- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 15383/23827] fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: bad4d8833739acc8eef306e7ad5c7877f9f4f0fb [15383/23827] etmem: add etmem-scan feature config: x86_64-randconfig-121-20241012 (https://download.01.org/0day-ci/archive/20241012/202410121701.6pXRhoNA-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410121701.6pXRhoNA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410121701.6pXRhoNA-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> fs/proc/etmem_scan.c:244:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] <asn:1> *buf @@ got void *buf @@ fs/proc/etmem_scan.c:244:18: sparse: expected void [noderef] <asn:1> *buf fs/proc/etmem_scan.c:244:18: sparse: got void *buf fs/proc/etmem_scan.c:1032:40: sparse: sparse: incorrect type in assignment (incompatible argument 2 (different address spaces)) @@ expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) @@ got long ( * )( ... ) @@ fs/proc/etmem_scan.c:1032:40: sparse: expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) fs/proc/etmem_scan.c:1032:40: sparse: got long ( * )( ... ) fs/proc/etmem_scan.c:425:46: sparse: sparse: self-comparison always evaluates to false In file included from fs/proc/etmem_scan.c:2: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +244 fs/proc/etmem_scan.c 240 241 static void setup_page_idle_ctrl(struct page_idle_ctrl *pic, void *buf, 242 int buf_size, unsigned int flags) 243 { > 244 pic->buf = buf; 245 pic->buf_size = buf_size; 246 pic->bytes_copied = 0; 247 pic->next_hva = 0; 248 pic->gpa_to_hva = 0; 249 pic->restart_gpa = 0; 250 pic->last_va = 0; 251 pic->flags = flags; 252 } 253 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ALSA: line6: Fix racy access to midibuf
by Yuan Can 12 Oct '24

12 Oct '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.224 commit e7e7d2b180d8f297cea6db43ea72402fd33e1a29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZ4 CVE: CVE-2024-44954 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15b7a03205b31bc5623378c190d22b7ff60026f1 upstream. There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races. Reported-by: syzbot+78eccfb8b3c9a85fc6c5(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/00000000000000949c061df288c5@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20240805130129.10872-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/usb/line6/driver.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c index b67617b68e50..07fd47da8954 100644 --- a/sound/usb/line6/driver.c +++ b/sound/usb/line6/driver.c @@ -286,12 +286,14 @@ static void line6_data_received(struct urb *urb) { struct usb_line6 *line6 = (struct usb_line6 *)urb->context; struct midi_buffer *mb = &line6->line6midi->midibuf_in; + unsigned long flags; int done; if (urb->status == -ESHUTDOWN) return; if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_write(mb, urb->transfer_buffer, urb->actual_length); @@ -300,12 +302,15 @@ static void line6_data_received(struct urb *urb) dev_dbg(line6->ifcdev, "%d %d buffer overflow - message skipped\n", done, urb->actual_length); } + spin_unlock_irqrestore(&line6->line6midi->lock, flags); for (;;) { + spin_lock_irqsave(&line6->line6midi->lock, flags); done = line6_midibuf_read(mb, line6->buffer_message, LINE6_MIDI_MESSAGE_MAXLEN, LINE6_MIDIBUF_READ_RX); + spin_unlock_irqrestore(&line6->line6midi->lock, flags); if (done <= 0) break; -- 2.17.1

2 1

[PATCH OLK-6.6] net/hinic3: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWIA2 CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Fixes: 3b469ecc9cb3 ("Add Huawei Intelligent Network Card Driver: hinic3") Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-6.6] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index aa4cd4143ac7..e16d746c23da 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -11094,7 +11094,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 7

[PATCH OLK-5.10] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index a4d96f0231b2..62d09520a55d 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -9990,7 +9990,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/7] CVE-2022-48878
by Yuan Can 12 Oct '24

12 Oct '24

Fix patch of CVE-2022-48878 and its pre requests and new fix patches. Krzysztof Kozlowski (1): Bluetooth: hci_qca: Fix driver shutdown on closed serdev Venkata Lakshmi Narayana Gubba (4): Bluetooth: hci_qca: Wait for timeout during suspend Bluetooth: hci_qca: Wait for SSR completion during suspend Bluetooth: hci_qca: check for SSR triggered flag while suspend Bluetooth: hci_qca: Fixed issue during suspend Yang Yingliang (1): Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() Zijun Hu (1): Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot drivers/bluetooth/hci_qca.c | 82 ++++++++++++++++++++++++++++++++----- 1 file changed, 72 insertions(+), 10 deletions(-) -- 2.17.1

2 8

[PATCH OLK-5.10] arm64/mpam: Be compatible with MPAM architecture v1.x
by Zeng Heng 12 Oct '24

12 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWM0R -------------------------------- Modified to be compatible with MPAM architecture version 1.x instead of version 1.0 only, otherwise the probe function would fail to initialize MPAM resource. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 6 ++++-- arch/arm64/kernel/mpam/mpam_resource.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c8f2d66da051..deaf990d0c74 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -127,12 +127,14 @@ mpam_probe_update_sysprops(u16 max_partid, u16 max_pmg) static int mpam_device_probe(struct mpam_device *dev) { + u64 idr; u32 hwfeatures, part_sel; u16 max_intpartid = 0; u16 max_partid, max_pmg; - if (mpam_read_reg(dev, MPAMF_AIDR) != MPAM_ARCHITECTURE_V1) { - pr_err_once("device at 0x%llx does not match MPAM architecture v1.0\n", + idr = mpam_read_reg(dev, MPAMF_AIDR); + if ((idr & MPAMF_AIDR_ARCH_MAJOR_REV) != MPAM_ARCHITECTURE_V1) { + pr_err_once("device at 0x%llx does not match MPAM architecture v1.x\n", dev->hwpage_address); return -EIO; } diff --git a/arch/arm64/kernel/mpam/mpam_resource.h b/arch/arm64/kernel/mpam/mpam_resource.h index 93452498c8d1..7a644634c826 100644 --- a/arch/arm64/kernel/mpam/mpam_resource.h +++ b/arch/arm64/kernel/mpam/mpam_resource.h @@ -48,6 +48,10 @@ #define HAS_MSMON BIT(30) #define HAS_PARTID_NRW BIT(31) +/* MPAMF_AIDR - MPAM architecture ID register */ +#define MPAMF_AIDR_ARCH_MAJOR_REV GENMASK(7, 4) +#define MPAMF_AIDR_ARCH_MINOR_REV GENMASK(3, 0) + /* MPAMF_IDR */ #define MPAMF_IDR_PMG_MAX_MASK ((BIT(8) - 1) << 16) #define MPAMF_IDR_PMG_MAX_SHIFT 16 -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Be compatible with MPAM architecture v1.x
by Zeng Heng 12 Oct '24

