn-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/crypto/hisilicon/sec/sec_drv.c:843: warning: Function parameter or member 'queue' not described in 'sec_queue_empty' >> drivers/crypto/hisilicon/sec/sec_drv.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1225/1225] kernel/kprobes.o: warning: objtool: register_kprobe()+0x6ee: unreachable instruction
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 388c9a84a807812e7226e0e1ca606563e14a7f5a [1225/1225] kprobes: Warn if the kprobe is reregistered config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411060227.oM4HzgsK-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060227.oM4HzgsK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060227.oM4HzgsK-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/kprobes.c:120:14: warning: no previous prototype for function 'alloc_insn_page' [-Wmissing-prototypes] 120 | void __weak *alloc_insn_page(void) | ^ kernel/kprobes.c:120:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 120 | void __weak *alloc_insn_page(void) | ^ | static kernel/kprobes.c:125:13: warning: no previous prototype for function 'free_insn_page' [-Wmissing-prototypes] 125 | void __weak free_insn_page(void *page) | ^ kernel/kprobes.c:125:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 125 | void __weak free_insn_page(void *page) | ^ | static 2 warnings generated. kernel/kprobes.c:145: warning: Function parameter or member 'c' not described in '__get_insn_slot' >> kernel/kprobes.o: warning: objtool: register_kprobe()+0x6ee: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_resctrl.c:566: warning: Function parameter or member 'cols' not described in 'rmid_transform'
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5e5fe4767eb1c2cdaeeddcd731adf35da6453c12 commit: 75008419705983d9d2027127568111f88a26a67c [1231/1231] arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241106/202411060122.PBQDO81j-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060122.PBQDO81j-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060122.PBQDO81j-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_resctrl.c:178:1: warning: conflicting types for 'mpam_get_raw_resctrl_resource' due to enum/integer mismatch; have 'struct raw_resctrl_resource *(enum resctrl_resource_level)' [-Wenum-int-mismatch] 178 | mpam_get_raw_resctrl_resource(enum resctrl_resource_level level) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/kernel/mpam/mpam_resctrl.c:47: arch/arm64/kernel/mpam/mpam_internal.h:192:1: note: previous declaration of 'mpam_get_raw_resctrl_resource' with type 'struct raw_resctrl_resource *(u32)' {aka 'struct raw_resctrl_resource *(unsigned int)'} 192 | mpam_get_raw_resctrl_resource(u32 level); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:521:5: warning: no previous prototype for 'closid_bitmap_init' [-Wmissing-prototypes] 521 | int closid_bitmap_init(void) | ^~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:1306:5: warning: no previous prototype for 'cpus_ctrl_write' [-Wmissing-prototypes] 1306 | int cpus_ctrl_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask, | ^~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:1403:5: warning: no previous prototype for 'cpus_mon_write' [-Wmissing-prototypes] 1403 | int cpus_mon_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask, | ^~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c: In function 'rdt_last_cmd_printf': arch/arm64/kernel/mpam/mpam_resctrl.c:1583:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 1583 | seq_buf_vprintf(&last_cmd_status, fmt, ap); | ^~~~~~~~~~~~~~~ >> arch/arm64/kernel/mpam/mpam_resctrl.c:566: warning: Function parameter or member 'cols' not described in 'rmid_transform' vim +566 arch/arm64/kernel/mpam/mpam_resctrl.c 549 550 /** 551 * struct rmid_transform - Matrix for transforming rmid to partid and pmg 552 * @rows: Number of bits for remap_body[:] bitmap 553 * @clos: Number of bitmaps 554 * @nr_usage: Number rmid we have 555 * @stride: Step stride from transforming rmid to partid and pmg 556 * @remap_body: Storing bitmaps' entry and itself 557 * @remap_enabled: Does remap_body init done 558 */ 559 struct rmid_transform { 560 u32 rows; 561 u32 cols; 562 u32 nr_usage; 563 int stride; 564 unsigned long **remap_body; 565 bool remap_enabled; > 566 }; 567 static struct rmid_transform rmid_remap_matrix; 568 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-47702
by Chen Zhongjin 05 Nov '24

