- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v3 00/19] arm64: perf: Add support for event counting threshold
by Junhao He 19 Sep '24

19 Sep '24

ounting of PMU events depending on how much the event increments on a single cycle. Two new config fields for perf_event_open have been added, and a PMU cap file for reading the max_threshold. See the second commit message and the docs in the last commit for more details. The feature is not currently supported on KVM guests, and PMMIR is set to read as zero, so it's not advertised as available. But it can be added at a later time. Writes to PMEVTYPER.TC and TH from guests are already RES0. The change has been validated on the Arm FVP model: a) Zero values, works as expected (as before). $ perf stat -e dtlb_walk/threshold=0,threshold_compare=0/ -- true 5962 dtlb_walk/threshold=0,threshold_compare=0/ b) Threshold >= 255 causes count to be 0 because dtlb_walk doesn't increase by more than 1 per cycle. $ perf stat -e dtlb_walk/threshold=255,threshold_compare=2/ -- true 0 dtlb_walk/threshold=255,threshold_compare=2/ c) Keeping comparison as >= but lowering the threshold to 1 makes the count return. $ perf stat -e dtlb_walk/threshold=1,threshold_compare=2/ -- true 6329 dtlb_walk/threshold=1,threshold_compare=2/ Anshuman Khandual (3): drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() drivers: perf: arm_pmuv3: Add new macro PMUV3_INIT_MAP_EVENT() James Clark (11): arm: perf: Remove inlines from arm_pmuv3.c arm: perf/kvm: Use GENMASK for ARMV8_PMU_PMCR_N arm: perf: Use GENMASK for PMMIR fields arm: perf: Convert remaining fields to use GENMASK arm64: perf: Include threshold control fields in PMEVTYPER mask arm: pmu: Share user ABI format mechanism with SPE perf/arm_dmc620: Remove duplicate format attribute #defines arm: pmu: Move error message and -EOPNOTSUPP to individual PMUs arm64: perf: Add support for event counting threshold Documentation: arm64: Document the PMU event counting threshold feature arm: perf: Fix ARCH=arm build with GCC Oliver Upton (2): KVM: arm64: Make PMEVTYPER<n>_EL0.NSH RES0 if EL2 isn't advertised KVM: arm64: Add PMU event filter bits required if EL3 is implemented Reiji Watanabe (1): KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 Rob Herring (Arm) (1): perf: arm_pmuv3: Avoid assigning fixed cycle counter with threshold Will Deacon (1): Revert "perf/arm_dmc620: Remove duplicate format attribute #defines" Documentation/arch/arm64/perf.rst | 72 ++++++++ arch/arm/kernel/perf_event_v7.c | 6 +- arch/arm64/kvm/arm.c | 3 +- arch/arm64/kvm/pmu-emul.c | 58 +++++-- arch/arm64/kvm/sys_regs.c | 21 ++- drivers/perf/apple_m1_cpu_pmu.c | 6 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmuv3.c | 274 ++++++++++++++++++------------ drivers/perf/arm_spe_pmu.c | 22 --- include/kvm/arm_pmu.h | 11 ++ include/linux/perf/arm_pmu.h | 22 +++ include/linux/perf/arm_pmuv3.h | 43 +++-- 12 files changed, 366 insertions(+), 183 deletions(-) -- 2.33.0

2 20

[PATCH OLK-6.6] tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
by Yi Yang 19 Sep '24

19 Sep '24

From: Peng Fan <peng.fan(a)nxp.com> stable inclusion from stable-v6.6.48 commit 8eb92cfca6c2c5a15ab1773f3d18ab8d8f7dbb68 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR5BZ CVE: CVE-2024-46706 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dc98d76a15bc29a9a4e76f2f65f39f3e590fb15c upstream. With "earlycon initcall_debug=1 loglevel=8" in bootargs, kernel sometimes boot hang. It is because normal console still is not ready, but runtime suspend is called, so early console putchar will hang in waiting TRDE set in UARTSTAT. The lpuart driver has auto suspend delay set to 3000ms, but during uart_add_one_port, a child device serial ctrl will added and probed with its pm runtime enabled(see serial_ctrl.c). The runtime suspend call path is: device_add |-> bus_probe_device |->device_initial_probe |->__device_attach |-> pm_runtime_get_sync(dev->parent); |-> pm_request_idle(dev); |-> pm_runtime_put(dev->parent); So in the end, before normal console ready, the lpuart get runtime suspended. And earlycon putchar will hang. To address the issue, mark last busy just after pm_runtime_enable, three seconds is long enough to switch from bootconsole to normal console. Fixes: 43543e6f539b ("tty: serial: fsl_lpuart: Add runtime pm support") Cc: stable <stable(a)kernel.org> Signed-off-by: Peng Fan <peng.fan(a)nxp.com> Link: https://lore.kernel.org/r/20240808140325.580105-1-peng.fan@oss.nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/fsl_lpuart.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 385b41275e8b..8bd0f8e45b14 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -2930,6 +2930,7 @@ static int lpuart_probe(struct platform_device *pdev) pm_runtime_set_autosuspend_delay(&pdev->dev, UART_AUTOSUSPEND_TIMEOUT); pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); + pm_runtime_mark_last_busy(&pdev->dev); ret = lpuart_global_reset(sport); if (ret) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Fix VSYNC referencing an unmapped VPE on GIC v4.0/v4.1
by Zhou Wang 19 Sep '24

19 Sep '24

From: caijian <caijian11(a)h-partners.com> Patch#1 Fix VSYNC referencing an unmapped VPE on GIC v4.1 Patch#2 Fix VSYNC referencing an unmapped VPE on GIC v4.0 Nianyao Tang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 Zhou Wang (1): irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.0 drivers/irqchip/irq-gic-v3-its.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.33.0

1 2

[PATCH OLK-5.10 0/1] Fix iBMA bug and change version
by Li Nan 19 Sep '24

19 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] Fix iBMA bug and change version
by Li Nan 19 Sep '24

19 Sep '24

From: Wujiahai <wujiahai(a)huawei.com> 1. The initialization sequence of the edma_host.timer and edma_host is optimized when the iBMA initializes the edma driver. 2. Change the iBMA driver version. Wujiahai (1): BMA: Fix edma driver initialization problem and change the version number. .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 2 +- .../ethernet/huawei/bma/edma_drv/bma_pci.h | 2 +- .../ethernet/huawei/bma/edma_drv/edma_host.c | 80 ++++++++----------- .../huawei/bma/kbox_drv/kbox_include.h | 2 +- .../ethernet/huawei/bma/veth_drv/veth_hb.h | 2 +- 5 files changed, 38 insertions(+), 50 deletions(-) -- 2.27.0