12 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWM0R -------------------------------- Modified to be compatible with MPAM architecture version 1.x instead of just version 1.0, otherwise the probe function would fail to initialize MPAM resource. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 6 ++++-- arch/arm64/kernel/mpam/mpam_resource.h | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c8f2d66da051..deaf990d0c74 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -127,12 +127,14 @@ mpam_probe_update_sysprops(u16 max_partid, u16 max_pmg) static int mpam_device_probe(struct mpam_device *dev) { + u64 idr; u32 hwfeatures, part_sel; u16 max_intpartid = 0; u16 max_partid, max_pmg; - if (mpam_read_reg(dev, MPAMF_AIDR) != MPAM_ARCHITECTURE_V1) { - pr_err_once("device at 0x%llx does not match MPAM architecture v1.0\n", + idr = mpam_read_reg(dev, MPAMF_AIDR); + if ((idr & MPAMF_AIDR_ARCH_MAJOR_REV) != MPAM_ARCHITECTURE_V1) { + pr_err_once("device at 0x%llx does not match MPAM architecture v1.x\n", dev->hwpage_address); return -EIO; } diff --git a/arch/arm64/kernel/mpam/mpam_resource.h b/arch/arm64/kernel/mpam/mpam_resource.h index 93452498c8d1..7a644634c826 100644 --- a/arch/arm64/kernel/mpam/mpam_resource.h +++ b/arch/arm64/kernel/mpam/mpam_resource.h @@ -48,6 +48,10 @@ #define HAS_MSMON BIT(30) #define HAS_PARTID_NRW BIT(31) +/* MPAMF_AIDR - MPAM architecture ID register */ +#define MPAMF_AIDR_ARCH_MAJOR_REV GENMASK(7, 4) +#define MPAMF_AIDR_ARCH_MINOR_REV GENMASK(3, 0) + /* MPAMF_IDR */ #define MPAMF_IDR_PMG_MAX_MASK ((BIT(8) - 1) << 16) #define MPAMF_IDR_PMG_MAX_SHIFT 16 -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-43855
by Li Nan 12 Oct '24

12 Oct '24

Li Nan (1): md: ensure child flush IO does not affect origin bio->bi_status Yu Kuai (1): md: Remove flush handling drivers/md/md.h | 10 ---- drivers/md/md.c | 134 +++++++++++------------------------------------- 2 files changed, 31 insertions(+), 113 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1] bpf: Remove tst_run from lwt_seg6local_prog_ops.
by Liu Jian 12 Oct '24

12 Oct '24

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit c13fda93aca118b8e5cd202e339046728ee7dddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARX44 CVE: CVE-2024-46754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The syzbot reported that the lwt_seg6 related BPF ops can be invoked via bpf_test_run() without without entering input_action_end_bpf() first. Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL probably didn't work since it was introduced in commit 04d4b274e2a ("ipv6: sr: Add seg6local action End.BPF"). The reason is that the per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self test case but each BPF function expects it. Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL. Suggested-by: Martin KaFai Lau <martin.lau(a)linux.dev> Reported-by: syzbot+608a2acde8c5a101d07d(a)syzkaller.appspotmail.com Fixes: d1542d4ae4df ("seg6: Use nested-BH locking for seg6_bpf_srh_states.") Fixes: 004d4b274e2a ("ipv6: sr: Add seg6local action End.BPF") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240710141631.FbmHcQaX@linutronix.de Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 8a61914d35c5..3cdca0279b2d 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -9881,7 +9881,6 @@ const struct bpf_verifier_ops lwt_seg6local_verifier_ops = { }; const struct bpf_prog_ops lwt_seg6local_prog_ops = { - .test_run = bpf_prog_test_run_skb, }; const struct bpf_verifier_ops cg_sock_verifier_ops = { -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-43855
by Li Nan 12 Oct '24

12 Oct '24

Li Nan (1): md: ensure child flush IO does not affect origin bio->bi_status Mikulas Patocka (1): md: fix a crash in mempool_free Yu Kuai (1): md: Remove flush handling drivers/md/md.h | 10 ---- drivers/md/md.c | 137 ++++++++++++------------------------------------ 2 files changed, 34 insertions(+), 113 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10] md/raid1: don't free conf on raid0_run failure
by Zheng Qixing 12 Oct '24

12 Oct '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.11-rc1 commit 17f91ac0843b50462a9c9c8f18df962338bd3db2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUQ97 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240604172607.3185916-3-hch@lst.de Conflicts: drivers/md/raid1.c [The conflicts here are due to inconsistencies in the context.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 4584fba5a010..333b611aa152 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3069,7 +3069,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3128,8 +3127,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3162,14 +3160,8 @@ static int raid1_run(struct mddev *mddev) } ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(&mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- 2.39.2

2 1

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAWGUW CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAWIA2 CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWIA2 CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 12 Oct '24

