- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ext4: Skip moving extents if page writeback failed
by Zhihao Cheng 17 Jun '24

17 Jun '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5XLM CVE: NA -------------------------------- Ext4 should check the return value of ext4_disable_buffered_iomap_aops() before moving extents, otherwise the EXT4_STATE_BUFFERED_IOMAP state is not cleared from the inode, which could trigger the WARNON in function _ext4_get_block(). Fixes: 2a158d544250 ("ext4: fall back to buffer_head path for defrag") Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/move_extent.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index f58c0cb4dd76..afd7869cae9a 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -640,10 +640,16 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, inode_dio_wait(donor_inode); /* Fallback to buffer_head aops for inodes with buffered iomap aops */ - if (ext4_test_inode_state(orig_inode, EXT4_STATE_BUFFERED_IOMAP)) - ext4_disable_buffered_iomap_aops(orig_inode); - if (ext4_test_inode_state(donor_inode, EXT4_STATE_BUFFERED_IOMAP)) - ext4_disable_buffered_iomap_aops(donor_inode); + if (ext4_test_inode_state(orig_inode, EXT4_STATE_BUFFERED_IOMAP)) { + ret = ext4_disable_buffered_iomap_aops(orig_inode); + if (ret) + goto out_unlock; + } + if (ext4_test_inode_state(donor_inode, EXT4_STATE_BUFFERED_IOMAP)) { + ret = ext4_disable_buffered_iomap_aops(donor_inode); + if (ret) + goto out_unlock; + } /* Protect extent tree against block allocations via delalloc */ ext4_double_down_write_data_sem(orig_inode, donor_inode); @@ -728,6 +734,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, ext4_free_ext_path(path); ext4_double_up_write_data_sem(orig_inode, donor_inode); +out_unlock: unlock_two_nondirectories(orig_inode, donor_inode); return ret; -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 11561/22937] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: fb55aa477dfa7f488f112a8b87116962d623ff63 [11561/22937] net: hns3: place cae regconfig-related implementations in an independent file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240617/202406171104.ZG6iVFTd-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240617/202406171104.ZG6iVFTd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406171104.ZG6iVFTd-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:51:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:52:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:55:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:56:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: sparse: sparse: symbol 'hns3_cae_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: expected unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: warning: no previous prototype for 'hns3_cae_get_commit_id' [-Wmissing-prototypes] 224 | int hns3_cae_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ vim +597 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c 558 559 int hns3_cae_common_cmd_send(struct hns3_nic_priv *net_priv, void *buf_in, 560 u32 in_size, void *buf_out, u32 out_size) 561 { 562 #define MAX_DESC_DATA_LEN 6 563 struct cmd_desc_param *param_in; 564 struct hclge_vport *vport; 565 struct hclge_dev *hdev; 566 struct hclge_desc desc; 567 bool check; 568 int ret; 569 int i; 570 571 check = !buf_in || in_size < sizeof(struct cmd_desc_param); 572 vport = hns3_cae_get_vport(net_priv->ae_handle); 573 hdev = vport->back; 574 575 param_in = (struct cmd_desc_param *)buf_in; 576 hns3_cae_cmd_setup_basic_desc(&desc, param_in->fw_dw_opcode, 577 param_in->is_read); 578 for (i = 0; i < MAX_DESC_DATA_LEN; i++) 579 desc.data[i] = param_in->reg_desc.data[i]; 580 ret = hns3_cae_cmd_send(hdev, &desc, 1); 581 if (ret) { 582 dev_err(&hdev->pdev->dev, "%s, ret is %d.\n", __func__, 583 ret); 584 return ret; 585 } 586 if (param_in->is_read) { 587 struct cmd_desc_param *param_out = 588 (struct cmd_desc_param *)buf_out; 589 590 check = !buf_out || out_size < sizeof(struct cmd_desc_param); 591 if (check) { 592 pr_err("input param buf_out error in %s function\n", 593 __func__); 594 return -EFAULT; 595 } 596 for (i = 0; i < MAX_DESC_DATA_LEN; i++) > 597 param_out->reg_desc.data[i] = desc.data[i]; -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v5 0/9] sync hulk-5.10 patches
by Yu Kuai 17 Jun '24

17 Jun '24

Changes in v5: - rebase Changes in v4: - just resend Changes in v3: - modify openeuler_defconfig for disabled new config in patch 1,2 Changes in v2: - fix head in commit message Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (7): block: add a switch to enable hungtask check for io blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 37 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 97 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 11 +++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 +++++++++++++++++--- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 7 +- kernel/trace/blktrace.c | 3 - 18 files changed, 264 insertions(+), 41 deletions(-) -- 2.39.2

2 10

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c net/bluetooth/iso.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") and ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") are not merged. In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 33873266b2bc..202367e98eea 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -607,6 +607,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 52e512f41da3..de1e47b70d0e 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -520,6 +520,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -553,10 +574,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -564,9 +587,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 4027c79786fd..e01159d8fabf 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -731,6 +731,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1020,6 +1024,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 8ac9adb2b28b..6f93e2a7bf91 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7241,7 +7241,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7312,7 +7312,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7863,18 +7863,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c net/bluetooth/iso.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") and ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") are not merged. In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 11a92bb4d7a9..5d8b6bd87495 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -602,6 +602,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 140d9764c77e..9478e63f10ef 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -522,6 +522,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -555,10 +576,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -566,9 +589,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 954b29605c94..ea83c75da095 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -729,6 +729,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1018,6 +1022,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 1677cbb77578..c3b6a416119e 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7204,7 +7204,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7275,7 +7275,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7826,18 +7826,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") are not merged In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 11a92bb4d7a9..5d8b6bd87495 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -602,6 +602,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 140d9764c77e..9478e63f10ef 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -522,6 +522,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -555,10 +576,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -566,9 +589,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 954b29605c94..ea83c75da095 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -729,6 +729,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1018,6 +1022,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 1677cbb77578..c3b6a416119e 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7204,7 +7204,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7275,7 +7275,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7826,18 +7826,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

1 0

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") are not merged In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 33873266b2bc..202367e98eea 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -607,6 +607,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 52e512f41da3..de1e47b70d0e 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -520,6 +520,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -553,10 +574,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -564,9 +587,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 4027c79786fd..e01159d8fabf 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -731,6 +731,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1020,6 +1024,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 8ac9adb2b28b..6f93e2a7bf91 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7241,7 +7241,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7312,7 +7312,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7863,18 +7863,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

2 1

[PATCH v2 OLK-5.10] fs/open: use unlikely modification of filp_close anomaly detection branch
by liwei 17 Jun '24

17 Jun '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IA5PIS --------------------------- The probability of obtaining file_count() equal to 0 in filp_close() is relatively small. Using unlikely modification can improve efficiency. Signed-off-by: liwei <liwei728(a)huawei.com> --- fs/open.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/open.c b/fs/open.c index 8092178ceab0..68de475df5ec 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1285,7 +1285,7 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0; - if (!file_count(filp)) { + if (unlikely(!file_count(filp))) { printk(KERN_ERR "VFS: Close: file count is 0\n"); return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH OLK-5.10 v2] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH] fs/open: use unlikely modification of filp_close anomaly detection branch
by liwei 17 Jun '24

17 Jun '24

hulk inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/IA5PIS --------------------------- The probability of obtaining file_count() equal to 0 in filp_close() is relatively small. Using unlikely modification can improve efficiency. Signed-off-by: liwei <liwei728(a)huawei.com> --- fs/open.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/open.c b/fs/open.c index 8092178ceab0..68de475df5ec 100644 --- a/fs/open.c +++ b/fs/open.c @@ -1285,7 +1285,7 @@ int filp_close(struct file *filp, fl_owner_t id) { int retval = 0; - if (!file_count(filp)) { + if (unlikely(!file_count(filp))) { printk(KERN_ERR "VFS: Close: file count is 0\n"); return 0; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 17 Jun '24

17 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH OLK-5.10] ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
by Long Li 17 Jun '24

17 Jun '24

From: Yang Xiongwei <yangxiongwei6(a)huawei.com> mainline inclusion from mainline-v6.9-rc4 commit 17cf0c2794bdb6f39671265aa18aea5c22ee8c4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4XI CVE: CVE-2024-26936 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..7937f860ea8f 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -539,6 +539,10 @@ int smb2_allocate_rsp_buf(struct ksmbd_work *work) if (cmd == SMB2_QUERY_INFO_HE) { struct smb2_query_info_req *req; + if (get_rfc1002_len(work->request_buf) < + offsetof(struct smb2_query_info_req, OutputBufferLength)) + return -EINVAL; + req = smb2_get_msg(work->request_buf); if ((req->InfoType == SMB2_O_INFO_FILE && (req->FileInfoClass == FILE_FULL_EA_INFORMATION || -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/9p: fix uninitialized values during inode evict
by Long Li 17 Jun '24

17 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[PATCH OLK-5.10] fs/9p: fix uninitialized values during inode evict
by Long Li 17 Jun '24

17 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2] dhugetlb: use rcu lock to protect hpool
by Liu Shixin 17 Jun '24