05 Nov '24

CVE-2024-47702 Chen Zhongjin (1): bpf: Fix kabi breakage in struct bpf_insn_access_aux Yonghong Song (1): bpf: Fail verification for sign-extension of packet data/data_end/data_meta include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-47702
by Chen Zhongjin 05 Nov '24

05 Nov '24

CVE-2024-47702 Chen Zhongjin (1): bpf: Fix kabi breakage in struct bpf_insn_access_aux Yonghong Song (1): bpf: Fail verification for sign-extension of packet data/data_end/data_meta include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 1257/1257] net/can/j1939/.tmp_main.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 05 Nov '24

05 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0c1156b86933300fc91692f839a7f6e0676f55d7 commit: e0c2ee9edcacfdda0e806166eaec1310cdf9e324 [1257/1257] can: add support of SAE J1939 protocol config: x86_64-buildonly-randconfig-002-20241102 (https://download.01.org/0day-ci/archive/20241105/202411051936.7BMR1oXT-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411051936.7BMR1oXT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411051936.7BMR1oXT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/can/j1939/.tmp_main.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: add more sanity checks to qdisc_pkt_len_init()
by Liu Jian 05 Nov '24

05 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.55 commit 9b0ee571d20a238a22722126abdfde61f1b2bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8W CVE: CVE-2024-49948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ] One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes. - 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8 virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size. We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len. Fixes: 1def9238d4aa ("net_sched: more precise pkt_len computation") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 4935ff1eecc7..facf8e3f41d0 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3754,10 +3754,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len += sizeof(struct udphdr); } - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, - shinfo->gso_size); + if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { + int payload = skb->len - hdr_len; + /* Malicious packet. */ + if (payload <= 0) + return; + gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); + } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } } -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1] net: add more sanity checks to qdisc_pkt_len_init()
by Liu Jian 05 Nov '24

05 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit 566a931a1436d0e0ad13708ea55479b95426213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8W CVE: CVE-2024-49948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ] One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes. - 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8 virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size. We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len. Fixes: 1def9238d4aa ("net_sched: more precise pkt_len computation") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 1cac2557f1b9..2b8e1f314ef2 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3756,10 +3756,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len += sizeof(struct udphdr); } - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, - shinfo->gso_size); + if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { + int payload = skb->len - hdr_len; + /* Malicious packet. */ + if (payload <= 0) + return; + gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); + } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } } -- 2.34.1

2 3

[PATCH OLK-5.10] net: add more sanity checks to qdisc_pkt_len_init()
by Liu Jian 05 Nov '24

05 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit 566a931a1436d0e0ad13708ea55479b95426213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8W CVE: CVE-2024-49948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ] One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes. - 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8 virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size. We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len. Fixes: 1def9238d4aa ("net_sched: more precise pkt_len computation") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index ed4d42965bcb..7c7994d86a94 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3771,10 +3771,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len += sizeof(struct udphdr); } - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, - shinfo->gso_size); + if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { + int payload = skb->len - hdr_len; + /* Malicious packet. */ + if (payload <= 0) + return; + gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); + } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } } -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1225/1225] drivers/cpuidle/cpuidle-haltpoll.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 05 Nov '24

05 Nov '24

Hi Marcelo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0c1156b86933300fc91692f839a7f6e0676f55d7 commit: 8104395ba98a81c8cb1ddd245482baca0d57d163 [1225/1225] add cpuidle-haltpoll driver config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241105/202411051849.OUFvUDzd-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411051849.OUFvUDzd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411051849.OUFvUDzd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpuidle/cpuidle-haltpoll.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-47702
by Chen Zhongjin 05 Nov '24