12 Oct '24

From: Shi Jing <shijing34(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWGUW CVE: NA -------------------------------- Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[openeuler:openEuler-1.0-LTS 4034/23827] fs/file.c:368:17: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 72ee1590dc860d0091f8e7714b467be5878d51ae [4034/23827] cgroups: Resource controller for open files config: x86_64-randconfig-123-20241012 (https://download.01.org/0day-ci/archive/20241012/202410120916.m0AjmQWh-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410120916.m0AjmQWh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410120916.m0AjmQWh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) fs/file.c:339:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file **old_fds @@ got struct file [noderef] <asn:4> **fd @@ fs/file.c:339:17: sparse: expected struct file **old_fds fs/file.c:339:17: sparse: got struct file [noderef] <asn:4> **fd fs/file.c:340:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file **new_fds @@ got struct file [noderef] <asn:4> **fd @@ fs/file.c:340:17: sparse: expected struct file **new_fds fs/file.c:340:17: sparse: got struct file [noderef] <asn:4> **fd >> fs/file.c:368:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file **[assigned] new_fds @@ got struct file [noderef] <asn:4> **fd @@ fs/file.c:368:17: sparse: expected struct file **[assigned] new_fds fs/file.c:368:17: sparse: got struct file [noderef] <asn:4> **fd fs/file.c:409:54: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct file *file @@ got struct file [noderef] <asn:4> *[assigned] __ret @@ fs/file.c:409:54: sparse: expected struct file *file fs/file.c:409:54: sparse: got struct file [noderef] <asn:4> *[assigned] __ret fs/file.c:477:28: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct fdtable [noderef] <asn:4> *fdt @@ got struct fdtable * @@ fs/file.c:477:28: sparse: expected struct fdtable [noderef] <asn:4> *fdt fs/file.c:477:28: sparse: got struct fdtable * fs/file.c:666:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file *file @@ got struct file [noderef] <asn:4> * @@ fs/file.c:666:14: sparse: expected struct file *file fs/file.c:666:14: sparse: got struct file [noderef] <asn:4> * fs/file.c:701:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file *file @@ got struct file [noderef] <asn:4> * @@ fs/file.c:701:30: sparse: expected struct file *file fs/file.c:701:30: sparse: got struct file [noderef] <asn:4> * fs/file.c:868:16: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file *tofree @@ got struct file [noderef] <asn:4> * @@ fs/file.c:868:16: sparse: expected struct file *tofree fs/file.c:868:16: sparse: got struct file [noderef] <asn:4> * fs/file.o: warning: objtool: alloc_fdtable()+0x2d: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __fget()+0x2c3: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __put_unused_fd()+0x56: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __close_fd()+0x63: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: do_dup2()+0x62: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: iterate_fd.part.0()+0x187: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: expand_fdtable.constprop.0()+0x108: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: expand_files()+0x145: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: ksys_dup3()+0x148: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __se_sys_dup2()+0x1da: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: dup_fd()+0x87e: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __alloc_fd()+0x39e: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: __fd_install()+0xb1: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: do_close_on_exec()+0x9d: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: set_close_on_exec()+0x97: sibling call from callable instruction with modified stack frame fs/file.o: warning: objtool: get_close_on_exec()+0x141: sibling call from callable instruction with modified stack frame vim +368 fs/file.c 300 301 spin_lock(&oldf->file_lock); 302 old_fdt = files_fdtable(oldf); 303 open_files = count_open_files(old_fdt); 304 305 /* 306 * Check whether we need to allocate a larger fd array and fd set. 307 */ 308 while (unlikely(open_files > new_fdt->max_fds)) { 309 spin_unlock(&oldf->file_lock); 310 311 if (new_fdt != &newf->fdtab) 312 __free_fdtable(new_fdt); 313 314 new_fdt = alloc_fdtable(open_files - 1); 315 if (!new_fdt) { 316 *errorp = -ENOMEM; 317 goto out_release; 318 } 319 320 /* beyond sysctl_nr_open; nothing to do */ 321 if (unlikely(new_fdt->max_fds < open_files)) { 322 __free_fdtable(new_fdt); 323 *errorp = -EMFILE; 324 goto out_release; 325 } 326 327 /* 328 * Reacquire the oldf lock and a pointer to its fd table 329 * who knows it may have a new bigger fd table. We need 330 * the latest pointer. 331 */ 332 spin_lock(&oldf->file_lock); 333 old_fdt = files_fdtable(oldf); 334 open_files = count_open_files(old_fdt); 335 } 336 337 copy_fd_bitmaps(new_fdt, old_fdt, open_files); 338 339 old_fds = old_fdt->fd; 340 new_fds = new_fdt->fd; 341 342 for (i = open_files; i != 0; i--) { 343 struct file *f = *old_fds++; 344 if (f) { 345 get_file(f); 346 } else { 347 /* 348 * The fd may be claimed in the fd bitmap but not yet 349 * instantiated in the files array if a sibling thread 350 * is partway through open(). So make sure that this 351 * fd is available to the new process. 352 */ 353 __clear_open_fd(open_files - i, new_fdt); 354 } 355 rcu_assign_pointer(*new_fds++, f); 356 } 357 spin_unlock(&oldf->file_lock); 358 359 /* clear the remainder */ 360 memset(new_fds, 0, (new_fdt->max_fds - open_files) * sizeof(struct file *)); 361 362 rcu_assign_pointer(newf->fdt, new_fdt); 363 #ifdef CONFIG_CGROUP_FILES 364 if (!files_cgroup_alloc_fd(newf, files_cgroup_count_fds(newf))) 365 return newf; 366 367 /* could not get enough FD resources. Need to clean up. */ > 368 new_fds = new_fdt->fd; 369 for (i = open_files; i != 0; i--) { 370 struct file *f = *new_fds++; 371 372 if (f) 373 fput(f); 374 } 375 if (new_fdt != &newf->fdtab) 376 __free_fdtable(new_fdt); 377 *errorp = -EMFILE; 378 #else 379 return newf; 380 #endif 381 382 out_release: 383 #ifdef CONFIG_CGROUP_FILES 384 files_cgroup_remove(newf); 385 #endif 386 kmem_cache_free(files_cachep, newf); 387 out: 388 return NULL; 389 } 390 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20575/23827] drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 12 Oct '24

12 Oct '24

Hi leoliuoc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 050ff2f361bf733d1dde505dea8b0f5ecb23507c [20575/23827] hwrng: Add Zhaoxin rng driver config: x86_64-buildonly-randconfig-003-20241010 (https://download.01.org/0day-ci/archive/20241012/202410121153.VMwUxyGS-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410121153.VMwUxyGS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410121153.VMwUxyGS-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/char/hw_random/zhaoxin-rng.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 10655/14350] drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: .text: unexpected end of section
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: 241ad43fe7e9c24d5ba4cdd1ec22e731cdd22d14 [10655/14350] Compiler: Add clang's PGO support for kernel. config: x86_64-randconfig-121-20241012 (https://download.01.org/0day-ci/archive/20241012/202410120718.Pcw8jZBK-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410120718.Pcw8jZBK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410120718.Pcw8jZBK-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: .text: unexpected end of section Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17755/23827] drivers/dax/kmem.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 12 Oct '24

12 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: be13c6c633412a576f1a666c07dbaae19331b0fc [17755/23827] Intel: device-dax: "Hotplug" persistent memory for use like normal RAM config: x86_64-buildonly-randconfig-003-20241010 (https://download.01.org/0day-ci/archive/20241012/202410120614.DTc2PtdL-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241012/202410120614.DTc2PtdL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410120614.DTc2PtdL-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/dax/kmem.c:4: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/dax/kmem.c:17:5: warning: no previous prototype for function 'dev_dax_kmem_probe' [-Wmissing-prototypes] 17 | int dev_dax_kmem_probe(struct device *dev) | ^ drivers/dax/kmem.c:17:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 17 | int dev_dax_kmem_probe(struct device *dev) | ^ | static 2 warnings generated. >> drivers/dax/kmem.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-46826
by Gu Bowen 11 Oct '24

11 Oct '24

Fix CVE-2024-46826 Alexey Dobriyan (1): ELF: fix kernel.randomize_va_space double read Gu Bowen (1): ELF: Fix mixed declarations and code of "snapshot_randomize_va_space" fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 5957/23827] include/linux/uaccess.h:112:17: warning: 'bind' may be used uninitialized
by kernel test robot 11 Oct '24