2 2

[PATCH OLK-6.6 v2 00/18] arm64: perf: Add support for event counting threshold
by Junhao He 19 Sep '24

19 Sep '24

ounting of PMU events depending on how much the event increments on a single cycle. Two new config fields for perf_event_open have been added, and a PMU cap file for reading the max_threshold. See the second commit message and the docs in the last commit for more details. The feature is not currently supported on KVM guests, and PMMIR is set to read as zero, so it's not advertised as available. But it can be added at a later time. Writes to PMEVTYPER.TC and TH from guests are already RES0. The change has been validated on the Arm FVP model: a) Zero values, works as expected (as before). $ perf stat -e dtlb_walk/threshold=0,threshold_compare=0/ -- true 5962 dtlb_walk/threshold=0,threshold_compare=0/ b) Threshold >= 255 causes count to be 0 because dtlb_walk doesn't increase by more than 1 per cycle. $ perf stat -e dtlb_walk/threshold=255,threshold_compare=2/ -- true 0 dtlb_walk/threshold=255,threshold_compare=2/ c) Keeping comparison as >= but lowering the threshold to 1 makes the count return. $ perf stat -e dtlb_walk/threshold=1,threshold_compare=2/ -- true 6329 dtlb_walk/threshold=1,threshold_compare=2/ Anshuman Khandual (3): drivers: perf: arm_pmuv3: Read PMMIR_EL1 unconditionally drivers: perf: arm_pmuv3: Drop some unused arguments from armv8_pmu_init() drivers: perf: arm_pmuv3: Add new macro PMUV3_INIT_MAP_EVENT() James Clark (11): arm: perf: Remove inlines from arm_pmuv3.c arm: perf/kvm: Use GENMASK for ARMV8_PMU_PMCR_N arm: perf: Use GENMASK for PMMIR fields arm: perf: Convert remaining fields to use GENMASK arm64: perf: Include threshold control fields in PMEVTYPER mask arm: pmu: Share user ABI format mechanism with SPE perf/arm_dmc620: Remove duplicate format attribute #defines arm: pmu: Move error message and -EOPNOTSUPP to individual PMUs arm64: perf: Add support for event counting threshold Documentation: arm64: Document the PMU event counting threshold feature arm: perf: Fix ARCH=arm build with GCC Oliver Upton (2): KVM: arm64: Make PMEVTYPER<n>_EL0.NSH RES0 if EL2 isn't advertised KVM: arm64: Add PMU event filter bits required if EL3 is implemented Reiji Watanabe (1): KVM: arm64: PMU: Add a helper to read a vCPU's PMCR_EL0 Will Deacon (1): Revert "perf/arm_dmc620: Remove duplicate format attribute #defines" Documentation/arch/arm64/perf.rst | 72 ++++++++ arch/arm/kernel/perf_event_v7.c | 6 +- arch/arm64/kvm/arm.c | 3 +- arch/arm64/kvm/pmu-emul.c | 58 +++++-- arch/arm64/kvm/sys_regs.c | 21 ++- drivers/perf/apple_m1_cpu_pmu.c | 6 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmuv3.c | 266 ++++++++++++++++++------------ drivers/perf/arm_spe_pmu.c | 22 --- include/kvm/arm_pmu.h | 11 ++ include/linux/perf/arm_pmu.h | 22 +++ include/linux/perf/arm_pmuv3.h | 43 +++-- 12 files changed, 359 insertions(+), 182 deletions(-) -- 2.33.0

2 19

[PATCH OLK-6.6] net/mlx5e: Take state lock during tx timeout reporter
by Liu Jian 19 Sep '24

19 Sep '24

From: Dragos Tatulea <dtatulea(a)nvidia.com> stable inclusion from stable-v6.6.48 commit b3b9a87adee97854bcd71057901d46943076267e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAQOI7 CVE: CVE-2024-45019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e6b5afd30b99b43682a7764e1a74a42fe4d5f4b3 ] mlx5e_safe_reopen_channels() requires the state lock taken. The referenced changed in the Fixes tag removed the lock to fix another issue. This patch adds it back but at a later point (when calling mlx5e_safe_reopen_channels()) to avoid the deadlock referenced in the Fixes tag. Fixes: eab0da38912e ("net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work") Signed-off-by: Dragos Tatulea <dtatulea(a)nvidia.com> Link: https://lore.kernel.org/all/ZplpKq8FKi3vwfxv@gmail.com/T/ Reviewed-by: Breno Leitao <leitao(a)debian.org> Reviewed-by: Moshe Shemesh <moshe(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20240808144107.2095424-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c index ff8242f67c54..51a23345caa1 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c @@ -149,7 +149,9 @@ static int mlx5e_tx_reporter_timeout_recover(void *ctx) return err; } + mutex_lock(&priv->state_lock); err = mlx5e_safe_reopen_channels(priv); + mutex_unlock(&priv->state_lock); if (!err) { to_ctx->status = 1; /* all channels recovered */ return err; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 v2] mptcp: pm: avoid possible UaF when selecting endp
by Liu Jian 19 Sep '24