17 Jun '24

hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/IA5JXN -------------------------------- In freeing process, set memcg->hpool or dpool_global_hpool to NULL and then freeing it. To avoid UAF problem of hpool, we have to make sure the users that already hold pointer to hpool don't use the pointer after freeing hpool. The freeing of hpool should block until make sure all such users don't use hpool. Since anyone who want to use hpool have to increase its refcount at first. Use rcu_read_lock() and synchronize_rcu() to guarantee all such users failed to get hpool before freeing hpool. Fixes: 0bc0d0d57eda ("dhugetlb: backport dynamic hugetlb feature") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/hugetlb.c | 6 ++++++ mm/memcontrol.c | 11 ++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4be708677ce6..18dd5bcd13a3 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3360,6 +3360,7 @@ void dhugetlb_pool_put(struct dhugetlb_pool *hpool) if (atomic_dec_and_test(&hpool->refcnt)) { css_put(&hpool->attach_memcg->css); + synchronize_rcu(); kfree(hpool); } } @@ -3500,9 +3501,14 @@ struct dhugetlb_pool *get_dhugetlb_pool_from_task(struct task_struct *tsk) rcu_read_lock(); memcg = mem_cgroup_from_task(tsk); + if (!memcg || !css_tryget(&memcg->css)) { + rcu_read_unlock(); + return NULL; + } rcu_read_unlock(); hpool = get_dhugetlb_pool_from_memcg(memcg); + css_put(&memcg->css); return hpool; } diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7dc68b1792ef..4ecb6f09b68b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4701,14 +4701,19 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, struct dhugetlb_pool *get_dhugetlb_pool_from_memcg(struct mem_cgroup *memcg) { struct mem_cgroup_extension *memcg_ext; + struct dhugetlb_pool *hpool; if (!memcg) return NULL; + rcu_read_lock(); memcg_ext = container_of(memcg, struct mem_cgroup_extension, memcg); - if (dhugetlb_pool_get(memcg_ext->hpool)) - return memcg_ext->hpool; - return NULL; + hpool = memcg_ext->hpool; + if (!dhugetlb_pool_get(hpool)) + hpool = NULL; + rcu_read_unlock(); + + return hpool; } static void set_dhugetlb_pool_to_memcg(struct mem_cgroup *memcg, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 7438/22937] drivers/net/phy/.tmp_ax88796b.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 56e625aa545a24e8d3fa44b5fbcdedd88e443dcc [7438/22937] net: phy: rename Asix Electronics PHY driver config: x86_64-buildonly-randconfig-004-20240614 (https://download.01.org/0day-ci/archive/20240617/202406170809.fyaOQ9ZM-lkp@…) compiler: gcc-8 (Ubuntu 8.4.0-3ubuntu2) 8.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240617/202406170809.fyaOQ9ZM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406170809.fyaOQ9ZM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/phy/.tmp_ax88796b.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11555/22937] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 8ad07513042c8fef5a03b404f0bbf066f603c101 [11555/22937] net: hns3: place dcqcn implementations in an ind file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240617/202406170627.RHMdP5Jc-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240617/202406170627.RHMdP5Jc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406170627.RHMdP5Jc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:39:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:42:22: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:43:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:44:22: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:53:23: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_rx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: expected unsigned int [usertype] dcqcn_rx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:255:42: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_tx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: expected unsigned int [usertype] dcqcn_tx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:256:42: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_db_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: expected unsigned int [usertype] dcqcn_db_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c:257:42: sparse: got restricted __le32 vim +39 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c 15 16 static int hns3_dcqcn_rw(struct hns3_nic_priv *net_priv, 17 u32 offset, u32 *data, u32 rw_type) 18 { 19 struct hnae3_handle *h = net_priv->ae_handle; 20 struct hclge_vport *vport; 21 struct hclge_dev *hdev; 22 struct hclge_desc desc; 23 int ret; 24 25 if (!data) 26 return -EFAULT; 27 28 vport = container_of(h, struct hclge_vport, nic); 29 hdev = vport->back; 30 31 if (rw_type == DEVMEM_CFG_READ) { 32 hns3_cae_cmd_setup_basic_desc(&desc, 33 HCLGE_OPC_DCQCN_TEMPLATE_CFG, 34 true); 35 } else { 36 hns3_cae_cmd_setup_basic_desc(&desc, 37 HCLGE_OPC_DCQCN_TEMPLATE_CFG, 38 false); > 39 desc.data[2] = *data; 40 } 41 > 42 desc.data[0] = SCC_TEMP_LOW_ADDR + offset; > 43 desc.data[1] = SCC_TEMP_HIGH_ADDR; 44 desc.data[4] = 32; 45 46 ret = hns3_cae_cmd_send(hdev, &desc, 1); 47 if (ret) { 48 dev_err(&hdev->pdev->dev, "disable net lane failed %d\n", ret); 49 return ret; 50 } 51 52 if (rw_type == DEVMEM_CFG_READ) > 53 *data = desc.data[2]; 54 55 return 0; 56 } 57 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11543/22937] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 16 Jun '24