11 Oct '24

Hi Jean-Philippe, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 2dd8345826607c5d2d6528de872118da554015b6 [5957/23827] vfio: Add support for Shared Virtual Addressing config: arm64-randconfig-004-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111943.njyjH1kd-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111943.njyjH1kd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111943.njyjH1kd-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from drivers/vfio/vfio_iommu_type1.c:31: include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'vfio_iommu_type1_init': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2222:1: note: in expansion of macro 'module_init' 2222 | module_init(vfio_iommu_type1_init); | ^~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2212:19: note: 'init_module' target declared here 2212 | static int __init vfio_iommu_type1_init(void) | ^~~~~~~~~~~~~~~~~~~~~ include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'vfio_iommu_type1_cleanup': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2223:1: note: in expansion of macro 'module_exit' 2223 | module_exit(vfio_iommu_type1_cleanup); | ^~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2217:20: note: 'cleanup_module' target declared here 2217 | static void __exit vfio_iommu_type1_cleanup(void) | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compat.h:19, from drivers/vfio/vfio_iommu_type1.c:27: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_bind_process' at drivers/vfio/vfio_iommu_type1.c:1933:6: include/linux/uaccess.h:112:17: warning: 'params' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/asm-generic/div64.h:25, from ./arch/arm64/include/generated/asm/div64.h:1, from include/linux/math64.h:6, from include/linux/time64.h:5, from include/linux/compat_time.h:6, from include/linux/compat.h:10: include/linux/kasan-checks.h: In function 'vfio_iommu_type1_bind_process': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:1920:46: note: 'params' declared here 1920 | struct vfio_iommu_type1_bind_process params; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_unbind_process' at drivers/vfio/vfio_iommu_type1.c:2021:6: include/linux/uaccess.h:112:17: warning: 'params' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_unbind_process': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2014:46: note: 'params' declared here 2014 | struct vfio_iommu_type1_bind_process params; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2084:7: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2080:46: note: 'info' declared here 2080 | struct vfio_iommu_type1_info info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2104:7: include/linux/uaccess.h:112:17: warning: 'map' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2098:49: note: 'map' declared here 2098 | struct vfio_iommu_type1_dma_map map; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2118:7: include/linux/uaccess.h:112:17: warning: 'unmap' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2113:51: note: 'unmap' declared here 2113 | struct vfio_iommu_type1_dma_unmap unmap; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2136:7: >> include/linux/uaccess.h:112:17: warning: 'bind' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2132:46: note: 'bind' declared here 2132 | struct vfio_iommu_type1_bind bind; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'vfio_iommu_type1_ioctl' at drivers/vfio/vfio_iommu_type1.c:2155:7: >> include/linux/uaccess.h:112:17: warning: 'bind' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'vfio_iommu_type1_ioctl': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/vfio/vfio_iommu_type1.c:2151:46: note: 'bind' declared here 2151 | struct vfio_iommu_type1_bind bind; | ^~~~ vim +/bind +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 d597580d373774 Al Viro 2017-03-20 124 #ifdef INLINE_COPY_TO_USER d597580d373774 Al Viro 2017-03-20 125 static inline unsigned long d597580d373774 Al Viro 2017-03-20 126 _copy_to_user(void __user *to, const void *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 127 { 9c5f6908de03a4 Al Viro 2017-06-29 128 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 129 if (access_ok(to, n)) { 9c5f6908de03a4 Al Viro 2017-06-29 130 kasan_check_read(from, n); d597580d373774 Al Viro 2017-03-20 131 n = raw_copy_to_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 132 } d597580d373774 Al Viro 2017-03-20 133 return n; d597580d373774 Al Viro 2017-03-20 134 } d597580d373774 Al Viro 2017-03-20 135 #else d597580d373774 Al Viro 2017-03-20 136 extern unsigned long d597580d373774 Al Viro 2017-03-20 137 _copy_to_user(void __user *, const void *, unsigned long); d597580d373774 Al Viro 2017-03-20 138 #endif d597580d373774 Al Viro 2017-03-20 139 d597580d373774 Al Viro 2017-03-20 140 static __always_inline unsigned long __must_check d597580d373774 Al Viro 2017-03-20 141 copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 142 { b0377fedb65280 Al Viro 2017-06-29 143 if (likely(check_copy_size(to, n, false))) d597580d373774 Al Viro 2017-03-20 @144 n = _copy_from_user(to, from, n); d597580d373774 Al Viro 2017-03-20 145 return n; d597580d373774 Al Viro 2017-03-20 146 } d597580d373774 Al Viro 2017-03-20 147 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29971/30000] drivers/net/ipvlan/ipvlan_main.c:431:19: warning: variable 'old_prog' set but not used
by kernel test robot 11 Oct '24

11 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 33a5644b70e15c265ec94eb3726216950a1476ef commit: 373ce97bdbb6378acf984656798aff4bb706a447 [29971/30000] ipvlan: support use xdp native mode config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241011/202410111924.i3Aw2F5F-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111924.i3Aw2F5F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111924.i3Aw2F5F-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ipvlan/ipvlan_main.c:431:19: warning: variable 'old_prog' set but not used [-Wunused-but-set-variable] 431 | struct bpf_prog *old_prog; | ^ 1 warning generated. vim +/old_prog +431 drivers/net/ipvlan/ipvlan_main.c 426 427 static int ipvlan_xdp_set(struct net_device *dev, struct bpf_prog *prog, 428 struct netlink_ext_ack *extack) 429 { 430 struct ipvl_dev *priv = netdev_priv(dev); > 431 struct bpf_prog *old_prog; 432 433 old_prog = rtnl_dereference(priv->xdp_prog); 434 rcu_assign_pointer(priv->xdp_prog, prog); 435 return 0; 436 } 437 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 2962/23827] fs/pstore/inode.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 11 Oct '24

11 Oct '24

Hi Kees, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: 68bc9e8812a24c4a04fd18a9e1ede123eaff0420 [2962/23827] pstore: Centralize init/exit routines config: x86_64-buildonly-randconfig-005-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111843.JeVyH5TZ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111843.JeVyH5TZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111843.JeVyH5TZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/pstore/inode.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] fix: fix version showed in ethtool
by s00851154 11 Oct '24

11 Oct '24

From: Shi Jing <shijing34(a)huawei.com> Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10 V1] sched/fair: Fix the condition in overload_clear
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWDO4 ----------------------------------------- In the overload_clear function, there is a bug when setting the overload_cpus, that is, when the steal_task feature is globally enabled and rq->cfs.h_nr_running is less than 2, the need_clear should be set to true. Fixes: 433c0b725642 ("sched/fair: Count the number of tasks marked as steal_task on cfs_rq") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 38841d1d640a..a518d636f07f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4492,11 +4492,10 @@ static void overload_clear(struct rq *rq) if (!steal_enabled()) return; - if (!group_steal_used() && rq->cfs.h_nr_running >= 2) - return; + if (rq->cfs.h_nr_running < 2) + need_clear = true; - if (group_steal_used() && - (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) + if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) need_clear = true; if (!need_clear) -- 2.25.1