19 Sep '24

From: "Matthieu Baerts (NGI0)" <matttbe(a)kernel.org> mainline inclusion from mainline-v6.11-rc5 commit 48e50dcbcbaaf713d82bf2da5c16aeced94ad07d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOY17 CVE: CVE-2024-44974 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni(a)redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable(a)vger.kernel.org Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/mptcp/pm_netlink.c [Did not backport 90d930882139 ("mptcp: constify a bunch of of helpers"), 85df533a787b ("mptcp: pm: do not ignore 'subflow' if 'signal' flag is also set"), 86e39e04482b ("mptcp: keep track of local endpoint still available for each msk").] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mptcp/pm_netlink.c | 44 ++++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index 0d6f3d912891..8d7d60334609 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -128,11 +128,13 @@ static bool lookup_subflow_by_saddr(const struct list_head *list, return false; } -static struct mptcp_pm_addr_entry * +static bool select_local_address(const struct pm_nl_pernet *pernet, - struct mptcp_sock *msk) + struct mptcp_sock *msk, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; rcu_read_lock(); spin_lock_bh(&msk->join_list_lock); @@ -146,19 +148,23 @@ select_local_address(const struct pm_nl_pernet *pernet, if (entry->addr.family == ((struct sock *)msk)->sk_family && !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) && !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) { - ret = entry; + *new_entry = *entry; + found = true; break; } } spin_unlock_bh(&msk->join_list_lock); rcu_read_unlock(); - return ret; + + return found; } -static struct mptcp_pm_addr_entry * -select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) +static bool +select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos, + struct mptcp_pm_addr_entry *new_entry) { - struct mptcp_pm_addr_entry *entry, *ret = NULL; + struct mptcp_pm_addr_entry *entry; + bool found = false; int i = 0; rcu_read_lock(); @@ -171,12 +177,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL)) continue; if (i++ == pos) { - ret = entry; + *new_entry = *entry; + found = true; break; } } rcu_read_unlock(); - return ret; + + return found; } static void check_work_pending(struct mptcp_sock *msk) @@ -306,7 +314,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) { struct mptcp_addr_info remote = { 0 }; struct sock *sk = (struct sock *)msk; - struct mptcp_pm_addr_entry *local; + struct mptcp_pm_addr_entry local; struct pm_nl_pernet *pernet; pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id); @@ -318,13 +326,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) /* check first for announce */ if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) { - local = select_signal_address(pernet, - msk->pm.add_addr_signaled); - if (local) { - if (mptcp_pm_alloc_anno_list(msk, local)) { + if (select_signal_address(pernet, + msk->pm.add_addr_signaled, &local)) { + if (mptcp_pm_alloc_anno_list(msk, &local)) { msk->pm.add_addr_signaled++; - mptcp_pm_announce_addr(msk, &local->addr, false); + mptcp_pm_announce_addr(msk, &local.addr, false); } } else { /* pick failed, avoid fourther attempts later */ @@ -339,13 +346,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) msk->pm.subflows < msk->pm.subflows_max) { remote_address((struct sock_common *)sk, &remote); - local = select_local_address(pernet, msk); - if (local) { + if (select_local_address(pernet, msk, &local)) { msk->pm.local_addr_used++; msk->pm.subflows++; check_work_pending(msk); spin_unlock_bh(&msk->pm.lock); - __mptcp_subflow_connect(sk, &local->addr, &remote); + __mptcp_subflow_connect(sk, &local.addr, &remote); spin_lock_bh(&msk->pm.lock); return; } -- 2.34.1

2 1

[openeuler:OLK-6.6 9567/13952] include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 19 Sep '24

19 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7df4077a020ac8c6b555718e171ec3b593a7aaf0 commit: d9ed39df777afd38fcbd4f4ca670cceb2f168124 [9567/13952] entry: Move exit to usermode functions to header file config: loongarch-randconfig-r123-20240918 (https://download.01.org/0day-ci/archive/20240918/202409182352.x3x3zSa8-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240918/202409182352.x3x3zSa8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409182352.x3x3zSa8-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got unsigned int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:380:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:380:9: sparse: expected void *ptr kernel/entry/common.c:380:9: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c:423:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ kernel/entry/common.c:423:29: sparse: expected void *ptr kernel/entry/common.c:423:29: sparse: got int [noderef] __percpu * kernel/entry/common.c: note: in included file: >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got unsigned int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * >> include/linux/entry-common.h:285:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:285:9: sparse: expected void *ptr include/linux/entry-common.h:285:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got unsigned int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got unsigned int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * include/linux/entry-common.h:298:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *ptr @@ got int [noderef] __percpu * @@ include/linux/entry-common.h:298:9: sparse: expected void *ptr include/linux/entry-common.h:298:9: sparse: got int [noderef] __percpu * vim +285 include/linux/entry-common.h 264 265 /** 266 * exit_to_user_mode_loop - do any pending work before leaving to user space 267 */ 268 unsigned long exit_to_user_mode_loop(struct pt_regs *regs, 269 unsigned long ti_work); 270 271 /** 272 * exit_to_user_mode_prepare - call exit_to_user_mode_loop() if required 273 * @regs: Pointer to pt_regs on entry stack 274 * 275 * 1) check that interrupts are disabled 276 * 2) call tick_nohz_user_enter_prepare() 277 * 3) call exit_to_user_mode_loop() if any flags from 278 * EXIT_TO_USER_MODE_WORK are set 279 * 4) check that interrupts are still disabled 280 */ 281 static __always_inline void exit_to_user_mode_prepare(struct pt_regs *regs) 282 { 283 unsigned long ti_work; 284 > 285 lockdep_assert_irqs_disabled(); 286 287 /* Flush pending rcuog wakeup before the last need_resched() check */ 288 tick_nohz_user_enter_prepare(); 289 290 ti_work = read_thread_flags(); 291 if (unlikely(ti_work & EXIT_TO_USER_MODE_WORK)) 292 ti_work = exit_to_user_mode_loop(regs, ti_work); 293 294 arch_exit_to_user_mode_prepare(regs, ti_work); 295 296 /* Ensure that kernel state is sane for a return to userspace */ 297 kmap_assert_nomap(); 298 lockdep_assert_irqs_disabled(); 299 lockdep_sys_exit(); 300 } 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.321 commit 3d89d0c4a1c6d4d2a755e826351b0a101dbc86f3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 64c7d64..0fbe3b6 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -574,6 +574,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.225 commit cbb9a969fc190e85195d1b0f08038e7f6199044e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 84e6f2b..e298189 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -564,6 +564,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH OLK-6.6] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.48 commit 34ba4f29f3d9eb52dee37512059efb2afd7e966f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 63f9322..931b655 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -901,6 +901,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH OLK-5.10] gtp: pull network headers in gtp_dev_xmit()
by Zhang Changzhong 18 Sep '24

18 Sep '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.225 commit cbb9a969fc190e85195d1b0f08038e7f6199044e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZX CVE: CVE-2024-44999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3a3be7ff9224f424e485287b54be00d2c6bd9c40 upstream. syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing fields in them. Use pskb_inet_may_pull() to fix this issue. [1] BUG: KMSAN: uninit-value in ipv6_pdp_find drivers/net/gtp.c:220 [inline] BUG: KMSAN: uninit-value in gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] BUG: KMSAN: uninit-value in gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 ipv6_pdp_find drivers/net/gtp.c:220 [inline] gtp_build_skb_ip6 drivers/net/gtp.c:1229 [inline] gtp_dev_xmit+0x1424/0x2540 drivers/net/gtp.c:1281 __netdev_start_xmit include/linux/netdevice.h:4913 [inline] netdev_start_xmit include/linux/netdevice.h:4922 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3596 __dev_queue_xmit+0x358c/0x5610 net/core/dev.c:4423 dev_queue_xmit include/linux/netdevice.h:3105 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x90e3/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:3994 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4080 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6526 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2815 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x749c/0xa3a0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2212 x64_sys_call+0x3799/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:45 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 7115 Comm: syz.1.515 Not tainted 6.11.0-rc1-syzkaller-00043-g94ede2a3e913 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Fixes: 999cb275c807 ("gtp: add IPv6 support") Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Harald Welte <laforge(a)gnumonks.org> Reviewed-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Link: https://patch.msgid.link/20240808132455.3413916-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/gtp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index c824636..993960f 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -567,6 +567,9 @@ static netdev_tx_t gtp_dev_xmit(struct sk_buff *skb, struct net_device *dev) if (skb_cow_head(skb, dev->needed_headroom)) goto tx_err; + if (!pskb_inet_may_pull(skb)) + goto tx_err; + skb_reset_inner_headers(skb); /* PDP context lookups in gtp_build_skb_*() need rcu read-side lock. */ -- 2.9.5