16 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: ed046b8a9bc5f5836ece3a3efa29c54f0fc904e7 [11543/22937] net: hns3: rename hns3_cae's files and remove send_cmdq config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240616/202406161000.Y3tDDJ9e-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240616/202406161000.Y3tDDJ9e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406161000.Y3tDDJ9e-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:85:14: sparse: sparse: symbol 'g_nictool_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:86:13: sparse: sparse: symbol 'g_nictool_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:89:5: sparse: sparse: symbol 'g_nictool_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:90:5: sparse: sparse: symbol 'g_nictool_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:128:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:171:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:258:5: sparse: sparse: symbol 'hns3_test_chs_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:302:5: sparse: sparse: symbol 'hns3_test_chs_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:355:5: sparse: sparse: symbol 'hns3_test_chs_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:412:5: sparse: sparse: symbol 'hns_test_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:485:5: sparse: sparse: symbol 'hns3_test_clean_stats' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:518:5: sparse: sparse: symbol 'hns3_nic_reset' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:566:5: sparse: sparse: symbol 'hns3_nic_timeout_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:599:5: sparse: sparse: symbol 'hns3_gro_age_handle' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:670:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:673:22: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:674:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:675:22: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:684:23: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:689:5: sparse: sparse: symbol 'hns3_nic_dcqcn' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_rx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: expected unsigned int [usertype] dcqcn_rx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:878:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_tx_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: expected unsigned int [usertype] dcqcn_tx_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:879:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] dcqcn_db_cnt @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: expected unsigned int [usertype] dcqcn_db_cnt drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:880:42: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:852:5: sparse: sparse: symbol 'hns3_dcqcn_get_msg_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:973:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1050:5: sparse: sparse: symbol 'nictool_k_mmap' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1073:5: sparse: sparse: symbol 'if_nictool_exist' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:258:5: warning: no previous prototype for 'hns3_test_chs_set' [-Wmissing-prototypes] 258 | int hns3_test_chs_set(struct hclge_dev *hdev, u8 chs_type, u8 enable) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:302:5: warning: no previous prototype for 'hns3_test_chs_get' [-Wmissing-prototypes] 302 | int hns3_test_chs_get(struct hclge_dev *hdev, u8 chs_type, u8 *enable) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:355:5: warning: no previous prototype for 'hns3_test_chs_cfg' [-Wmissing-prototypes] 355 | int hns3_test_chs_cfg(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:412:5: warning: no previous prototype for 'hns_test_get_commit_id' [-Wmissing-prototypes] 412 | int hns_test_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c: In function 'get_driver_ver': drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:480:53: warning: argument to 'sizeof' in 'strncpy' call is the same expression as the source; did you mean to use the size of the destination? [-Wsizeof-pointer-memaccess] 480 | strncpy(buf_out, HNAE_DRIVER_VERSION, sizeof(HNAE_DRIVER_VERSION)); | ^ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c: At top level: drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:485:5: warning: no previous prototype for 'hns3_test_clean_stats' [-Wmissing-prototypes] 485 | int hns3_test_clean_stats(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:518:5: warning: no previous prototype for 'hns3_nic_reset' [-Wmissing-prototypes] 518 | int hns3_nic_reset(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:566:5: warning: no previous prototype for 'hns3_nic_timeout_cfg' [-Wmissing-prototypes] 566 | int hns3_nic_timeout_cfg(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:599:5: warning: no previous prototype for 'hns3_gro_age_handle' [-Wmissing-prototypes] 599 | int hns3_gro_age_handle(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:689:5: warning: no previous prototype for 'hns3_nic_dcqcn' [-Wmissing-prototypes] 689 | int hns3_nic_dcqcn(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:852:5: warning: no previous prototype for 'hns3_dcqcn_get_msg_cnt' [-Wmissing-prototypes] 852 | int hns3_dcqcn_get_msg_cnt(struct hns3_nic_priv *net_priv, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1050:5: warning: no previous prototype for 'nictool_k_mmap' [-Wmissing-prototypes] 1050 | int nictool_k_mmap(struct file *filp, struct vm_area_struct *vma) | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:1073:5: warning: no previous prototype for 'if_nictool_exist' [-Wmissing-prototypes] 1073 | int if_nictool_exist(void) | ^~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:27:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:28:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:29:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:37:32: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:37:53: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:41:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:42:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:43:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:44:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:45:30: sparse: got unsigned int [usertype] >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:74:18: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_dfx.c:75:17: sparse: got restricted __le32 -- drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: sparse: sparse: symbol 'hclge_test_send_generic_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: sparse: sparse: symbol 'hclge_test_send_allocate_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: sparse: sparse: symbol 'hclge_test_send_key_cfg_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: sparse: sparse: symbol 'hclge_test_send_tcam_op_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: sparse: sparse: symbol 'hclge_test_send_ad_op_cmd' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] cnt_idx @@ got restricted __le32 [usertype] idx @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: expected restricted __le16 [usertype] cnt_idx drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:280:22: sparse: got restricted __le32 [usertype] idx drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: sparse: sparse: symbol 'hclge_test_send_cnt_op_cmd' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:20:5: warning: no previous prototype for 'hclge_test_send_generic_cmd' [-Wmissing-prototypes] 20 | int hclge_test_send_generic_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:62:5: warning: no previous prototype for 'hclge_test_send_allocate_cmd' [-Wmissing-prototypes] 62 | int hclge_test_send_allocate_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:100:5: warning: no previous prototype for 'hclge_test_send_key_cfg_cmd' [-Wmissing-prototypes] 100 | int hclge_test_send_key_cfg_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:153:5: warning: no previous prototype for 'hclge_test_send_tcam_op_cmd' [-Wmissing-prototypes] 153 | int hclge_test_send_tcam_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:224:5: warning: no previous prototype for 'hclge_test_send_ad_op_cmd' [-Wmissing-prototypes] 224 | int hclge_test_send_ad_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c:267:5: warning: no previous prototype for 'hclge_test_send_cnt_op_cmd' [-Wmissing-prototypes] 267 | int hclge_test_send_cnt_op_cmd(struct hclge_dev *hdev, u8 *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:38:46: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:54:55: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:55:54: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:90:45: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_hilink_param.c:137:45: sparse: got unsigned int -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] his_link_machine_state @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: expected unsigned int [usertype] his_link_machine_state drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:32:67: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:35:46: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] cur_link_machine_state @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: expected unsigned int [usertype] cur_link_machine_state drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:39:67: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:42:46: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: sparse: sparse: symbol 'fill_port_info' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c:19:6: warning: no previous prototype for 'fill_port_info' [-Wmissing-prototypes] 19 | void fill_port_info(struct hclge_port_info *get_port_info_out, | ^~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: sparse: sparse: symbol 'hns3_read_promisc_mode_cfg' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: sparse: sparse: symbol 'hns3_set_promisc_mode_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:6:5: warning: no previous prototype for 'hns3_read_promisc_mode_cfg' [-Wmissing-prototypes] 6 | int hns3_read_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_promisc.c:44:5: warning: no previous prototype for 'hns3_set_promisc_mode_cfg' [-Wmissing-prototypes] 44 | int hns3_set_promisc_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:18: sparse: sparse: symbol 'get_val_hdev' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: sparse: sparse: symbol 'hns3_cmd_rx_priv_wl_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: sparse: sparse: symbol 'hns3_cmd_common_thrd_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: sparse: sparse: symbol 'hns3_cmd_common_wl_config' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] high_wl @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: expected unsigned int [usertype] high_wl drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:229:35: sparse: got restricted __le16 [usertype] high >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] low_wl @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: expected unsigned int [usertype] low_wl drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:230:34: sparse: got restricted __le16 [usertype] low >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short @@ got restricted __le16 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: expected unsigned short drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:273:48: sparse: got restricted __le16 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] share_buff @@ got restricted __le16 [usertype] shared_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: expected unsigned short [usertype] share_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:275:38: sparse: got restricted __le16 [usertype] shared_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short @@ got restricted __le16 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: expected unsigned short drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:318:48: sparse: got restricted __le16 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] high @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: expected unsigned short [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:366:53: sparse: got restricted __le16 [usertype] high >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] low @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: expected unsigned short [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:367:52: sparse: got restricted __le16 [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] high @@ got restricted __le16 [usertype] high @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: expected unsigned short [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:416:53: sparse: got restricted __le16 [usertype] high drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] low @@ got restricted __le16 [usertype] low @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: expected unsigned short [usertype] low drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:417:52: sparse: got restricted __le16 [usertype] low >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:450:28: sparse: sparse: restricted __le32 degrades to integer >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:452:22: sparse: got unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:9:19: warning: no previous prototype for 'get_val_hdev' [-Wmissing-prototypes] 9 | struct hclge_dev *get_val_hdev(struct hns3_nic_priv *net_priv) | ^~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:19:5: warning: no previous prototype for 'hns3_cmd_rx_priv_wl_config' [-Wmissing-prototypes] 19 | int hns3_cmd_rx_priv_wl_config(struct hclge_dev *hdev, u16 tc, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:89:5: warning: no previous prototype for 'hns3_cmd_common_thrd_config' [-Wmissing-prototypes] 89 | int hns3_cmd_common_thrd_config(struct hclge_dev *hdev, u16 tc, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_qos.c:161:5: warning: no previous prototype for 'hns3_cmd_common_wl_config' [-Wmissing-prototypes] 161 | int hns3_cmd_common_wl_config(struct hclge_dev *hdev, u32 high, u32 low, u32 en) | ^~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:6:30: sparse: sparse: symbol 'hns3_ring_stats_name' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:149:21: sparse: sparse: cast to restricted __le64 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:105:5: sparse: sparse: symbol 'hns3_read_stat_mode_cfg' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __le64 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: expected unsigned long long [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:192:14: sparse: got restricted __le64 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:154:5: sparse: sparse: symbol 'hns3_set_stat_mode_cfg' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:105:5: warning: no previous prototype for 'hns3_read_stat_mode_cfg' [-Wmissing-prototypes] 105 | int hns3_read_stat_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_stat.c:154:5: warning: no previous prototype for 'hns3_set_stat_mode_cfg' [-Wmissing-prototypes] 154 | int hns3_set_stat_mode_cfg(struct hns3_nic_priv *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:25:30: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: expected unsigned char [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:45:23: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:50:5: sparse: sparse: symbol 'hns3_test_tm_q_to_qs_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:75:29: sparse: sparse: restricted __le16 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:63:5: sparse: sparse: symbol 'hns3_test_tm_q_to_qs_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:80:5: sparse: sparse: symbol 'hns3_test_tm_qs_to_pri_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:94:5: sparse: sparse: symbol 'hns3_test_tm_qs_to_pri_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:110:5: sparse: sparse: symbol 'hns3_test_tm_qs_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:123:5: sparse: sparse: symbol 'hns3_test_tm_qs_weight_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:139:5: sparse: sparse: symbol 'hns3_test_tm_pri_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:152:5: sparse: sparse: symbol 'hns3_test_tm_pri_weight_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] pg_id @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: expected unsigned char [usertype] pg_id drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:175:20: sparse: got restricted __le16 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:168:5: sparse: sparse: symbol 'hns3_test_tm_pri_pg_bitmap_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned char [usertype] pg_id @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: expected unsigned char [usertype] pg_id drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:190:20: sparse: got restricted __le16 [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:181:5: sparse: sparse: symbol 'hns3_test_tm_pri_pg_bitmap_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] qs_bit_map @@ got unsigned int [usertype] map @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: expected restricted __le32 [usertype] qs_bit_map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:212:38: sparse: got unsigned int [usertype] map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:200:5: sparse: sparse: symbol 'hns3_test_tm_qs_bp_bitmap_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] qs_bit_map @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:233:14: sparse: got restricted __le32 [usertype] qs_bit_map drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:217:5: sparse: sparse: symbol 'hns3_test_tm_qs_bp_bitmap_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] pri_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: expected restricted __le32 [usertype] pri_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:250:41: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:237:5: sparse: sparse: symbol 'hns3_test_tm_pri_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] pri_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:270:17: sparse: got restricted __le32 [usertype] pri_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:255:5: sparse: sparse: symbol 'hns3_test_tm_pri_shapping_get' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:275:5: sparse: sparse: symbol 'hns3_test_tm_pg_weight_set' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:288:5: sparse: sparse: symbol 'hns3_test_tm_pg_weight_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] pg_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: expected restricted __le32 [usertype] pg_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:317:40: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:304:5: sparse: sparse: symbol 'hns3_test_tm_pg_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] pg_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:338:25: sparse: got restricted __le32 [usertype] pg_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:322:5: sparse: sparse: symbol 'hns3_test_tm_pg_shapping_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] port_shapping_para @@ got unsigned int [usertype] shaper @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: expected restricted __le32 [usertype] port_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:352:42: sparse: got unsigned int [usertype] shaper drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:343:5: sparse: sparse: symbol 'hns3_test_tm_port_shapping_set' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] port_shapping_para @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:369:25: sparse: got restricted __le32 [usertype] port_shapping_para drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:357:5: sparse: sparse: symbol 'hns3_test_tm_port_shapping_get' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:421:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:422:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:423:30: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:431:27: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:431:48: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:435:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:436:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:437:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:438:30: sparse: got unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:439:30: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:50:5: warning: no previous prototype for 'hns3_test_tm_q_to_qs_set' [-Wmissing-prototypes] 50 | int hns3_test_tm_q_to_qs_set(struct hclge_dev *hdev, u16 q_id, u16 qs_id) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:63:5: warning: no previous prototype for 'hns3_test_tm_q_to_qs_get' [-Wmissing-prototypes] 63 | int hns3_test_tm_q_to_qs_get(struct hclge_dev *hdev, u16 q_id, u16 *qs_id) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:80:5: warning: no previous prototype for 'hns3_test_tm_qs_to_pri_set' [-Wmissing-prototypes] 80 | int hns3_test_tm_qs_to_pri_set(struct hclge_dev *hdev, u16 qs_id, u8 pri) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:94:5: warning: no previous prototype for 'hns3_test_tm_qs_to_pri_get' [-Wmissing-prototypes] 94 | int hns3_test_tm_qs_to_pri_get(struct hclge_dev *hdev, u16 qs_id, u8 *pri) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:110:5: warning: no previous prototype for 'hns3_test_tm_qs_weight_set' [-Wmissing-prototypes] 110 | int hns3_test_tm_qs_weight_set(struct hclge_dev *hdev, u16 qs_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:123:5: warning: no previous prototype for 'hns3_test_tm_qs_weight_get' [-Wmissing-prototypes] 123 | int hns3_test_tm_qs_weight_get(struct hclge_dev *hdev, u16 qs_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:139:5: warning: no previous prototype for 'hns3_test_tm_pri_weight_set' [-Wmissing-prototypes] 139 | int hns3_test_tm_pri_weight_set(struct hclge_dev *hdev, u8 pri_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:152:5: warning: no previous prototype for 'hns3_test_tm_pri_weight_get' [-Wmissing-prototypes] 152 | int hns3_test_tm_pri_weight_get(struct hclge_dev *hdev, u8 pri_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:168:5: warning: no previous prototype for 'hns3_test_tm_pri_pg_bitmap_set' [-Wmissing-prototypes] 168 | int hns3_test_tm_pri_pg_bitmap_set(struct hclge_dev *hdev, u8 pg_id, u8 bitmap) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:181:5: warning: no previous prototype for 'hns3_test_tm_pri_pg_bitmap_get' [-Wmissing-prototypes] 181 | int hns3_test_tm_pri_pg_bitmap_get(struct hclge_dev *hdev, u8 pg_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:200:5: warning: no previous prototype for 'hns3_test_tm_qs_bp_bitmap_set' [-Wmissing-prototypes] 200 | int hns3_test_tm_qs_bp_bitmap_set(struct hclge_dev *hdev, u8 tc, u8 gp_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:217:5: warning: no previous prototype for 'hns3_test_tm_qs_bp_bitmap_get' [-Wmissing-prototypes] 217 | int hns3_test_tm_qs_bp_bitmap_get(struct hclge_dev *hdev, u8 tc, u8 gp_id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:237:5: warning: no previous prototype for 'hns3_test_tm_pri_shapping_set' [-Wmissing-prototypes] 237 | int hns3_test_tm_pri_shapping_set(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:255:5: warning: no previous prototype for 'hns3_test_tm_pri_shapping_get' [-Wmissing-prototypes] 255 | int hns3_test_tm_pri_shapping_get(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:275:5: warning: no previous prototype for 'hns3_test_tm_pg_weight_set' [-Wmissing-prototypes] 275 | int hns3_test_tm_pg_weight_set(struct hclge_dev *hdev, u8 pg_id, u8 dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:288:5: warning: no previous prototype for 'hns3_test_tm_pg_weight_get' [-Wmissing-prototypes] 288 | int hns3_test_tm_pg_weight_get(struct hclge_dev *hdev, u8 pg_id, u8 *dwrr) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:304:5: warning: no previous prototype for 'hns3_test_tm_pg_shapping_set' [-Wmissing-prototypes] 304 | int hns3_test_tm_pg_shapping_set(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:322:5: warning: no previous prototype for 'hns3_test_tm_pg_shapping_get' [-Wmissing-prototypes] 322 | int hns3_test_tm_pg_shapping_get(struct hclge_dev *hdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:343:5: warning: no previous prototype for 'hns3_test_tm_port_shapping_set' [-Wmissing-prototypes] 343 | int hns3_test_tm_port_shapping_set(struct hclge_dev *hdev, u32 shaper) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c:357:5: warning: no previous prototype for 'hns3_test_tm_port_shapping_get' [-Wmissing-prototypes] 357 | int hns3_test_tm_port_shapping_get(struct hclge_dev *hdev, u32 *shaper) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:54:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:55:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:59:38: sparse: right side has type unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:61:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ti2oupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: expected unsigned int [usertype] ti2oupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:70:43: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] tv2pupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: expected unsigned int [usertype] tv2pupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:71:43: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:75:38: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:76:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] tp2nupm @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: expected unsigned int [usertype] tp2nupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:85:43: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:86:54: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:87:41: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:96:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:97:46: sparse: right side has type int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:100:38: sparse: right side has type unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: sparse: invalid assignment: |= drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: left side has type restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:102:38: sparse: right side has type int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] ti2oupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:113:46: sparse: got unsigned int [usertype] ti2oupm >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] tv2pupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:115:46: sparse: got unsigned int [usertype] tv2pupm >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:126:38: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:127:38: sparse: got int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] tp2nupm @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:138:46: sparse: got unsigned int [usertype] tp2nupm drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_vlan.c:140:46: sparse: got int -- >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:56:41: sparse: got int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:126:5: sparse: sparse: symbol 'hns3_set_sfp_state' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c:126:5: warning: no previous prototype for 'hns3_set_sfp_state' [-Wmissing-prototypes] 126 | int hns3_set_sfp_state(struct hnae3_handle *handle, bool en) | ^~~~~~~~~~~~~~~~~~ vim +673 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 648 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 649 static int hns3_dcqcn_rw(struct hns3_nic_priv *net_priv, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 650 u32 offset, u32 *data, u32 rw_type) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 651 { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 652 struct hnae3_handle *h = net_priv->ae_handle; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 653 struct hclge_vport *vport; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 654 struct hclge_dev *hdev; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 655 struct hclge_desc desc; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 656 int ret; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 657 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 658 if (!data) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 659 return -EFAULT; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 660 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 661 vport = container_of(h, struct hclge_vport, nic); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 662 hdev = vport->back; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 663 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 664 if (rw_type == DEVMEM_CFG_READ) { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 665 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_DCQCN_TEMPLATE_CFG, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 666 true); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 667 } else { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 668 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_DCQCN_TEMPLATE_CFG, d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 669 false); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 670 desc.data[2] = *data; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 671 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 672 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 @673 desc.data[0] = SCC_TEMP_LOW_ADDR + offset; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 674 desc.data[1] = SCC_TEMP_HIGH_ADDR; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 675 desc.data[4] = 32; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 676 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 677 ret = hclge_cmd_send(&hdev->hw, &desc, 1); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 678 if (ret) { d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 679 dev_err(&hdev->pdev->dev, "disable net lane failed %d\n", ret); d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 680 return ret; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 681 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 682 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 683 if (rw_type == DEVMEM_CFG_READ) d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 684 *data = desc.data[2]; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 685 d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 686 return 0; d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 687 } d02033616da9f2 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_nictool.c Weiwei 2019-08-14 688 :::::: The code at line 673 was first introduced by commit :::::: d02033616da9f2fca85e2e8cb73bdd04c46f21e9 net: hns3: add hns3 cae drivers to kernel :::::: TO: Weiwei <dengweiwei(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1606/22937] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2626:5: sparse: sparse: symbol 'hclge_set_all_vf_rst' was not declared. Should it be static?
by kernel test robot 16 Jun '24