2 1

[PATCH OLK-6.6] fix: fix version showed in ethtool
by s00851154 11 Oct '24

11 Oct '24

From: Shi Jing <shijing34(a)huawei.com> Fix the version in the output of ethtool commands from empty to the kernel version. Use the macro HINIC3_NIC_DRV_VERSION to record driver changes for developers. The last number 1.0.X grow as minor changes, like this revision which does not affect the main functions. The middle number 1.X.1 iterates with changes to drivers functionality and fixing of serious bugs, and the first one X.0.1 means the number of releases of the driver. Signed-off-by: Shi Jing <shijing34(a)huawei.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c | 1 - drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c index 5a1995956a555..4ea526329d155 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strscpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strscpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strscpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 2967311aab76c..5868187eafa99 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH OLK-5.10 V1] sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAWDPS ----------------------------------------- It would be more practical to put the statistics of h_nr_running and steal_h_nr_running in the per-cpu column. Fixes: 1f9456c873b7 ("sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index ff2d6dc59c14..4275398bc713 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -594,11 +594,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) SEQ_printf(m, " .%-30s: %d\n", "nr_spread_over", cfs_rq->nr_spread_over); SEQ_printf(m, " .%-30s: %d\n", "nr_running", cfs_rq->nr_running); -#ifdef CONFIG_SCHED_STEAL - SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", cfs_rq->h_nr_running); - SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", - cfs_rq->steal_h_nr_running); -#endif SEQ_printf(m, " .%-30s: %ld\n", "load", cfs_rq->load.weight); #ifdef CONFIG_SMP SEQ_printf(m, " .%-30s: %lu\n", "load_avg", @@ -714,6 +709,11 @@ do { \ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", #x, SPLIT_NS(rq->x)) P(nr_running); +#ifdef CONFIG_SCHED_STEAL + SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", rq->cfs.h_nr_running); + SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", + rq->cfs.steal_h_nr_running); +#endif P(nr_switches); P(nr_uninterruptible); PN(next_balance); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2024-46826
by Gu Bowen 11 Oct '24

11 Oct '24

Fix CVE-2024-46826 Alexey Dobriyan (1): ELF: fix kernel.randomize_va_space double read Gu Bowen (1): ELF: Fix mixed declarations and code of "snapshot_randomize_va_space" fs/binfmt_elf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 20512/23827] drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction
by kernel test robot 11 Oct '24

11 Oct '24

Hi Logan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 9b2f1457c730cd7915663ac5d9ccb849f2657714 commit: a89f484219c9ea217d26908f16037d1ab55d4f17 [20512/23827] md: Ensure resync is reported after it starts config: x86_64-randconfig-001-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111657.HXras3Wj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111657.HXras3Wj-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/md/md.c:49: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/md.c:320:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 320 | int cpu; | ^ drivers/md/md.c:2231:24: warning: variable 'bi_rdev' set but not used [-Wunused-but-set-variable] 2231 | struct blk_integrity *bi_rdev; | ^ 3 warnings generated. >> drivers/md/md.o: warning: objtool: md_seq_show()+0x1087: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 0/2] bugfix for cgroup steal task
by Cheng Yu 11 Oct '24

11 Oct '24

bugfix for cgroup steal task Cheng Yu (2): sched/fair: Fix the condition in overload_clear sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug kernel/sched/debug.c | 10 +++++----- kernel/sched/fair.c | 7 +++---- 2 files changed, 8 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 V1 1/2] sched/fair: Fix the condition in overload_clear
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- In the overload_clear function, there is a bug when setting the overload_cpus, that is, when the steal_task feature is globally enabled and rq->cfs.h_nr_running is less than 2, the need_clear should be set to true. Fixes: 433c0b725642 ("sched/fair: Count the number of tasks marked as steal_task on cfs_rq") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/fair.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 38841d1d640a..a518d636f07f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -4492,11 +4492,10 @@ static void overload_clear(struct rq *rq) if (!steal_enabled()) return; - if (!group_steal_used() && rq->cfs.h_nr_running >= 2) - return; + if (rq->cfs.h_nr_running < 2) + need_clear = true; - if (group_steal_used() && - (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) + if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) need_clear = true; if (!need_clear) -- 2.25.1

2 1

[openeuler:OLK-6.6 777/14350] arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B
by kernel test robot 11 Oct '24

11 Oct '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: db5bb24abc8dd120fd81b7ce21819e96578d011e [777/14350] LoongArch: Old BPI compatibility config: loongarch-randconfig-r062-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111529.bqXXUCAv-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111529.bqXXUCAv-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/loongarch/kernel/legacy_boot.c:439:25-27: WARNING !A || A && B is equivalent to !A || B vim +439 arch/loongarch/kernel/legacy_boot.c 423 424 static struct fwnode_handle * __init parse_isa_base(u64 *cpu_addr) 425 { 426 struct device_node *np; 427 const __be32 *ranges = NULL; 428 int len; 429 struct device_node *node; 430 431 for_each_node_by_name(np, "isa") { 432 node = of_node_get(np); 433 434 if (!node) 435 break; 436 437 ranges = of_get_property(node, "ranges", &len); 438 > 439 if (!ranges || (ranges && len > 0)) 440 break; 441 } 442 if (ranges) { 443 ranges += 2; 444 *cpu_addr = of_translate_address(np, ranges); 445 return &np->fwnode; 446 } 447 448 return NULL; 449 } 450 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 V1 2/2] sched/debug: Fix h_nr_running/steal_h_nr_running in sched_debug
by Cheng Yu 11 Oct '24

11 Oct '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAQWPQ ----------------------------------------- It would be more practical to put the statistics of h_nr_running and steal_h_nr_running in the per-cpu column. Fixes: 1f9456c873b7 ("sched/debug: Add h_nr_running/steal_h_nr_running in sched_debug") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- kernel/sched/debug.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index ff2d6dc59c14..4275398bc713 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -594,11 +594,6 @@ void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq) SEQ_printf(m, " .%-30s: %d\n", "nr_spread_over", cfs_rq->nr_spread_over); SEQ_printf(m, " .%-30s: %d\n", "nr_running", cfs_rq->nr_running); -#ifdef CONFIG_SCHED_STEAL - SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", cfs_rq->h_nr_running); - SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", - cfs_rq->steal_h_nr_running); -#endif SEQ_printf(m, " .%-30s: %ld\n", "load", cfs_rq->load.weight); #ifdef CONFIG_SMP SEQ_printf(m, " .%-30s: %lu\n", "load_avg", @@ -714,6 +709,11 @@ do { \ SEQ_printf(m, " .%-30s: %Ld.%06ld\n", #x, SPLIT_NS(rq->x)) P(nr_running); +#ifdef CONFIG_SCHED_STEAL + SEQ_printf(m, " .%-30s: %d\n", "h_nr_running", rq->cfs.h_nr_running); + SEQ_printf(m, " .%-30s: %ld\n", "steal_h_nr_running", + rq->cfs.steal_h_nr_running); +#endif P(nr_switches); P(nr_uninterruptible); PN(next_balance); -- 2.25.1