2 1

[PATCH OLK-5.10 0/2] CVE-2024-36915
by Yongqiang Liu 18 Sep '24

18 Sep '24

Eric Dumazet (2): net: add copy_safe_from_sockptr() helper nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies include/linux/sockptr.h | 25 +++++++++++++++++++++++++ net/nfc/llcp_sock.c | 12 ++++++------ 2 files changed, 31 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-36915
by Yongqiang Liu 18 Sep '24

18 Sep '24

Eric Dumazet (2): net: add copy_safe_from_sockptr() helper nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies include/linux/sockptr.h | 25 +++++++++++++++++++++++++ net/nfc/llcp_sock.c | 12 ++++++------ 2 files changed, 31 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[OLK-5.10 0/2] CVE-2024-36915
by Yongqiang Liu 18 Sep '24

18 Sep '24

Eric Dumazet (2): net: add copy_safe_from_sockptr() helper nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies include/linux/sockptr.h | 25 +++++++++++++++++++++++++ net/nfc/llcp_sock.c | 12 ++++++------ 2 files changed, 31 insertions(+), 6 deletions(-) -- 2.34.1

1 2

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: don't walk off the end of ealist
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: lei lu <llfamsec(a)gmail.com> stable inclusion from stable-v5.10.223 commit 6386f1b6a10e5d1ddd03db4ff6dfc55d488852ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG918 CVE: CVE-2024-41017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit d0fa70aca54c8643248e89061da23752506ec0d4 upstream. Add a check before visiting the members of ea to make sure each ea stays within the ealist. Signed-off-by: lei lu <llfamsec(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/jfs/xattr.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 7ae54f78a5b0..aea5531559c0 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -797,7 +797,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, size_t buf_size) { struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; int xattr_size; ssize_t size; @@ -817,9 +817,16 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, goto not_found; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* Find the named attribute */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if ((namelen == ea->namelen) && memcmp(name, ea->name, namelen) == 0) { /* Found it */ @@ -834,6 +841,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, memcpy(data, value, size); goto release; } + } not_found: size = -ENODATA; release: @@ -861,7 +869,7 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) ssize_t size = 0; int xattr_size; struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; down_read(&JFS_IP(inode)->xattr_sem); @@ -876,9 +884,16 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) goto release; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* compute required size of list */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) { + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if (can_list(ea)) size += name_size(ea) + 1; } -- 2.34.1

2 1

[PATCH OLK-5.10] jfs: don't walk off the end of ealist
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: lei lu <llfamsec(a)gmail.com> stable inclusion from stable-v5.10.223 commit 6386f1b6a10e5d1ddd03db4ff6dfc55d488852ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAG918 CVE: CVE-2024-41017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit d0fa70aca54c8643248e89061da23752506ec0d4 upstream. Add a check before visiting the members of ea to make sure each ea stays within the ealist. Signed-off-by: lei lu <llfamsec(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- fs/jfs/xattr.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 7ae54f78a5b0..aea5531559c0 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -797,7 +797,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, size_t buf_size) { struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; int xattr_size; ssize_t size; @@ -817,9 +817,16 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, goto not_found; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* Find the named attribute */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if ((namelen == ea->namelen) && memcmp(name, ea->name, namelen) == 0) { /* Found it */ @@ -834,6 +841,7 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, memcpy(data, value, size); goto release; } + } not_found: size = -ENODATA; release: @@ -861,7 +869,7 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) ssize_t size = 0; int xattr_size; struct jfs_ea_list *ealist; - struct jfs_ea *ea; + struct jfs_ea *ea, *ealist_end; struct ea_buffer ea_buf; down_read(&JFS_IP(inode)->xattr_sem); @@ -876,9 +884,16 @@ ssize_t jfs_listxattr(struct dentry * dentry, char *data, size_t buf_size) goto release; ealist = (struct jfs_ea_list *) ea_buf.xattr; + ealist_end = END_EALIST(ealist); /* compute required size of list */ - for (ea = FIRST_EA(ealist); ea < END_EALIST(ealist); ea = NEXT_EA(ea)) { + for (ea = FIRST_EA(ealist); ea < ealist_end; ea = NEXT_EA(ea)) { + if (unlikely(ea + 1 > ealist_end) || + unlikely(NEXT_EA(ea) > ealist_end)) { + size = -EUCLEAN; + goto release; + } + if (can_list(ea)) size += name_size(ea) + 1; } -- 2.34.1

2 1

[PATCH OLK-6.6] vfs: Don't evict inode under the inode lru traversing context
by Zheng Qixing 18 Sep '24