16 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 09262653590358d6bd64c121600490fcfa3312b3 [1606/22937] driver: hns3: update hns3 driver from drivers config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240616/202406160405.uc8O581O-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240616/202406160405.uc8O581O-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406160405.uc8O581O-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:39:22: sparse: sparse: symbol 'ae_algo' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:238:34: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:239:34: sparse: sparse: cast from restricted __be16 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2220:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __le32 [usertype] sfp_speed @@ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2220:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2220:16: sparse: got restricted __le32 [usertype] sfp_speed >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2626:5: sparse: sparse: symbol 'hclge_set_all_vf_rst' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3098:6: sparse: sparse: symbol 'hclge_reset_fail' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:8088:21: sparse: sparse: symbol 'hclge_ops' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:2626:5: warning: no previous prototype for 'hclge_set_all_vf_rst' [-Wmissing-prototypes] 2626 | int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3098:6: warning: no previous prototype for 'hclge_reset_fail' [-Wmissing-prototypes] 3098 | bool hclge_reset_fail(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:8176:5: warning: no previous prototype for 'hclge_init' [-Wmissing-prototypes] 8176 | int hclge_init(void) | ^~~~~~~~~~ vim +/hclge_set_all_vf_rst +2626 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 2625 > 2626 int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) 2627 { 2628 int i; 2629 2630 for (i = hdev->num_vmdq_vport + 1; i < hdev->num_alloc_vport; i++) { 2631 struct hclge_vport *vport = &hdev->vport[i]; 2632 int ret; 2633 2634 /* Send cmd to set/clear VF's FUNC_RST_ING */ 2635 ret = hclge_set_vf_rst(hdev, vport->vport_id, reset); 2636 if (ret) { 2637 dev_err(&hdev->pdev->dev, 2638 "set vf(%d) rst failded %d!\n", 2639 vport->vport_id, ret); 2640 return ret; 2641 } 2642 2643 if (!reset) 2644 continue; 2645 2646 /* Inform VF to process the reset. 2647 * hclge_inform_reset_assert_to_vf may fail if VF 2648 * driver is not loaded. 2649 */ 2650 ret = hclge_inform_reset_assert_to_vf(vport); 2651 if (ret) 2652 dev_warn(&hdev->pdev->dev, 2653 "inform reset to vf(%d) failded %d!\n", 2654 vport->vport_id, ret); 2655 } 2656 2657 return 0; 2658 } 2659 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS a11258126817cb686678871ccc7cea4e9601ae7a
by kernel test robot 16 Jun '24

16 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: a11258126817cb686678871ccc7cea4e9601ae7a !9084 v5 xfs: atomic writes for xfs Warning ids grouped by kconfigs: clang_recent_errors |-- arm64-randconfig-051-20240615 | |-- Documentation-devicetree-bindings-iio-addac-adi-ad74413r.yaml:channel:Missing-additionalProperties-unevaluatedProperties-constraint | `-- Documentation-devicetree-bindings-sound-amlogic-gx-sound-card.yaml:codec(-):Missing-additionalProperties-unevaluatedProperties-constraint `-- x86_64-allnoconfig |-- drivers-arm-spe-spe.c:linux-perf-arm_pmu.h-is-included-more-than-once. |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 1688m configs tested: 35 configs skipped: 145 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-13.2.0 arm64 defconfig gcc-13.2.0 arm64 randconfig-001-20240615 clang-19 arm64 randconfig-002-20240615 gcc-13.2.0 arm64 randconfig-003-20240615 clang-17 arm64 randconfig-004-20240615 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240615 gcc-9 x86_64 buildonly-randconfig-002-20240615 clang-18 x86_64 buildonly-randconfig-003-20240615 clang-18 x86_64 buildonly-randconfig-004-20240615 clang-18 x86_64 buildonly-randconfig-005-20240615 gcc-9 x86_64 buildonly-randconfig-006-20240615 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240615 gcc-13 x86_64 randconfig-002-20240615 gcc-8 x86_64 randconfig-003-20240615 gcc-13 x86_64 randconfig-004-20240615 gcc-13 x86_64 randconfig-005-20240615 gcc-13 x86_64 randconfig-006-20240615 gcc-8 x86_64 randconfig-011-20240615 clang-18 x86_64 randconfig-012-20240615 gcc-13 x86_64 randconfig-013-20240615 clang-18 x86_64 randconfig-014-20240615 clang-18 x86_64 randconfig-015-20240615 clang-18 x86_64 randconfig-016-20240615 clang-18 x86_64 randconfig-071-20240615 clang-18 x86_64 randconfig-072-20240615 clang-18 x86_64 randconfig-073-20240615 gcc-7 x86_64 randconfig-074-20240615 gcc-13 x86_64 randconfig-075-20240615 clang-18 x86_64 randconfig-076-20240615 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Kaixiong Yu 16 Jun '24