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f7c1291d7c3f15bc448cd93e29fa539386fe85fe
by kernel test robot 11 Oct '24

11 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f7c1291d7c3f15bc448cd93e29fa539386fe85fe !12080 btrfs: clean up our handling of refs == 0 in snapshot delete Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410101809.HFdpybos-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410111205.LRqw3beL-lkp@intel.com drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' ld.lld: error: undefined symbol: arch_elf_adjust_prot Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-004-20241010 | `-- ld.lld:error:undefined-symbol:arch_elf_adjust_prot |-- loongarch-allmodconfig | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | `-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-001-20241011 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-002-20241011 | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-randconfig-r062-20241011 | `-- arch-loongarch-kernel-legacy_boot.c:WARNING-A-A-B-is-equivalent-to-A-B |-- x86_64-allyesconfig | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-buildonly-randconfig-003-20241011 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-tdm-dev.c:error:incomplete-definition-of-type-struct-module | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3 | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-func | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- x86_64-rhel-8.3-kselftests | |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-vpsp_do_cmd | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP | |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. | `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst `-- x86_64-rhel-8.3-rust |-- drivers-crypto-ccp-hygon-csv-dev.c:warning:no-previous-prototype-for-function-vpsp_do_cmd |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-Directly-convert-the-gpa-address-into-hpa-and-forward-it-to-PSP |-- drivers-crypto-ccp-hygon-vpsp.c:warning:Cannot-understand-brief-copy-data-in-gpa-to-host-memory-and-send-it-to-psp-for-processing. `-- drivers-crypto-ccp-hygon-vpsp.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst elapsed time: 1257m configs tested: 32 configs skipped: 133 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241011 gcc-14.1.0 arm64 randconfig-002-20241011 clang-20 arm64 randconfig-003-20241011 clang-20 arm64 randconfig-004-20241011 gcc-14.1.0 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20241011 gcc-14.1.0 loongarch randconfig-002-20241011 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241011 gcc-12 x86_64 buildonly-randconfig-002-20241011 gcc-12 x86_64 buildonly-randconfig-003-20241011 clang-18 x86_64 buildonly-randconfig-004-20241011 clang-18 x86_64 buildonly-randconfig-005-20241011 gcc-12 x86_64 buildonly-randconfig-006-20241011 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20241011 clang-18 x86_64 randconfig-002-20241011 gcc-11 x86_64 randconfig-003-20241011 gcc-12 x86_64 randconfig-004-20241011 gcc-12 x86_64 randconfig-005-20241011 clang-18 x86_64 randconfig-006-20241011 clang-18 x86_64 randconfig-011-20241011 gcc-12 x86_64 randconfig-012-20241011 clang-18 x86_64 randconfig-013-20241011 gcc-11 x86_64 randconfig-014-20241011 clang-18 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/3] CVE-2024-46858
by Wang Liang 11 Oct '24

11 Oct '24

Davide Caratti (1): mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Edward Adam Davis (1): mptcp: pm: Fix uaf in __timer_delete_sync Geliang Tang (1): mptcp: export lookup_anno_list_by_saddr net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 27 ++++++++++++++++----------- net/mptcp/protocol.h | 5 ++++- 3 files changed, 21 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-22.03-LTS-SP1] net: dpaa: Pad packets to ETH_ZLEN
by Wang Liang 11 Oct '24

11 Oct '24

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.11 commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O1 CVE: CVE-2024-46854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240910143144.1439910-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cb7c028b1bf5..638dd56bbc5e 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2147,12 +2147,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2162,6 +2162,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] netfilter: nft_socket: fix sk refcount leaks
by Wang Liang 11 Oct '24

11 Oct '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11 commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9K2 CVE: CVE-2024-46855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must put 'sk' reference before returning. Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_socket.c [conflicts due to not mergered e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nft_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index f6d517185d9c..151cd2fc0765 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } +out_put_sk: if (sk != skb->sk) sock_gen_put(sk); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2024-46858
by Wang Liang 11 Oct '24

11 Oct '24

Davide Caratti (1): mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Edward Adam Davis (1): mptcp: pm: Fix uaf in __timer_delete_sync Geliang Tang (1): mptcp: export lookup_anno_list_by_saddr net/mptcp/options.c | 2 +- net/mptcp/pm_netlink.c | 27 ++++++++++++++++----------- net/mptcp/protocol.h | 5 ++++- 3 files changed, 21 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] net: dpaa: Pad packets to ETH_ZLEN
by Wang Liang 11 Oct '24

11 Oct '24

From: Sean Anderson <sean.anderson(a)linux.dev> mainline inclusion from mainline-v6.11 commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9O1 CVE: CVE-2024-46854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Fixes: 9ad1a3749333 ("dpaa_eth: add support for DPAA Ethernet") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20240910143144.1439910-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c index cb7c028b1bf5..638dd56bbc5e 100644 --- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c @@ -2147,12 +2147,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); - bool nonlinear = skb_is_nonlinear(skb); struct rtnl_link_stats64 *percpu_stats; struct dpaa_percpu_priv *percpu_priv; struct netdev_queue *txq; struct dpaa_priv *priv; struct qm_fd fd; + bool nonlinear; int offset = 0; int err = 0; @@ -2162,6 +2162,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) qm_fd_clear_fd(&fd); + /* Packet data is always read as 32-bit words, so zero out any part of + * the skb which might be sent if we have to pad the packet + */ + if (__skb_put_padto(skb, ETH_ZLEN, false)) + goto enomem; + + nonlinear = skb_is_nonlinear(skb); if (!nonlinear) { /* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nft_socket: fix sk refcount leaks
by Wang Liang 11 Oct '24

11 Oct '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11 commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9K2 CVE: CVE-2024-46855 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We must put 'sk' reference before returning. Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_socket.c [conflicts due to not mergered e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nft_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index 826e5f8c78f3..07e73e50b713 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } +out_put_sk: if (sk != skb->sk) sock_gen_put(sk); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 9b2f1457c730cd7915663ac5d9ccb849f2657714
by kernel test robot 11 Oct '24