18 Sep '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v6.6.48 commit b9bda5f6012dd00372f3a06a82ed8971a4c57c32 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZK CVE: CVE-2024-45003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2a0629834cd82f05d424bbc193374f9a43d1f87d upstream. The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate() reclaims its pages instead of using ordinary inode reference. This way inode deletion cannot be triggered from inode_lru_isolate() thus avoiding the deadlock. evict() is made to wait for I_LRU_ISOLATING to be cleared before proceeding with inode cleanup. Link: https://lore.kernel.org/all/37c29c42-7685-d1f0-067d-63582ffac405@huaweiclou… Link: https://bugzilla.kernel.org/show_bug.cgi?id=219022 Fixes: e50e5129f384 ("ext4: xattr-in-inode support") Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") Cc: stable(a)vger.kernel.org Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Link: https://lore.kernel.org/r/20240809031628.1069873-1-chengzhihao@huaweicloud.… Reviewed-by: Jan Kara <jack(a)suse.cz> Suggested-by: Jan Kara <jack(a)suse.cz> Suggested-by: Mateusz Guzik <mjguzik(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/inode.c | 39 +++++++++++++++++++++++++++++++++++++-- include/linux/fs.h | 5 +++++ 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index 2d8b8d353750..d31fd643c7ef 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -486,6 +486,39 @@ static void inode_lru_list_del(struct inode *inode) this_cpu_dec(nr_unused); } +static void inode_pin_lru_isolating(struct inode *inode) +{ + lockdep_assert_held(&inode->i_lock); + WARN_ON(inode->i_state & (I_LRU_ISOLATING | I_FREEING | I_WILL_FREE)); + inode->i_state |= I_LRU_ISOLATING; +} + +static void inode_unpin_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + WARN_ON(!(inode->i_state & I_LRU_ISOLATING)); + inode->i_state &= ~I_LRU_ISOLATING; + smp_mb(); + wake_up_bit(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); +} + +static void inode_wait_for_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + if (inode->i_state & I_LRU_ISOLATING) { + DEFINE_WAIT_BIT(wq, &inode->i_state, __I_LRU_ISOLATING); + wait_queue_head_t *wqh; + + wqh = bit_waitqueue(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); + __wait_on_bit(wqh, &wq, bit_wait, TASK_UNINTERRUPTIBLE); + spin_lock(&inode->i_lock); + WARN_ON(inode->i_state & I_LRU_ISOLATING); + } + spin_unlock(&inode->i_lock); +} + /** * inode_sb_list_add - add inode to the superblock list of inodes * @inode: inode to add @@ -655,6 +688,8 @@ static void evict(struct inode *inode) inode_sb_list_del(inode); + inode_wait_for_lru_isolating(inode); + /* * Wait for flusher thread to be done with the inode so that filesystem * does not start destroying it while writeback is still running. Since @@ -843,7 +878,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, * be under pressure before the cache inside the highmem zone. */ if (inode_has_buffers(inode) || !mapping_empty(&inode->i_data)) { - __iget(inode); + inode_pin_lru_isolating(inode); spin_unlock(&inode->i_lock); spin_unlock(lru_lock); if (remove_inode_buffers(inode)) { @@ -855,7 +890,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, __count_vm_events(PGINODESTEAL, reap); mm_account_reclaimed_pages(reap); } - iput(inode); + inode_unpin_lru_isolating(inode); spin_lock(lru_lock); return LRU_RETRY; } diff --git a/include/linux/fs.h b/include/linux/fs.h index e4ea5c34b90c..e7c55ebb9d71 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2334,6 +2334,9 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, * * I_PINNING_FSCACHE_WB Inode is pinning an fscache object for writeback. * + * I_LRU_ISOLATING Inode is pinned being isolated from LRU without holding + * i_count. + * * Q: What is the difference between I_WILL_FREE and I_FREEING? */ #define I_DIRTY_SYNC (1 << 0) @@ -2357,6 +2360,8 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, #define I_DONTCACHE (1 << 16) #define I_SYNC_QUEUED (1 << 17) #define I_PINNING_FSCACHE_WB (1 << 18) +#define __I_LRU_ISOLATING 19 +#define I_LRU_ISOLATING (1 << __I_LRU_ISOLATING) #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC) #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES) -- 2.39.2

2 1

[PATCH OLK-5.10] vfs: Don't evict inode under the inode lru traversing context
by Zheng Qixing 18 Sep '24

18 Sep '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v6.6.48 commit b9bda5f6012dd00372f3a06a82ed8971a4c57c32 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAOXZK CVE: CVE-2024-45003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------------------- commit 2a0629834cd82f05d424bbc193374f9a43d1f87d upstream. The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at first, at that time, other processes will be stuck if they try getting these inodes (See function find_inode_fast), then the reclaiming process destroy the inodes by function dispose_list(). Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Case 1: In function ext4_evict_inode(), the ea inode lookup could happen if ea_inode feature is enabled, the lookup process will be stuck under the evicting context like this: 1. File A has inode i_reg and an ea inode i_ea 2. getfattr(A, xattr_buf) // i_ea is added into lru // lru->i_ea 3. Then, following three processes running like this: PA PB echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // i_reg is added into lru, lru->i_ea->i_reg prune_icache_sb list_lru_walk_one inode_lru_isolate i_ea->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(i_reg) spin_unlock(&i_reg->i_lock) spin_unlock(lru_lock) rm file A i_reg->nlink = 0 iput(i_reg) // i_reg->nlink is 0, do evict ext4_evict_inode ext4_xattr_delete_inode ext4_xattr_inode_dec_ref_all ext4_xattr_inode_iget ext4_iget(i_ea->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(i_ea) ----→ AA deadlock dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&i_ea->i_state) Case 2: In deleted inode writing function ubifs_jnl_write_inode(), file deleting process holds BASEHD's wbuf->io_mutex while getting the xattr inode, which could race with inode reclaiming process(The reclaiming process could try locking BASEHD's wbuf->io_mutex in inode evicting function), then an ABBA deadlock problem would happen as following: 1. File A has inode ia and a xattr(with inode ixa), regular file B has inode ib and a xattr. 2. getfattr(A, xattr_buf) // ixa is added into lru // lru->ixa 3. Then, following three processes running like this: PA PB PC echo 2 > /proc/sys/vm/drop_caches shrink_slab prune_dcache_sb // ib and ia are added into lru, lru->ixa->ib->ia prune_icache_sb list_lru_walk_one inode_lru_isolate ixa->i_state |= I_FREEING // set inode state inode_lru_isolate __iget(ib) spin_unlock(&ib->i_lock) spin_unlock(lru_lock) rm file B ib->nlink = 0 rm file A iput(ia) ubifs_evict_inode(ia) ubifs_jnl_delete_inode(ia) ubifs_jnl_write_inode(ia) make_reservation(BASEHD) // Lock wbuf->io_mutex ubifs_iget(ixa->i_ino) iget_locked find_inode_fast __wait_on_freeing_inode(ixa) | iput(ib) // ib->nlink is 0, do evict | ubifs_evict_inode | ubifs_jnl_delete_inode(ib) ↓ ubifs_jnl_write_inode ABBA deadlock ←-----make_reservation(BASEHD) dispose_list // cannot be executed by prune_icache_sb wake_up_bit(&ixa->i_state) Fix the possible deadlock by using new inode state flag I_LRU_ISOLATING to pin the inode in memory while inode_lru_isolate() reclaims its pages instead of using ordinary inode reference. This way inode deletion cannot be triggered from inode_lru_isolate() thus avoiding the deadlock. evict() is made to wait for I_LRU_ISOLATING to be cleared before proceeding with inode cleanup. Link: https://lore.kernel.org/all/37c29c42-7685-d1f0-067d-63582ffac405@huaweiclou… Link: https://bugzilla.kernel.org/show_bug.cgi?id=219022 Fixes: e50e5129f384 ("ext4: xattr-in-inode support") Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") Cc: stable(a)vger.kernel.org Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Link: https://lore.kernel.org/r/20240809031628.1069873-1-chengzhihao@huaweicloud.… Reviewed-by: Jan Kara <jack(a)suse.cz> Suggested-by: Jan Kara <jack(a)suse.cz> Suggested-by: Mateusz Guzik <mjguzik(a)gmail.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/inode.c | 39 +++++++++++++++++++++++++++++++++++++-- include/linux/fs.h | 5 +++++ 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/fs/inode.c b/fs/inode.c index bec790bde7ca..c4eaa1db9d1a 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -453,6 +453,39 @@ static void inode_lru_list_del(struct inode *inode) this_cpu_dec(nr_unused); } +static void inode_pin_lru_isolating(struct inode *inode) +{ + lockdep_assert_held(&inode->i_lock); + WARN_ON(inode->i_state & (I_LRU_ISOLATING | I_FREEING | I_WILL_FREE)); + inode->i_state |= I_LRU_ISOLATING; +} + +static void inode_unpin_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + WARN_ON(!(inode->i_state & I_LRU_ISOLATING)); + inode->i_state &= ~I_LRU_ISOLATING; + smp_mb(); + wake_up_bit(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); +} + +static void inode_wait_for_lru_isolating(struct inode *inode) +{ + spin_lock(&inode->i_lock); + if (inode->i_state & I_LRU_ISOLATING) { + DEFINE_WAIT_BIT(wq, &inode->i_state, __I_LRU_ISOLATING); + wait_queue_head_t *wqh; + + wqh = bit_waitqueue(&inode->i_state, __I_LRU_ISOLATING); + spin_unlock(&inode->i_lock); + __wait_on_bit(wqh, &wq, bit_wait, TASK_UNINTERRUPTIBLE); + spin_lock(&inode->i_lock); + WARN_ON(inode->i_state & I_LRU_ISOLATING); + } + spin_unlock(&inode->i_lock); +} + /** * inode_sb_list_add - add inode to the superblock list of inodes * @inode: inode to add @@ -572,6 +605,8 @@ static void evict(struct inode *inode) inode_sb_list_del(inode); + inode_wait_for_lru_isolating(inode); + /* * Wait for flusher thread to be done with the inode so that filesystem * does not start destroying it while writeback is still running. Since @@ -771,7 +806,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, } if (inode_has_buffers(inode) || inode->i_data.nrpages) { - __iget(inode); + inode_pin_lru_isolating(inode); spin_unlock(&inode->i_lock); spin_unlock(lru_lock); if (remove_inode_buffers(inode)) { @@ -784,7 +819,7 @@ static enum lru_status inode_lru_isolate(struct list_head *item, if (current->reclaim_state) current->reclaim_state->reclaimed_slab += reap; } - iput(inode); + inode_unpin_lru_isolating(inode); spin_lock(lru_lock); return LRU_RETRY; } diff --git a/include/linux/fs.h b/include/linux/fs.h index 9d7e901b71fd..7e8684e3f05d 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -2280,6 +2280,9 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, * Used to detect that mark_inode_dirty() should not move * inode between dirty lists. * + * I_LRU_ISOLATING Inode is pinned being isolated from LRU without holding + * i_count. + * * Q: What is the difference between I_WILL_FREE and I_FREEING? */ #define I_DIRTY_SYNC (1 << 0) @@ -2302,6 +2305,8 @@ static inline void kiocb_clone(struct kiocb *kiocb, struct kiocb *kiocb_src, #define I_CREATING (1 << 15) #define I_DONTCACHE (1 << 16) #define I_SYNC_QUEUED (1 << 17) +#define __I_LRU_ISOLATING 19 +#define I_LRU_ISOLATING (1 << __I_LRU_ISOLATING) #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC) #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES) -- 2.39.2