16 Jun '24

*** BLURB HERE *** Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
by Kaixiong Yu 15 Jun '24

15 Jun '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.219 commit bca19bb2dc2d89ce60c4a4a6e59609d4cf2e13ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27V CVE: CVE-2021-47571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. The free_rtllib() function frees the "dev" pointer so there is use after free on the next line. Re-arrange things to avoid that. Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20211117072016.GA5237@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c index 7cdced0b0581..da73998bc5f7 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c @@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) free_irq(dev->irq, dev); priv->irq = 0; } - free_rtllib(dev); if (dev->mem_start != 0) { iounmap((void __iomem *)dev->mem_start); release_mem_region(pci_resource_start(pdev, 1), pci_resource_len(pdev, 1)); } + + free_rtllib(dev); } else { priv = rtllib_priv(dev); } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 745a3c567e1c329d131a8896642475f3916d020a
by kernel test robot 15 Jun '24

15 Jun '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 745a3c567e1c329d131a8896642475f3916d020a !9017 misc/libmasm/module: Fix two use after free in ibmasm_init_one Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202406150959.idZDT1QZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202406151050.cbAafgsa-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/edac/skx_common.o: warning: objtool: missing symbol for section .text drivers/spi/spi-phytium-plat.c:186:34: warning: unused variable 'phytium_spi_of_match' [-Wunused-const-variable] kernel/livepatch/core.c:75:16: warning: no previous prototype for function 'klp_check_patch_kprobed' [-Wmissing-prototypes] mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] Unverified Error/Warning (likely false positive, please contact us if interested): drivers/block/loop.c:1338 loop_set_status() warn: inconsistent returns '&loop_ctl_mutex'. Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- x86_64-buildonly-randconfig-001-20240615 | |-- drivers-edac-skx_common.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-buildonly-randconfig-005-20240615 `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text clang_recent_errors |-- x86_64-allyesconfig | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20240615 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20240615 | `-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-randconfig-005-20240420 | |-- drivers-spi-spi-phytium-plat.c:warning:unused-variable-phytium_spi_of_match | |-- mm-debug.c:warning:format-specifies-type-int-but-the-argument-has-type-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-unsigned-long-but-the-argument-has-type-const-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-void-but-the-argument-has-type-int | `-- mm-debug.c:warning:more-conversions-than-data-arguments |-- x86_64-randconfig-073-20240521 | `-- kernel-livepatch-core.c:warning:no-previous-prototype-for-function-klp_check_patch_kprobed |-- x86_64-randconfig-103-20240609 | `-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. `-- x86_64-randconfig-161-20240430 `-- drivers-block-loop.c-loop_set_status()-warn:inconsistent-returns-loop_ctl_mutex-. elapsed time: 1596m configs tested: 35 configs skipped: 150 tested configs: arm64 allmodconfig gcc-13.2.0 arm64 allnoconfig gcc-13.2.0 arm64 defconfig gcc-13.2.0 arm64 randconfig-001-20240614 gcc-13.2.0 arm64 randconfig-002-20240614 gcc-13.2.0 arm64 randconfig-003-20240614 gcc-13.2.0 arm64 randconfig-004-20240614 gcc-13.2.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240615 gcc-9 x86_64 buildonly-randconfig-002-20240615 clang-18 x86_64 buildonly-randconfig-003-20240615 clang-18 x86_64 buildonly-randconfig-004-20240615 clang-18 x86_64 buildonly-randconfig-005-20240615 gcc-9 x86_64 buildonly-randconfig-006-20240615 clang-18 x86_64 defconfig gcc-13 x86_64 randconfig-001-20240615 gcc-13 x86_64 randconfig-002-20240615 gcc-8 x86_64 randconfig-003-20240615 gcc-13 x86_64 randconfig-004-20240615 gcc-13 x86_64 randconfig-005-20240615 gcc-13 x86_64 randconfig-006-20240615 gcc-8 x86_64 randconfig-011-20240615 clang-18 x86_64 randconfig-012-20240615 gcc-13 x86_64 randconfig-013-20240615 clang-18 x86_64 randconfig-014-20240615 clang-18 x86_64 randconfig-015-20240615 clang-18 x86_64 randconfig-016-20240615 clang-18 x86_64 randconfig-071-20240615 clang-18 x86_64 randconfig-072-20240615 clang-18 x86_64 randconfig-073-20240615 gcc-7 x86_64 randconfig-074-20240615 gcc-13 x86_64 randconfig-075-20240615 clang-18 x86_64 randconfig-076-20240615 gcc-13 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
by Kaixiong Yu 15 Jun '24

15 Jun '24

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.219 commit bca19bb2dc2d89ce60c4a4a6e59609d4cf2e13ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S27V CVE: CVE-2021-47571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b535917c51acc97fb0761b1edec85f1f3d02bda4 upstream. The free_rtllib() function frees the "dev" pointer so there is use after free on the next line. Re-arrange things to avoid that. Fixes: 66898177e7e5 ("staging: rtl8192e: Fix unload/reload problem") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Link: https://lore.kernel.org/r/20211117072016.GA5237@kili Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c index 7cdced0b0581..da73998bc5f7 100644 --- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c @@ -2579,13 +2579,14 @@ static void _rtl92e_pci_disconnect(struct pci_dev *pdev) free_irq(dev->irq, dev); priv->irq = 0; } - free_rtllib(dev); if (dev->mem_start != 0) { iounmap((void __iomem *)dev->mem_start); release_mem_region(pci_resource_start(pdev, 1), pci_resource_len(pdev, 1)); } + + free_rtllib(dev); } else { priv = rtllib_priv(dev); } -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

2 1

[PATCH OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

2 1

[OLK-6.6] openeuler_defconfig: fix checkdefconfig fail
by Peng Zhang 15 Jun '24

15 Jun '24

From: ZhangPeng <zhangpeng362(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IA5OHG ------------------------------------------------------- CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for aarch64 is not updated. Make update_oedefconfig to fix checkdefconfig fail. Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ab1db78f049a..41a1ea231ed0 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -7911,6 +7911,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 0c6fc6018c2c..4a979fcc1790 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -9043,6 +9043,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-36971
by Liu Jian 15 Jun '24

15 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 15 Jun '24

15 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/cma: Fix rdma_resolve_route() memory leak
by Zhao Wenhui 15 Jun '24

15 Jun '24

From: Gerd Rausch <gerd.rausch(a)oracle.com> stable inclusion from stable-v4.19.198 commit 4893c938f2a140a74be91779e45e4a7fa111198f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ER CVE: CVE-2021-47345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 74f160ead74bfe5f2b38afb4fcf86189f9ff40c9 ] Fix a memory leak when "mda_resolve_route() is called more than once on the same "rdma_cm_id". This is possible if cma_query_handler() triggers the RDMA_CM_EVENT_ROUTE_ERROR flow which puts the state machine back and allows rdma_resolve_route() to be called again. Link: https://lore.kernel.org/r/f6662b7b-bdb7-2706-1e12-47c61d3474b6@oracle.com Signed-off-by: Gerd Rausch <gerd.rausch(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/infiniband/core/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..127ebd481689 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -2547,7 +2547,8 @@ static int cma_resolve_ib_route(struct rdma_id_private *id_priv, int timeout_ms) cma_init_resolve_route_work(work, id_priv); - route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); + if (!route->path_rec) + route->path_rec = kmalloc(sizeof *route->path_rec, GFP_KERNEL); if (!route->path_rec) { ret = -ENOMEM; goto err1; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/9p: fix uninitialized values during inode evict
by Long Li 15 Jun '24

15 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[PATCH OLK-5.10] fs/9p: fix uninitialized values during inode evict
by Long Li 15 Jun '24

15 Jun '24

From: Eric Van Hensbergen <ericvh(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 6630036b7c228f57c7893ee0403e92c2db2cd21d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U997 CVE: CVE-2024-36923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an iget fails due to not being able to retrieve information from the server then the inode structure is only partially initialized. When the inode gets evicted, references to uninitialized structures (like fscache cookies) were being made. This patch checks for a bad_inode before doing anything other than clearing the inode from the cache. Since the inode is bad, it shouldn't have any state associated with it that needs to be written back (and there really isn't a way to complete those anyways). Reported-by: syzbot+eb83fe1cce5833cd66a0(a)syzkaller.appspotmail.com Signed-off-by: Eric Van Hensbergen <ericvh(a)kernel.org> Conflicts: fs/9p/vfs_inode.c [v9fs_evict_inode() function has been changed] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/9p/vfs_inode.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c index 88ca5015f987..483d777a8617 100644 --- a/fs/9p/vfs_inode.c +++ b/fs/9p/vfs_inode.c @@ -376,15 +376,19 @@ void v9fs_evict_inode(struct inode *inode) { struct v9fs_inode *v9inode = V9FS_I(inode); - truncate_inode_pages_final(&inode->i_data); - clear_inode(inode); - filemap_fdatawrite(&inode->i_data); - - v9fs_cache_inode_put_cookie(inode); - /* clunk the fid stashed in writeback_fid */ - if (v9inode->writeback_fid) { - p9_client_clunk(v9inode->writeback_fid); - v9inode->writeback_fid = NULL; + if (!is_bad_inode(inode)) { + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + filemap_fdatawrite(&inode->i_data); + + v9fs_cache_inode_put_cookie(inode); + /* clunk the fid stashed in writeback_fid */ + if (v9inode->writeback_fid) { + p9_client_clunk(v9inode->writeback_fid); + v9inode->writeback_fid = NULL; + } + } else { + clear_inode(inode); } } -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 17817/22937] drivers/edac/skx_common.o: warning: objtool: missing symbol for section .text
by kernel test robot 15 Jun '24