11 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 9b2f1457c730cd7915663ac5d9ccb849f2657714 !12071 btrfs: clean up our handling of refs == 0 in snapshot delete Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-001-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20241011 | `-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay |-- arm64-randconfig-003-20241011 | `-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) |-- arm64-randconfig-004-20241011 | |-- include-linux-uaccess.h:warning:bind-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kmask-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:p-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:params-may-be-used-uninitialized |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-002-20241011 | |-- arch-x86-kernel-cpu-mce-therm_throt.o:warning:objtool:missing-symbol-for-section-.irqentry.text | `-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241011 | |-- fs-sysfs-symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- net-9p-client.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-ax25-ax25_dev.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-buildonly-randconfig-005-20241011 | `-- fs-pstore-inode.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-001-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-002-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-003-20241011 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-012-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-014-20241011 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-015-20241011 `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity elapsed time: 1226m configs tested: 30 configs skipped: 138 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20241011 gcc-14.1.0 arm64 randconfig-002-20241011 gcc-14.1.0 arm64 randconfig-003-20241011 gcc-14.1.0 arm64 randconfig-004-20241011 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20241011 gcc-12 x86_64 buildonly-randconfig-002-20241011 gcc-12 x86_64 buildonly-randconfig-003-20241011 clang-18 x86_64 buildonly-randconfig-004-20241011 clang-18 x86_64 buildonly-randconfig-005-20241011 gcc-12 x86_64 buildonly-randconfig-006-20241011 clang-18 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20241011 clang-18 x86_64 randconfig-002-20241011 gcc-11 x86_64 randconfig-003-20241011 gcc-12 x86_64 randconfig-004-20241011 gcc-12 x86_64 randconfig-005-20241011 clang-18 x86_64 randconfig-006-20241011 clang-18 x86_64 randconfig-011-20241011 gcc-12 x86_64 randconfig-012-20241011 clang-18 x86_64 randconfig-013-20241011 gcc-11 x86_64 randconfig-014-20241011 clang-18 x86_64 randconfig-015-20241011 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/6] Backport some patches of hns RoCE from mainline
by Chengchang Tang 11 Oct '24

11 Oct '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Backport some patches of hns RoCE from Linux mainline to olk-5.10 Chengchang Tang (2): RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled Junxian Huang (1): RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler Xinghai Cen (3): Revert "RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler" Revert "RDMA/hns: Fix 1bit-ECC recovery address in non-4K OS" Revert "RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled" -- 2.33.0

2 7

[openeuler:OLK-6.6 13318/14350] drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module'
by kernel test robot 11 Oct '24

11 Oct '24

Hi chench00, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f7c1291d7c3f15bc448cd93e29fa539386fe85fe commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [13318/14350] crypto: tdm: Add Hygon TDM driver config: x86_64-buildonly-randconfig-003-20241011 (https://download.01.org/0day-ci/archive/20241011/202410111205.LRqw3beL-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241011/202410111205.LRqw3beL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410111205.LRqw3beL-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-dev.c:94:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^ >> drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:707:53: note: expanded from macro 'memcpy' 707 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^ include/linux/fortify-string.h:650:41: note: expanded from macro '__fortify_memcpy_chk' 650 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:708:35: note: expanded from macro 'memcpy' 708 | __struct_size(p), __struct_size(q), \ | ^ include/linux/fortify-string.h:110:56: note: expanded from macro '__struct_size' 110 | #define __struct_size(p) __builtin_dynamic_object_size(p, 0) | ^ include/linux/fortify-string.h:652:27: note: expanded from macro '__fortify_memcpy_chk' 652 | const size_t __q_size = (q_size); \ | ^~~~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:709:35: note: expanded from macro 'memcpy' 709 | __member_size(p), __member_size(q), \ | ^ include/linux/fortify-string.h:111:56: note: expanded from macro '__member_size' 111 | #define __member_size(p) __builtin_dynamic_object_size(p, 1) | ^ include/linux/fortify-string.h:654:33: note: expanded from macro '__fortify_memcpy_chk' 654 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ include/linux/fortify-string.h:707:50: note: expanded from macro 'memcpy' 707 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^ include/linux/fortify-string.h:662:23: note: expanded from macro '__fortify_memcpy_chk' 662 | __underlying_##op(p, q, __fortify_size); \ | ^ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:606:20: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^ 2 warnings and 4 errors generated. vim +340 drivers/crypto/ccp/hygon/tdm-dev.c 323 324 if (!hash) { 325 ret = -DYN_NULL_POINTER; 326 pr_err("Null pointer\n"); 327 goto end; 328 } 329 330 ctx_msg.flag = flag; 331 ctx_msg.pid = current->pid; 332 memcpy(ctx_msg.comm, current->comm, sizeof(current->comm)); 333 334 return_address = CALLER_ADDR1; 335 if (return_address) { 336 #if IS_BUILTIN(CONFIG_CRYPTO_DEV_CCP_DD) 337 p_module = __module_address(return_address); 338 // caller is module 339 if (p_module) > 340 memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); 341 // caller is build-in 342 else 343 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 344 #elif IS_ENABLED(CONFIG_KALLSYMS) 345 symbol_len = sprint_symbol((char *)symbol_buf, return_address); 346 if (!symbol_len) { 347 ret = -DYN_ERR_API; 348 pr_err("sprint_symbol failed\n"); 349 goto end; 350 } 351 symbol_begin = strchr((char *)symbol_buf, '['); 352 if (!symbol_begin) { 353 ret = -DYN_NULL_POINTER; 354 pr_err("module name is not exist\n"); 355 goto end; 356 } 357 symbol_end = strchr((char *)symbol_buf, ']'); 358 if (!symbol_end) { 359 ret = -DYN_NULL_POINTER; 360 pr_err("module name is not exist\n"); 361 goto end; 362 } 363 symbol_begin++; 364 if (symbol_end - symbol_begin) 365 memcpy(ctx_msg.module_name, symbol_begin, symbol_end - symbol_begin); 366 else 367 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 368 #else 369 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 370 #endif 371 } else 372 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 373 374 ret = calc_task_context_hash(ctx_msg, hash); 375 if (ret) { 376 pr_err("calc_task_context_hash failed\n"); 377 goto end; 378 } 379 380 end: 381 return ret; 382 } 383 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 49f59d53b4b2..cf285d43d0c1 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-6.6] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 311007b1d904..c2e666e82857 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -754,7 +754,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-5.10] USB: usbtmc: prevent kernel-usb-infoleak
by Yipeng Zou 11 Oct '24