2 1

[PATCH OLK-5.10] nfs: always check dreq->error after a commit
by Li Lingfeng 18 Sep '24

18 Sep '24

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v6.0-rc1 commit 55051c0ced7d322a169f8603d306ee6ec079f8ae category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARK13 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the client gets back a short DIO write, it will then attempt to issue another write to finish the DIO request. If that write then fails (as is often the case in an -ENOSPC situation), then we still may need to issue a COMMIT if the earlier short write was unstable. If that COMMIT then succeeds, then we don't want the client to reschedule the write requests, and to instead just return a short write. Otherwise, we can end up looping over the same DIO write forever. Always consult dreq->error after a successful RPC, even when the flag state is not NFS_ODIRECT_DONE. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2028370 Reported-by: Boyang Xue <bxue(a)redhat.com> Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/direct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c index 499519f0f6ec..5b8ab542ee84 100644 --- a/fs/nfs/direct.c +++ b/fs/nfs/direct.c @@ -629,8 +629,9 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data) dreq->max_count = 0; dreq->count = 0; dreq->flags = NFS_ODIRECT_DONE; - } else if (dreq->flags == NFS_ODIRECT_DONE) + } else { status = dreq->error; + } nfs_init_cinfo_from_dreq(&cinfo, dreq); -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Skip finding free audio for unknown engine_id
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.222 commit ffa7bd3ca9cfa902b857d1dc9a5f46fededf86c8 category: bugfix https://gitee.com/src-openeuler/kernel/issues/IAGT0E CVE: CVE-2024-42119 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3 ] [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. [HOW] Skip and return NULL. This fixes 2 OVERRUN issues reported by Coverity. Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Wayne Lin <wayne.lin(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c index f1eda1a6496d..0a13c06eea44 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1802,6 +1802,9 @@ static struct audio *find_first_free_audio( { int i, available_audio_count; + if (id == ENGINE_ID_UNKNOWN) + return NULL; + available_audio_count = pool->audio_count; for (i = 0; i < available_audio_count; i++) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] kobject_uevent: Fix OOB access within zap_modalias_env()
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Zijun Hu <quic_zijuhu(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 648d5490460d38436640da0812bf7f6351c150d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP CVE: CVE-2024-42292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc upstream. zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove. Fixes: 9b3fa47d4a76 ("kobject: fix suppressing modalias in uevents delivered over netlink") Cc: stable(a)vger.kernel.org Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Reviewed-by: Lk Sii <lk_sii(a)163.com> Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@qui… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- lib/kobject_uevent.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 8056def4c028..c0214080e233 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -432,8 +432,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) len = strlen(env->envp[i]) + 1; if (i != env->envp_idx - 1) { + /* @env->envp[] contains pointers to @env->buf[] + * with @env->buflen chars, and we are removing + * variable MODALIAS here pointed by @env->envp[i] + * with length @len as shown below: + * + * 0 @env->buf[] @env->buflen + * --------------------------------------------- + * ^ ^ ^ ^ + * | |-> @len <-| target block | + * @env->envp[0] @env->envp[i] @env->envp[i + 1] + * + * so the "target block" indicated above is moved + * backward by @len, and its right size is + * @env->buflen - (@env->envp[i + 1] - @env->envp[0]). + */ memmove(env->envp[i], env->envp[i + 1], - env->buflen - len); + env->buflen - (env->envp[i + 1] - env->envp[0])); for (j = i; j < env->envp_idx - 1; j++) env->envp[j] = env->envp[j + 1] - len; -- 2.34.1