15 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: 0cfc819665b6124290e8d9ff7a52b8e0147eaa55 [17817/22937] Intel: EDAC, skx, i10nm: Make skx_common.c a pure library config: x86_64-buildonly-randconfig-001-20240615 (https://download.01.org/0day-ci/archive/20240615/202406151050.cbAafgsa-lkp@…) compiler: gcc-9 (Ubuntu 9.5.0-4ubuntu2) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240615/202406151050.cbAafgsa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406151050.cbAafgsa-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/edac/skx_common.c: In function 'skx_mce_output_error': drivers/edac/skx_common.c:478:8: warning: variable 'type' set but not used [-Wunused-but-set-variable] 478 | char *type, *optype; | ^~~~ drivers/edac/skx_common.c: In function 'skx_get_dimm_info': drivers/edac/skx_common.c:317:72: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=] 317 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~ drivers/edac/skx_common.c:317:45: note: using the range [0, 4294967295] for directive argument 317 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c:317:2: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32 317 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 318 | imc->src_id, imc->lmc, chan, dimmno); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c: In function 'skx_get_nvdimm_info': drivers/edac/skx_common.c:365:72: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=] 365 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~ drivers/edac/skx_common.c:365:45: note: using the range [0, 4294967295] for directive argument 365 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c:365:2: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32 365 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 366 | imc->src_id, imc->lmc, chan, dimmno); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/edac/skx_common.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-36971
by Liu Jian 15 Jun '24

15 Jun '24

CVE-2024-36971 Eric Dumazet (1): net: fix __dst_negative_advice() race Liu Jian (1): net: fix kabi breakage in struct dst_ops include/net/dst_ops.h | 4 ++++ include/net/sock.h | 13 +++---------- net/ipv4/route.c | 22 ++++++++-------------- net/ipv6/route.c | 29 +++++++++++++++-------------- net/xfrm/xfrm_policy.c | 11 +++-------- 5 files changed, 33 insertions(+), 46 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 18534/22937] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 15 Jun '24

15 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [18534/22937] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-103-20240609 (https://download.01.org/0day-ci/archive/20240615/202406150959.idZDT1QZ-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406150959.idZDT1QZ-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v5 00/21] xfs: atomic writes for xfs
by Long Li 14 Jun '24

14 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (11): block: Add core atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (5): block: get atomic write max sectors xfs: support atomic write ioctl xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Documentation/ABI/testing/sysfs-block | 52 ++++++++++++++ block/blk-core.c | 39 ++++++++++- block/blk-merge.c | 95 +++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-settings.c | 57 ++++++++++++++++ block/blk-sysfs.c | 34 ++++++++++ block/blk.h | 1 + drivers/md/dm-table.c | 5 +- drivers/md/dm.c | 4 +- drivers/nvme/host/core.c | 56 +++++++++++++++ fs/aio.c | 8 +-- fs/iomap/direct-io.c | 32 +++++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 24 ++++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 ++ fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 38 ++++++++++- fs/xfs/xfs_inode.c | 30 ++++++++ fs/xfs/xfs_inode.h | 11 +++ fs/xfs/xfs_ioctl.c | 98 ++++++++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 +++++- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 +++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 75 +++++++++++++++++++- include/linux/fs.h | 30 +++++++- include/linux/iomap.h | 1 + include/uapi/linux/fs.h | 9 ++- io_uring/io_uring.c | 2 +- 32 files changed, 776 insertions(+), 40 deletions(-) -- 2.31.1

2 22

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix not validating setsockopt user input
by Kaixiong Yu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.8.7 commit 8ee0c132a61df9723813c40e742dc5321824daa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE CVE: CVE-2024-35965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f3951242ace5efc7131932e2e01e6ac6baed846 ] Check user input length before copying data. Fixes: 33575df7be67 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c") Fixes: 3ee7b7cd8390 ("Bluetooth: Add BT_MODE socket option") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_sock.c [The conflict occurs because the commit 54db3630deff566224de6cfb0767d2d398e68ed5 ("Bluetooth: Remove BT_HS"), which is from stable inclusion-v6.8.2, is not merged] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 54 +++++++++++++++----------------------- 1 file changed, 21 insertions(+), 33 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 756523e5402a..13afdc599b58 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -744,7 +744,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, struct sock *sk = sock->sk; struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_options opts; - int len, err = 0; + int err = 0; u32 opt; BT_DBG("sk %p", sk); @@ -771,11 +771,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); - if (copy_from_sockptr(&opts, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen); + if (err) break; - } if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { err = -EINVAL; @@ -818,10 +816,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; case L2CAP_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt & L2CAP_LM_FIPS) { err = -EINVAL; @@ -902,7 +899,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, struct bt_security sec; struct bt_power pwr; struct l2cap_conn *conn; - int len, err = 0; + int err = 0; u32 opt; u16 mtu; u8 mode; @@ -928,11 +925,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level < BT_SECURITY_LOW || sec.level > BT_SECURITY_FIPS) { @@ -977,10 +972,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) { set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -992,10 +986,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_FLUSHABLE: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt > BT_FLUSHABLE_ON) { err = -EINVAL; @@ -1027,11 +1020,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; - len = min_t(unsigned int, sizeof(pwr), optlen); - if (copy_from_sockptr(&pwr, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen); + if (err) break; - } if (pwr.force_active) set_bit(FLAG_FORCE_ACTIVE, &chan->flags); @@ -1040,10 +1031,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_CHANNEL_POLICY: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; - break; - } + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) + break; if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) { err = -EINVAL; @@ -1088,10 +1078,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen); + if (err) break; - } if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && sk->sk_state == BT_CONNECTED) @@ -1119,10 +1108,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mode, optval, sizeof(u8))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen); + if (err) break; - } BT_DBG("mode %u", mode); -- 2.25.1

2 1

[PATCH v2 OLK-5.10] arm64: mm: Replace global variable in pbha with static key
by Wupeng Ma 14 Jun '24

14 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5L01 -------------------------------- During the lmbench test, it was observed that bw_mem experienced a degradation of 8% or more. To solve this issue, replacing the global variables with a static key. Fixes: 0d65528c8526 ("arm64: mm: Detect and enable PBHA bit0 at early startup") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- Changelog since v1: - add fix tag for bugfix --- drivers/soc/hisilicon/pbha.c | 17 +++++++++-------- include/linux/pbha.h | 13 ++++++++----- 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/soc/hisilicon/pbha.c b/drivers/soc/hisilicon/pbha.c index 57daa5c338b5..9e385c93bab5 100644 --- a/drivers/soc/hisilicon/pbha.c +++ b/drivers/soc/hisilicon/pbha.c @@ -17,8 +17,9 @@ #define HBM_MODE_CACHE 1 -bool __ro_after_init pbha_bit0_enabled; -bool __ro_after_init pbha_bit0_kernel_enabled; +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_enabled); +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + static bool pbha_enabled_phase_1; void __init early_pbha_bit0_init(void) @@ -191,15 +192,15 @@ static int __init setup_pbha(char *str) return 0; if (strcmp(str, "enable") == 0) { - pbha_bit0_enabled = true; - pbha_bit0_kernel_enabled = true; + static_branch_enable(&pbha_bit0_enabled); + static_branch_enable(&pbha_bit0_kernel_enabled); } else if (strcmp(str, "user") == 0) { - pbha_bit0_enabled = true; + static_branch_enable(&pbha_bit0_enabled); } - if (pbha_bit0_enabled) - pr_info("pbha bit_0 enabled, kernel: %d\n", - pbha_bit0_kernel_enabled); + if (static_branch_likely(&pbha_bit0_enabled)) + pr_info("pbha bit_0 enabled, kernel: %ld\n", + static_branch_likely(&pbha_bit0_kernel_enabled)); return 0; } diff --git a/include/linux/pbha.h b/include/linux/pbha.h index 45a4b07778bf..a8ac441628bd 100644 --- a/include/linux/pbha.h +++ b/include/linux/pbha.h @@ -20,20 +20,22 @@ #define HBM_MODE_CACHE 1 #ifdef CONFIG_ARM64_PBHA -extern bool __ro_after_init pbha_bit0_enabled; -extern bool __ro_after_init pbha_bit0_kernel_enabled; +DECLARE_STATIC_KEY_FALSE(pbha_bit0_enabled); +DECLARE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + extern struct mm_walk_ops pbha_bit0_walk_ops; extern void __init early_pbha_bit0_init(void); extern int pbha_bit0_update_vma(struct mm_struct *mm, int val); static inline bool system_support_pbha_bit0(void) { - return pbha_bit0_enabled; + return static_branch_unlikely(&pbha_bit0_enabled); } static inline pgprot_t pgprot_pbha_bit0(pgprot_t prot) { - if (!system_support_pbha_bit0() || !pbha_bit0_kernel_enabled) + if (!system_support_pbha_bit0() || + !static_branch_unlikely(&pbha_bit0_kernel_enabled)) return prot; return pgprot_pbha(prot, PBHA_VAL_BIT0); @@ -45,7 +47,8 @@ static inline pte_t maybe_mk_pbha_bit0(pte_t pte, struct vm_area_struct *vma) return pte; /* global init task will update pbha bit0 iff kernel can do this */ - if (unlikely(is_global_init(current)) && pbha_bit0_kernel_enabled && + if (unlikely(is_global_init(current)) && + static_branch_unlikely(&pbha_bit0_kernel_enabled) && !(vma->vm_flags & VM_PBHA_BIT0)) vma->vm_flags |= VM_PBHA_BIT0; -- 2.25.1

2 1

[PATCH v2 OLK-5.10] arm64: mm: Replace global variable in pbha with static key
by Wupeng Ma 14 Jun '24