11 Oct '24

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU7U CVE: CVE-2024-47671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The syzbot reported a kernel-usb-infoleak in usbtmc_write, we need to clear the structure before filling fields. Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write") Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/class/usbtmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index 76ff182427bc..78adc112a77b 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(void) if (!urb) return NULL; - dmabuf = kmalloc(bufsize, GFP_KERNEL); + dmabuf = kzalloc(bufsize, GFP_KERNEL); if (!dmabuf) { usb_free_urb(urb); return NULL; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Have tracing_max_latency inc the trace array ref count
by Chen Zhongjin 11 Oct '24

11 Oct '24

From: "Steven Rostedt (Google)" <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.6-rc2 commit 7d660c9b2bc95107f90a9f4c4759be85309a6550 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IATD5H Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The tracing_max_latency file points to the trace_array max_latency field. For an instance, if the file is opened and the instance is deleted, reading or writing to the file will cause a use after free. Up the ref count of the trace_array when tracing_max_latency is opened. Link: https://lkml.kernel.org/r/20230907024803.666889383@goodmis.org Link: https://lore.kernel.org/all/1cb3aee2-19af-c472-e265-05176fe9bd84@huawei.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Fixes: 8530dec63e7b4 ("tracing: Add tracing_check_open_get_tr()") Tested-by: Linux Kernel Functional Testing <lkft(a)linaro.org> Tested-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [adjust context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/trace/trace.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 3c776919305a..a470950b8ed6 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -1718,7 +1718,7 @@ static void trace_create_maxlat_file(struct trace_array *tr, init_irq_work(&tr->fsnotify_irqwork, latency_fsnotify_workfn_irq); tr->d_max_latency = trace_create_file("tracing_max_latency", TRACE_MODE_WRITE, - d_tracer, &tr->max_latency, + d_tracer, tr, &tracing_max_lat_fops); } @@ -1752,7 +1752,7 @@ void latency_fsnotify(struct trace_array *tr) #define trace_create_maxlat_file(tr, d_tracer) \ trace_create_file("tracing_max_latency", TRACE_MODE_WRITE, \ - d_tracer, &tr->max_latency, &tracing_max_lat_fops) + d_tracer, tr, &tracing_max_lat_fops) #else #define trace_create_maxlat_file(tr, d_tracer) do { } while (0) @@ -6227,14 +6227,18 @@ static ssize_t tracing_max_lat_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos) { - return tracing_nsecs_read(filp->private_data, ubuf, cnt, ppos); + struct trace_array *tr = filp->private_data; + + return tracing_nsecs_read(&tr->max_latency, ubuf, cnt, ppos); } static ssize_t tracing_max_lat_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos) { - return tracing_nsecs_write(filp->private_data, ubuf, cnt, ppos); + struct trace_array *tr = filp->private_data; + + return tracing_nsecs_write(&tr->max_latency, ubuf, cnt, ppos); } #endif @@ -7264,10 +7268,11 @@ static const struct file_operations tracing_thresh_fops = { #if defined(CONFIG_TRACER_MAX_TRACE) || defined(CONFIG_HWLAT_TRACER) static const struct file_operations tracing_max_lat_fops = { - .open = tracing_open_generic, + .open = tracing_open_generic_tr, .read = tracing_max_lat_read, .write = tracing_max_lat_write, .llseek = generic_file_llseek, + .release = tracing_release_generic_tr, }; #endif -- 2.25.1

2 1

[PATCH OLK-6.6] arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
by Heyuan Wang 11 Oct '24

11 Oct '24

From: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> mainline inclusion from mainline-v6.11-rc1 commit 2488444274c70038eb6b686cba5f1ce48ebb9cdd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OA CVE: CVE-2024-46822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In a review discussion of the changes to support vCPU hotplug where a check was added on the GICC being enabled if was online, it was noted that there is need to map back to the cpu and use that to index into a cpumask. As such, a valid ID is needed. If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible for the entry in cpu_madt_gicc[cpu] == NULL. This function would then cause a NULL pointer dereference. Whilst a path to trigger this has not been established, harden this caller against the possibility. Reviewed-by: Gavin Shan <gshan(a)redhat.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Link: https://lore.kernel.org/r/20240529133446.28446-13-Jonathan.Cameron@huawei.c… Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: wangheyuan <wangheyuan2(a)h-partners.com> --- arch/arm64/include/asm/acpi.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index bc9a6656fc0c..a407f9cd549e 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -124,7 +124,8 @@ static inline int get_cpu_for_acpi_id(u32 uid) int cpu; for (cpu = 0; cpu < nr_cpu_ids; cpu++) - if (uid == get_acpi_id_for_cpu(cpu)) + if (acpi_cpu_get_madt_gicc(cpu) && + uid == get_acpi_id_for_cpu(cpu)) return cpu; return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-5.10 00/19] blk-throttle: support prioritized processing of metadata
by Yu Kuai 10 Oct '24

10 Oct '24

Jens Axboe (1): block: move blk-throtl fast path inline Jinke Han (1): blk-throttle: Fix io statistics for cgroup v1 Kemeng Shi (2): blk-throttle: Fix that bps of child could exceed bps limited in parent blk-throttle: correct calculation of wait time in tg_may_dispatch Laibin Qiu (1): blk-throttle: Set BIO_THROTTLED when bio has been throttled Ming Lei (4): block: throttle split bio in case of iops limit block: don't try to throttle split bio if iops limit isn't set block: revert 4f1e9630afe6 ("blk-throtl: optimize IOPS throttle for large IO scenarios") block: avoid use-after-free on throttle data Yu Kuai (10): Revert "blk-throttle: fix io hung due to configuration updates" Revert "blk-throttle: Set BIO_THROTTLED when bio has been throttled" blk-throttle: fix that io throttle can only work for single bio blk-throttle: fix io hung due to configuration updates blk-throttle: remove THROTL_TG_HAS_IOPS_LIMIT blk-throttle: improve bypassing bios checkings blk-throttle: print signed value 'carryover_bytes/ios' for user blk-throttle: fix wrong comparation while 'carryover_ios/bytes' is negative blk-throttle: consider 'carryover_ios/bytes' in throtl_trim_slice() blk-throttle: support prioritized processing of metadata block/bio.c | 2 - block/blk-cgroup.c | 7 +- block/blk-core.c | 1 + block/blk-merge.c | 6 +- block/blk-sysfs.c | 1 + block/blk-throttle.c | 519 +++++++++++++------------------------- block/blk-throttle.h | 214 ++++++++++++++++ block/blk.h | 16 -- include/linux/bio.h | 2 +- include/linux/blk_types.h | 2 +- 10 files changed, 396 insertions(+), 374 deletions(-) create mode 100644 block/blk-throttle.h -- 2.39.2

2 20