2 1

[PATCH OLK-5.10] kobject_uevent: Fix OOB access within zap_modalias_env()
by Zhao Wenhui 18 Sep '24

18 Sep '24

From: Zijun Hu <quic_zijuhu(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 648d5490460d38436640da0812bf7f6351c150d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP CVE: CVE-2024-42292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc upstream. zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove. Fixes: 9b3fa47d4a76 ("kobject: fix suppressing modalias in uevents delivered over netlink") Cc: stable(a)vger.kernel.org Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Reviewed-by: Lk Sii <lk_sii(a)163.com> Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@qui… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- lib/kobject_uevent.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 8056def4c028..c0214080e233 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -432,8 +432,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) len = strlen(env->envp[i]) + 1; if (i != env->envp_idx - 1) { + /* @env->envp[] contains pointers to @env->buf[] + * with @env->buflen chars, and we are removing + * variable MODALIAS here pointed by @env->envp[i] + * with length @len as shown below: + * + * 0 @env->buf[] @env->buflen + * --------------------------------------------- + * ^ ^ ^ ^ + * | |-> @len <-| target block | + * @env->envp[0] @env->envp[i] @env->envp[i + 1] + * + * so the "target block" indicated above is moved + * backward by @len, and its right size is + * @env->buflen - (@env->envp[i + 1] - @env->envp[0]). + */ memmove(env->envp[i], env->envp[i + 1], - env->buflen - len); + env->buflen - (env->envp[i + 1] - env->envp[0])); for (j = i; j < env->envp_idx - 1; j++) env->envp[j] = env->envp[j + 1] - len; -- 2.34.1

2 1

[PATCH OLK-5.10] net: fix one compile error in net_rship_refresh_timeout()
by Liu Jian 18 Sep '24

18 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARV38 -------------------------------- Fix the below error when disable CONFIG_PROC_SYSCTL compile macro: aarch64-linux-gnu-ld: net/ipv4/tcp.o: in function \ `net_rship_refresh_timeout': include/net/net_rship.h:92: undefined reference to \ `net_numa_rship_jiffies' Fixes: 64ba5634c4c6 ("net: add some bpf hooks in tcp stack for network numa relationship") Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/filter.c | 3 +++ net/core/sysctl_net_core.c | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 9ef84e86b5c5..a4e94a3e8c76 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -10787,7 +10787,10 @@ static int __init gnet_bpf_init(void) } late_initcall(gnet_bpf_init); +#if defined(CONFIG_SCHED_TASK_RELATIONSHIP) #include <linux/sched/relationship.h> +unsigned long net_numa_rship_jiffies __read_mostly = HZ / 10; /* 100ms */ +#endif BPF_CALL_3(bpf_sched_net_rship_submit, void *, reqbuf, size_t, sz, u64, flags) { #if defined(CONFIG_SCHED_TASK_RELATIONSHIP) diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c index ea0ee32f27bb..8ac874fd9271 100644 --- a/net/core/sysctl_net_core.c +++ b/net/core/sysctl_net_core.c @@ -47,7 +47,6 @@ int sysctl_devconf_inherit_init_net __read_mostly; EXPORT_SYMBOL(sysctl_devconf_inherit_init_net); #ifdef CONFIG_SCHED_TASK_RELATIONSHIP -unsigned long net_numa_rship_jiffies __read_mostly = HZ / 10; /* 100ms */ static unsigned long net_numa_rship_ms_min = HZ / 10; /* 100ms */ static unsigned long net_numa_rship_ms_max = 100 * HZ; /* 100s */ #endif -- 2.34.1

2 1

[PATCH OLK-5.10] tcp: fix one compile error in __inet_hash_connect()
by Liu Jian 18 Sep '24

18 Sep '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARV38 -------------------------------- Fix the below error when disable CONFIG_PROC_SYSCTL compile macro: aarch64-linux-gnu-ld: net/ipv4/inet_hashtables.o: in \ function `__inet_hash_connect': net/ipv4/inet_hashtables.c:759: undefined reference to \ `sysctl_local_port_allocation' Fixes: 726c52655f7 ("tcp/dccp: Add another way to allocate local ports in connect()") Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/inet_hashtables.c | 2 ++ net/ipv4/sysctl_net_ipv4.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index 1ca02944ae90..1894cf014129 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -28,6 +28,8 @@ #include <net/tcp.h> #include <net/sock_reuseport.h> +int sysctl_local_port_allocation; + static u32 inet_ehashfn(const struct net *net, const __be32 laddr, const __u16 lport, const __be32 faddr, const __be16 fport) diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index a013df55e933..207a8b00a77d 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -51,7 +51,6 @@ static int comp_sack_nr_max = 255; static u32 u32_max_div_HZ = UINT_MAX / HZ; static int one_day_secs = 24 * 3600; -int sysctl_local_port_allocation; /* obsolete */ static int sysctl_tcp_low_latency __read_mostly; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: add missing check for inode numbers on directory entries
by Xia Fukun 18 Sep '24

18 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.223 commit 2f2fa9cf7c3537958a82fbe8c8595a5eb0861ad7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPRT CVE: CVE-2024-42104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit bb76c6c274683c8570ad788f79d4b875bde0e458 upstream. Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn(). As Jan Kara pointed out, this is because the link count of a metadata file gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(), tries to delete that inode (ifile inode in this case). The inconsistency occurs because directories containing the inode numbers of these metadata files that should not be visible in the namespace are read without checking. Fix this issue by treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages. Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer analysis. Link: https://lkml.kernel.org/r/20240623051135.4180-3-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d79afb004be235636ee8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d79afb004be235636ee8 Reported-by: Jan Kara <jack(a)suse.cz> Closes: https://lkml.kernel.org/r/20240617075758.wewhukbrjod5fp5o@quack3 Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nilfs2/dir.c | 6 ++++++ fs/nilfs2/nilfs.h | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 75cf7fef8987a..7269a7d8bb95c 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -143,6 +143,9 @@ static bool nilfs_check_page(struct page *page) goto Enamelen; if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1)) goto Espan; + if (unlikely(p->inode && + NILFS_PRIVATE_INODE(le64_to_cpu(p->inode)))) + goto Einumber; } if (offs != limit) goto Eend; @@ -168,6 +171,9 @@ static bool nilfs_check_page(struct page *page) goto bad_entry; Espan: error = "directory entry across blocks"; + goto bad_entry; +Einumber: + error = "disallowed inode number"; bad_entry: nilfs_error(sb, "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d", diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h index cefd2cfc7012c..3f3971e0292da 100644 --- a/fs/nilfs2/nilfs.h +++ b/fs/nilfs2/nilfs.h @@ -121,6 +121,11 @@ enum { ((ino) >= NILFS_FIRST_INO(sb) || \ ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino)))) +#define NILFS_PRIVATE_INODE(ino) ({ \ + ino_t __ino = (ino); \ + ((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \ + (__ino) != NILFS_SKETCH_INO); }) + /** * struct nilfs_transaction_info: context information for synchronization * @ti_magic: Magic number -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: add missing check for inode numbers on directory entries
by Xia Fukun 18 Sep '24