14 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5L01 -------------------------------- During the lmbench test, it was observed that bw_mem experienced a degradation of 8% or more. To solve this issue, replacing the global variables with a static key. Fixes: 0d65528c8526 ("arm64: mm: Detect and enable PBHA bit0 at early startup") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- Changelog since v1: - add fix tag for bugfix --- drivers/soc/hisilicon/pbha.c | 17 +++++++++-------- include/linux/pbha.h | 13 ++++++++----- 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/soc/hisilicon/pbha.c b/drivers/soc/hisilicon/pbha.c index 57daa5c338b5..9e385c93bab5 100644 --- a/drivers/soc/hisilicon/pbha.c +++ b/drivers/soc/hisilicon/pbha.c @@ -17,8 +17,9 @@ #define HBM_MODE_CACHE 1 -bool __ro_after_init pbha_bit0_enabled; -bool __ro_after_init pbha_bit0_kernel_enabled; +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_enabled); +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + static bool pbha_enabled_phase_1; void __init early_pbha_bit0_init(void) @@ -191,15 +192,15 @@ static int __init setup_pbha(char *str) return 0; if (strcmp(str, "enable") == 0) { - pbha_bit0_enabled = true; - pbha_bit0_kernel_enabled = true; + static_branch_enable(&pbha_bit0_enabled); + static_branch_enable(&pbha_bit0_kernel_enabled); } else if (strcmp(str, "user") == 0) { - pbha_bit0_enabled = true; + static_branch_enable(&pbha_bit0_enabled); } - if (pbha_bit0_enabled) - pr_info("pbha bit_0 enabled, kernel: %d\n", - pbha_bit0_kernel_enabled); + if (static_branch_likely(&pbha_bit0_enabled)) + pr_info("pbha bit_0 enabled, kernel: %ld\n", + static_branch_likely(&pbha_bit0_kernel_enabled)); return 0; } diff --git a/include/linux/pbha.h b/include/linux/pbha.h index 45a4b07778bf..a8ac441628bd 100644 --- a/include/linux/pbha.h +++ b/include/linux/pbha.h @@ -20,20 +20,22 @@ #define HBM_MODE_CACHE 1 #ifdef CONFIG_ARM64_PBHA -extern bool __ro_after_init pbha_bit0_enabled; -extern bool __ro_after_init pbha_bit0_kernel_enabled; +DECLARE_STATIC_KEY_FALSE(pbha_bit0_enabled); +DECLARE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + extern struct mm_walk_ops pbha_bit0_walk_ops; extern void __init early_pbha_bit0_init(void); extern int pbha_bit0_update_vma(struct mm_struct *mm, int val); static inline bool system_support_pbha_bit0(void) { - return pbha_bit0_enabled; + return static_branch_unlikely(&pbha_bit0_enabled); } static inline pgprot_t pgprot_pbha_bit0(pgprot_t prot) { - if (!system_support_pbha_bit0() || !pbha_bit0_kernel_enabled) + if (!system_support_pbha_bit0() || + !static_branch_unlikely(&pbha_bit0_kernel_enabled)) return prot; return pgprot_pbha(prot, PBHA_VAL_BIT0); @@ -45,7 +47,8 @@ static inline pte_t maybe_mk_pbha_bit0(pte_t pte, struct vm_area_struct *vma) return pte; /* global init task will update pbha bit0 iff kernel can do this */ - if (unlikely(is_global_init(current)) && pbha_bit0_kernel_enabled && + if (unlikely(is_global_init(current)) && + static_branch_unlikely(&pbha_bit0_kernel_enabled) && !(vma->vm_flags & VM_PBHA_BIT0)) vma->vm_flags |= VM_PBHA_BIT0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: L2CAP: Fix not validating setsockopt user input
by Kaixiong Yu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.8.7 commit 8ee0c132a61df9723813c40e742dc5321824daa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE CVE: CVE-2024-35965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f3951242ace5efc7131932e2e01e6ac6baed846 ] Check user input length before copying data. Fixes: 33575df7be67 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c") Fixes: 3ee7b7cd8390 ("Bluetooth: Add BT_MODE socket option") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_sock.c [The conflict occurs because the commit 54db3630deff566224de6cfb0767d2d398e68ed5 ("Bluetooth: Remove BT_HS"), which is from stable inclusion-v6.8.2, is not merged.] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 52 +++++++++++++++----------------------- 1 file changed, 20 insertions(+), 32 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 63bfbb5918fe..c91f4c190bbc 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -744,7 +744,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, struct sock *sk = sock->sk; struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_options opts; - int len, err = 0; + int err = 0; u32 opt; BT_DBG("sk %p", sk); @@ -771,11 +771,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); - if (copy_from_sockptr(&opts, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen); + if (err) break; - } if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { err = -EINVAL; @@ -818,10 +816,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; case L2CAP_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt & L2CAP_LM_FIPS) { err = -EINVAL; @@ -902,7 +899,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, struct bt_security sec; struct bt_power pwr; struct l2cap_conn *conn; - int len, err = 0; + int err = 0; u32 opt; u16 mtu; u8 mode; @@ -928,11 +925,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level < BT_SECURITY_LOW || sec.level > BT_SECURITY_FIPS) { @@ -977,10 +972,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) { set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -992,10 +986,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_FLUSHABLE: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt > BT_FLUSHABLE_ON) { err = -EINVAL; @@ -1027,11 +1020,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; - len = min_t(unsigned int, sizeof(pwr), optlen); - if (copy_from_sockptr(&pwr, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen); + if (err) break; - } if (pwr.force_active) set_bit(FLAG_FORCE_ACTIVE, &chan->flags); @@ -1065,10 +1056,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_SNDMTU: - if (!bdaddr_type_is_le(chan->src_type)) { - err = -EINVAL; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } /* Setting is not supported as it's the remote side that * decides this. @@ -1088,10 +1078,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen); + if (err) break; - } if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && sk->sk_state == BT_CONNECTED) @@ -1119,10 +1108,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mode, optval, sizeof(u8))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen); + if (err) break; - } BT_DBG("mode %u", mode); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64: mm: Replace global variable in pbha with static key
by Wupeng Ma 14 Jun '24

14 Jun '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5L01 -------------------------------- During the lmbench test, it was observed that bw_mem experienced a degradation of 8% or more. To solve this issue, replacing the global variables with a static key. Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/soc/hisilicon/pbha.c | 17 +++++++++-------- include/linux/pbha.h | 13 ++++++++----- 2 files changed, 17 insertions(+), 13 deletions(-) diff --git a/drivers/soc/hisilicon/pbha.c b/drivers/soc/hisilicon/pbha.c index 57daa5c338b5..9e385c93bab5 100644 --- a/drivers/soc/hisilicon/pbha.c +++ b/drivers/soc/hisilicon/pbha.c @@ -17,8 +17,9 @@ #define HBM_MODE_CACHE 1 -bool __ro_after_init pbha_bit0_enabled; -bool __ro_after_init pbha_bit0_kernel_enabled; +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_enabled); +__ro_after_init DEFINE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + static bool pbha_enabled_phase_1; void __init early_pbha_bit0_init(void) @@ -191,15 +192,15 @@ static int __init setup_pbha(char *str) return 0; if (strcmp(str, "enable") == 0) { - pbha_bit0_enabled = true; - pbha_bit0_kernel_enabled = true; + static_branch_enable(&pbha_bit0_enabled); + static_branch_enable(&pbha_bit0_kernel_enabled); } else if (strcmp(str, "user") == 0) { - pbha_bit0_enabled = true; + static_branch_enable(&pbha_bit0_enabled); } - if (pbha_bit0_enabled) - pr_info("pbha bit_0 enabled, kernel: %d\n", - pbha_bit0_kernel_enabled); + if (static_branch_likely(&pbha_bit0_enabled)) + pr_info("pbha bit_0 enabled, kernel: %ld\n", + static_branch_likely(&pbha_bit0_kernel_enabled)); return 0; } diff --git a/include/linux/pbha.h b/include/linux/pbha.h index 45a4b07778bf..a8ac441628bd 100644 --- a/include/linux/pbha.h +++ b/include/linux/pbha.h @@ -20,20 +20,22 @@ #define HBM_MODE_CACHE 1 #ifdef CONFIG_ARM64_PBHA -extern bool __ro_after_init pbha_bit0_enabled; -extern bool __ro_after_init pbha_bit0_kernel_enabled; +DECLARE_STATIC_KEY_FALSE(pbha_bit0_enabled); +DECLARE_STATIC_KEY_FALSE(pbha_bit0_kernel_enabled); + extern struct mm_walk_ops pbha_bit0_walk_ops; extern void __init early_pbha_bit0_init(void); extern int pbha_bit0_update_vma(struct mm_struct *mm, int val); static inline bool system_support_pbha_bit0(void) { - return pbha_bit0_enabled; + return static_branch_unlikely(&pbha_bit0_enabled); } static inline pgprot_t pgprot_pbha_bit0(pgprot_t prot) { - if (!system_support_pbha_bit0() || !pbha_bit0_kernel_enabled) + if (!system_support_pbha_bit0() || + !static_branch_unlikely(&pbha_bit0_kernel_enabled)) return prot; return pgprot_pbha(prot, PBHA_VAL_BIT0); @@ -45,7 +47,8 @@ static inline pte_t maybe_mk_pbha_bit0(pte_t pte, struct vm_area_struct *vma) return pte; /* global init task will update pbha bit0 iff kernel can do this */ - if (unlikely(is_global_init(current)) && pbha_bit0_kernel_enabled && + if (unlikely(is_global_init(current)) && + static_branch_unlikely(&pbha_bit0_kernel_enabled) && !(vma->vm_flags & VM_PBHA_BIT0)) vma->vm_flags |= VM_PBHA_BIT0; -- 2.25.1

2 1

[PATCH OLK-5.10 v4 00/26] xfs: atomic writes for xfs
by Long Li 14 Jun '24

14 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (11): block: Add core atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (6): block: get atomic write max sectors xfs: support atomic write ioctl xfs: atomic write file dio convert to mark IOCB_ATOMIC xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Zhang Yi (4): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() xfs: refactor the truncating order xfs: correct the truncate blocksize of realtime inode Documentation/ABI/testing/sysfs-block | 52 ++++++++++++ block/blk-core.c | 39 ++++++++- block/blk-merge.c | 95 ++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-settings.c | 57 +++++++++++++ block/blk-sysfs.c | 34 ++++++++ block/blk.h | 1 + drivers/md/dm-table.c | 5 +- drivers/md/dm.c | 4 +- drivers/nvme/host/core.c | 56 ++++++++++++ fs/aio.c | 8 +- fs/iomap/buffered-io.c | 8 +- fs/iomap/direct-io.c | 32 +++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 24 +++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 + fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 40 ++++++++- fs/xfs/xfs_inode.c | 43 ++++++++++ fs/xfs/xfs_inode.h | 12 +++ fs/xfs/xfs_ioctl.c | 96 ++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 ++++- fs/xfs/xfs_iops.c | 118 +++++++++++++------------- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 ++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 77 ++++++++++++++++- include/linux/fs.h | 30 ++++++- include/linux/iomap.h | 5 +- include/linux/math64.h | 24 ++++++ include/uapi/linux/fs.h | 9 +- io_uring/io_uring.c | 2 +- 35 files changed, 884 insertions(+), 102 deletions(-) -- 2.31.1