05 Nov '24

CVE-2024-47702 Chen Zhongjin (1): bpf: Fix kabi breakage in struct bpf_insn_access_aux Yonghong Song (1): bpf: Fail verification for sign-extension of packet data/data_end/data_meta include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 1/2] bpf: Fail verification for sign-extension of packet data/data_end/data_meta
by Chen Zhongjin 05 Nov '24

05 Nov '24

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 92de36080c93296ef9005690705cba260b9bd68a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJQ CVE: CVE-2024-47702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ Reported-by: syzbot+ad9ec60c8eaf69e6f99c(a)syzkaller.appspotmail.com Fixes: 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20240723153439.2429035-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Conflicts: include/linux/bpf.h [fix context change in struct bpf_insn_access_aux] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index beec79b4d74b..e1447c33f8e2 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -914,6 +914,7 @@ static_assert(__BPF_REG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT); struct bpf_insn_access_aux { enum bpf_reg_type reg_type; KABI_FILL_HOLE(bool is_retval) /* is accessing function return value ? */ + bool is_ldsx; union { int ctx_field_size; struct { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e11daa9fccee..915ff766ec3d 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5576,12 +5576,13 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id, bool *is_retval) + struct btf **btf, u32 *btf_id, bool *is_retval, bool is_ldsx) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, .is_retval = false, + .is_ldsx = is_ldsx, }; if (env->ops->is_valid_access && @@ -6844,7 +6845,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id, &is_retval); + &btf_id, &is_retval, is_ldsx); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { diff --git a/net/core/filter.c b/net/core/filter.c index e16d746c23da..e4f1dc9f222b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8601,13 +8601,16 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type if (off + size > offsetofend(struct __sk_buff, cb[4])) return false; break; + case bpf_ctx_range(struct __sk_buff, data): + case bpf_ctx_range(struct __sk_buff, data_meta): + case bpf_ctx_range(struct __sk_buff, data_end): + if (info->is_ldsx || size != size_default) + return false; + break; case bpf_ctx_range_till(struct __sk_buff, remote_ip6[0], remote_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, local_ip6[0], local_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4): case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4): - case bpf_ctx_range(struct __sk_buff, data): - case bpf_ctx_range(struct __sk_buff, data_meta): - case bpf_ctx_range(struct __sk_buff, data_end): if (size != size_default) return false; break; @@ -9051,6 +9054,14 @@ static bool xdp_is_valid_access(int off, int size, } } return false; + } else { + switch (off) { + case offsetof(struct xdp_md, data_meta): + case offsetof(struct xdp_md, data): + case offsetof(struct xdp_md, data_end): + if (info->is_ldsx) + return false; + } } switch (off) { @@ -9381,12 +9392,12 @@ static bool flow_dissector_is_valid_access(int off, int size, switch (off) { case bpf_ctx_range(struct __sk_buff, data): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET; return true; case bpf_ctx_range(struct __sk_buff, data_end): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET_END; return true; -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS 0/5] ext4: fix CVE-2024-47701
by Baokun Li 05 Nov '24

05 Nov '24

Eric Whitney (1): ext4: fix RENAME_WHITEOUT handling for inline directories Thadeu Lima de Souza Cascardo (4): ext4: ext4_search_dir should return a proper error ext4: return error on ext4_find_inline_entry ext4: explicitly exit when ext4_find_inline_entry returns an error ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- fs/ext4/namei.c | 25 ++++++++++++++----------- 2 files changed, 39 insertions(+), 21 deletions(-) -- 2.46.1

2 6

[PATCH OLK-5.10 0/4] ext4: fix CVE-2024-47701
by Baokun Li 05 Nov '24

05 Nov '24

Thadeu Lima de Souza Cascardo (4): ext4: ext4_search_dir should return a proper error ext4: return error on ext4_find_inline_entry ext4: explicitly exit when ext4_find_inline_entry returns an error ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- fs/ext4/namei.c | 14 ++++++++------ 2 files changed, 33 insertions(+), 16 deletions(-) -- 2.46.1

2 5