2 27

[PATCH openEuler-1.0-LTS] dhugetlb: use rcu lock to protect hpool
by Liu Shixin 14 Jun '24

14 Jun '24

hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/IA5JXN -------------------------------- In freeing process, set memcg->hpool or dpool_global_hpool to NULL and then freeing it. To avoid UAF problem of hpool, we have to make sure the users that already hold pointer to hpool don't use the pointer after freeing hpool. The freeing of hpool should block until make sure all such users don't use hpool. Since anyone who want to use hpool have to increase its refcount at first. Use rcu_read_lock() and synchronize_rcu() to guarantee all such users failed to get hpool before freeing hpool. Fixes: 0bc0d0d57eda ("dhugetlb: backport dynamic hugetlb feature") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/hugetlb.c | 1 + mm/memcontrol.c | 11 ++++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4be708677ce6..07b961d0a5ff 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3360,6 +3360,7 @@ void dhugetlb_pool_put(struct dhugetlb_pool *hpool) if (atomic_dec_and_test(&hpool->refcnt)) { css_put(&hpool->attach_memcg->css); + synchronize_rcu(); kfree(hpool); } } diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7dc68b1792ef..4ecb6f09b68b 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4701,14 +4701,19 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, struct dhugetlb_pool *get_dhugetlb_pool_from_memcg(struct mem_cgroup *memcg) { struct mem_cgroup_extension *memcg_ext; + struct dhugetlb_pool *hpool; if (!memcg) return NULL; + rcu_read_lock(); memcg_ext = container_of(memcg, struct mem_cgroup_extension, memcg); - if (dhugetlb_pool_get(memcg_ext->hpool)) - return memcg_ext->hpool; - return NULL; + hpool = memcg_ext->hpool; + if (!dhugetlb_pool_get(hpool)) + hpool = NULL; + rcu_read_unlock(); + + return hpool; } static void set_dhugetlb_pool_to_memcg(struct mem_cgroup *memcg, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
by Zheng Zucheng 14 Jun '24

14 Jun '24

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v5.15-rc4 commit 305d568b72f17f674155a2a8275f865f207b3808 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4OB CVE: CVE-2021-47391 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice. CPU 1 CPU 2 rdma_resolve_addr(): RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) #1 process_one_req(): for #1 addr_handler(): RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND mutex_unlock(&id_priv->handler_mutex); [.. handler still running ..] rdma_resolve_addr(): RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY rdma_resolve_ip(addr_handler) !! two requests are now on the req_list rdma_destroy_id(): destroy_id_handler_unlock(): _destroy_id(): cma_cancel_operation(): rdma_addr_cancel() // process_one_req() self removes it spin_lock_bh(&lock); cancel_delayed_work(&req->work); if (!list_empty(&req->list)) == true ! rdma_addr_cancel() returns after process_on_req #1 is done kfree(id_priv) process_one_req(): for #2 addr_handler(): mutex_lock(&id_priv->handler_mutex); !! Use after free on id_priv rdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one. The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers. Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path. Link: https://lore.kernel.org/r/0-v1-3bc675b8006d+22-syz_cancel_uaf_jgg@nvidia.com Cc: stable(a)vger.kernel.org Fixes: e51060f08a61 ("IB: IP address based RDMA connection manager") Reported-by: syzbot+dc3dfba010d7671e05f5(a)syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> (cherry picked from commit 305d568b72f17f674155a2a8275f865f207b3808) Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/core/cma.c drivers/infiniband/core/cma_priv.h [Some contexts different. No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/infiniband/core/cma.c | 23 +++++++++++++++++++++++ drivers/infiniband/core/cma_priv.h | 1 + 2 files changed, 24 insertions(+) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 20a5501b740a..90cb1255ca64 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1643,6 +1643,14 @@ static void cma_cancel_operation(struct rdma_id_private *id_priv, { switch (state) { case RDMA_CM_ADDR_QUERY: + /* + * We can avoid doing the rdma_addr_cancel() based on state, + * only RDMA_CM_ADDR_QUERY has a work that could still execute. + * Notice that the addr_handler work could still be exiting + * outside this state, however due to the interaction with the + * handler_mutex the work is guaranteed not to touch id_priv + * during exit. + */ rdma_addr_cancel(&id_priv->id.route.addr.dev_addr); break; case RDMA_CM_ROUTE_QUERY: @@ -3459,6 +3467,21 @@ int rdma_resolve_addr(struct rdma_cm_id *id, struct sockaddr *src_addr, if (dst_addr->sa_family == AF_IB) { ret = cma_resolve_ib_addr(id_priv); } else { + /* + * The FSM can return back to RDMA_CM_ADDR_BOUND after + * rdma_resolve_ip() is called, eg through the error + * path in addr_handler(). If this happens the existing + * request must be canceled before issuing a new one. + * Since canceling a request is a bit slow and this + * oddball path is rare, keep track once a request has + * been issued. The track turns out to be a permanent + * state since this is the only cancel as it is + * immediately before rdma_resolve_ip(). + */ + if (id_priv->used_resolve_ip) + rdma_addr_cancel(&id->route.addr.dev_addr); + else + id_priv->used_resolve_ip = 1; ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr, &id->route.addr.dev_addr, timeout_ms, addr_handler, id_priv); diff --git a/drivers/infiniband/core/cma_priv.h b/drivers/infiniband/core/cma_priv.h index 194cfe78c447..e2e0bc89d847 100644 --- a/drivers/infiniband/core/cma_priv.h +++ b/drivers/infiniband/core/cma_priv.h @@ -87,6 +87,7 @@ struct rdma_id_private { bool tos_set; u8 reuseaddr; u8 afonly; + u8 used_resolve_ip; enum ib_gid_type gid_type; /* -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix UAF problem of hpool
by Liu Shixin 14 Jun '24

14 Jun '24

Add rcu lock protection to avoid get refcount of hpool after it has been freed. Liu Shixin (2): mm/dynamic_hugetlb: simplify the refcount code mm/dynamic_hugetlb: use rcu lock to protect hpool mm/dynamic_hugetlb.c | 128 +++++++++++++++++++++++++++---------------- 1 file changed, 82 insertions(+), 46 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix not validating setsockopt user input
by Kaixiong Yu 14 Jun '24

14 Jun '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.8.7 commit 8ee0c132a61df9723813c40e742dc5321824daa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE CVE: CVE-2024-35965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f3951242ace5efc7131932e2e01e6ac6baed846 ] Check user input length before copying data. Fixes: 33575df7be67 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c") Fixes: 3ee7b7cd8390 ("Bluetooth: Add BT_MODE socket option") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_sock.c [The conflict occurs because the commit 54db3630deff566224de6cfb0767d2d398e68ed5 ("Bluetooth: Remove BT_HS"), which is from stable inclusion-v6.8.2, is not merged] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 54 +++++++++++++++----------------------- 1 file changed, 21 insertions(+), 33 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 63bfbb5918fe..f739223d3af8 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -744,7 +744,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, struct sock *sk = sock->sk; struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_options opts; - int len, err = 0; + int err = 0; u32 opt; BT_DBG("sk %p", sk); @@ -771,11 +771,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); - if (copy_from_sockptr(&opts, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen); + if (err) break; - } if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { err = -EINVAL; @@ -818,10 +816,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; case L2CAP_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt & L2CAP_LM_FIPS) { err = -EINVAL; @@ -902,7 +899,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, struct bt_security sec; struct bt_power pwr; struct l2cap_conn *conn; - int len, err = 0; + int err = 0; u32 opt; u16 mtu; u8 mode; @@ -928,11 +925,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level < BT_SECURITY_LOW || sec.level > BT_SECURITY_FIPS) { @@ -977,10 +972,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) { set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -992,10 +986,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_FLUSHABLE: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt > BT_FLUSHABLE_ON) { err = -EINVAL; @@ -1027,11 +1020,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; - len = min_t(unsigned int, sizeof(pwr), optlen); - if (copy_from_sockptr(&pwr, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen); + if (err) break; - } if (pwr.force_active) set_bit(FLAG_FORCE_ACTIVE, &chan->flags); @@ -1040,10 +1031,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_CHANNEL_POLICY: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; - break; - } + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) + break; if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) { err = -EINVAL; @@ -1088,10 +1078,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen); + if (err) break; - } if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && sk->sk_state == BT_CONNECTED) @@ -1119,10 +1108,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mode, optval, sizeof(u8))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen); + if (err) break; - } BT_DBG("mode %u", mode); -- 2.25.1

2 1

[PATCH OLK-5.10 v2 0/2] Fix UAF problem of hpool
by Liu Shixin 14 Jun '24

14 Jun '24

Add rcu lock protection to avoid get refcount of hpool after it has been freed. Liu Shixin (2): mm/dynamic_hugetlb: simplify the refcount code mm/dynamic_hugetlb: use rcu lock to protect hpool mm/dynamic_hugetlb.c | 128 +++++++++++++++++++++++++++---------------- 1 file changed, 82 insertions(+), 46 deletions(-) -- 2.25.1

1 2

[PATCH OLK-5.10 0/2] Fix UAF problem of hpool
by Liu Shixin 14 Jun '24

14 Jun '24

Add rcu lock protection to avoid get refcount of hpool after it has been freed. Liu Shixin (2): mm/dynamic_hugetlb: simplify the refcount code mm/dynamic_hugetlb: use rcu lock to protect hpool mm/dynamic_hugetlb.c | 128 +++++++++++++++++++++++++++---------------- 1 file changed, 82 insertions(+), 46 deletions(-) -- 2.25.1

2 3