18 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.223 commit 2f2fa9cf7c3537958a82fbe8c8595a5eb0861ad7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGPRT CVE: CVE-2024-42104 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit bb76c6c274683c8570ad788f79d4b875bde0e458 upstream. Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free of metadata file inodes, which triggers a kernel bug in lru_add_fn(). As Jan Kara pointed out, this is because the link count of a metadata file gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(), tries to delete that inode (ifile inode in this case). The inconsistency occurs because directories containing the inode numbers of these metadata files that should not be visible in the namespace are read without checking. Fix this issue by treating the inode numbers of these internal files as errors in the sanity check helper when reading directory folios/pages. Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer analysis. Link: https://lkml.kernel.org/r/20240623051135.4180-3-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+d79afb004be235636ee8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d79afb004be235636ee8 Reported-by: Jan Kara <jack(a)suse.cz> Closes: https://lkml.kernel.org/r/20240617075758.wewhukbrjod5fp5o@quack3 Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nilfs2/dir.c | 6 ++++++ fs/nilfs2/nilfs.h | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 75cf7fef8987a..7269a7d8bb95c 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -143,6 +143,9 @@ static bool nilfs_check_page(struct page *page) goto Enamelen; if (((offs + rec_len - 1) ^ offs) & ~(chunk_size-1)) goto Espan; + if (unlikely(p->inode && + NILFS_PRIVATE_INODE(le64_to_cpu(p->inode)))) + goto Einumber; } if (offs != limit) goto Eend; @@ -168,6 +171,9 @@ static bool nilfs_check_page(struct page *page) goto bad_entry; Espan: error = "directory entry across blocks"; + goto bad_entry; +Einumber: + error = "disallowed inode number"; bad_entry: nilfs_error(sb, "bad entry in directory #%lu: %s - offset=%lu, inode=%lu, rec_len=%d, name_len=%d", diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h index cefd2cfc7012c..3f3971e0292da 100644 --- a/fs/nilfs2/nilfs.h +++ b/fs/nilfs2/nilfs.h @@ -121,6 +121,11 @@ enum { ((ino) >= NILFS_FIRST_INO(sb) || \ ((ino) < NILFS_USER_INO && (NILFS_SYS_INO_BITS & BIT(ino)))) +#define NILFS_PRIVATE_INODE(ino) ({ \ + ino_t __ino = (ino); \ + ((__ino) < NILFS_USER_INO && (__ino) != NILFS_ROOT_INO && \ + (__ino) != NILFS_SKETCH_INO); }) + /** * struct nilfs_transaction_info: context information for synchronization * @ti_magic: Magic number -- 2.34.1

2 1

[PATCH OLK-6.6] btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
by Yifan Qiao 18 Sep '24

18 Sep '24

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.6.49 commit 51722b99f41f5e722ffa10b8f61e802a0e70b331 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAR4CF CVE: CVE-2024-46687 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10 upstream. [BUG] There is an internal report that KASAN is reporting use-after-free, with the following backtrace: BUG: KASAN: slab-use-after-free in btrfs_check_read_bio+0xa68/0xb70 [btrfs] Read of size 4 at addr ffff8881117cec28 by task kworker/u16:2/45 CPU: 1 UID: 0 PID: 45 Comm: kworker/u16:2 Not tainted 6.11.0-rc2-next-20240805-default+ #76 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] Call Trace: dump_stack_lvl+0x61/0x80 print_address_description.constprop.0+0x5e/0x2f0 print_report+0x118/0x216 kasan_report+0x11d/0x1f0 btrfs_check_read_bio+0xa68/0xb70 [btrfs] process_one_work+0xce0/0x12a0 worker_thread+0x717/0x1250 kthread+0x2e3/0x3c0 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x11/0x20 Allocated by task 20917: kasan_save_stack+0x37/0x60 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x7d/0x80 kmem_cache_alloc_noprof+0x16e/0x3e0 mempool_alloc_noprof+0x12e/0x310 bio_alloc_bioset+0x3f0/0x7a0 btrfs_bio_alloc+0x2e/0x50 [btrfs] submit_extent_page+0x4d1/0xdb0 [btrfs] btrfs_do_readpage+0x8b4/0x12a0 [btrfs] btrfs_readahead+0x29a/0x430 [btrfs] read_pages+0x1a7/0xc60 page_cache_ra_unbounded+0x2ad/0x560 filemap_get_pages+0x629/0xa20 filemap_read+0x335/0xbf0 vfs_read+0x790/0xcb0 ksys_read+0xfd/0x1d0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 20917: kasan_save_stack+0x37/0x60 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x50 __kasan_slab_free+0x4b/0x60 kmem_cache_free+0x214/0x5d0 bio_free+0xed/0x180 end_bbio_data_read+0x1cc/0x580 [btrfs] btrfs_submit_chunk+0x98d/0x1880 [btrfs] btrfs_submit_bio+0x33/0x70 [btrfs] submit_one_bio+0xd4/0x130 [btrfs] submit_extent_page+0x3ea/0xdb0 [btrfs] btrfs_do_readpage+0x8b4/0x12a0 [btrfs] btrfs_readahead+0x29a/0x430 [btrfs] read_pages+0x1a7/0xc60 page_cache_ra_unbounded+0x2ad/0x560 filemap_get_pages+0x629/0xa20 filemap_read+0x335/0xbf0 vfs_read+0x790/0xcb0 ksys_read+0xfd/0x1d0 do_syscall_64+0x6d/0x140 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [CAUSE] Although I cannot reproduce the error, the report itself is good enough to pin down the cause. The call trace is the regular endio workqueue context, but the free-by-task trace is showing that during btrfs_submit_chunk() we already hit a critical error, and is calling btrfs_bio_end_io() to error out. And the original endio function called bio_put() to free the whole bio. This means a double freeing thus causing use-after-free, e.g.: 1. Enter btrfs_submit_bio() with a read bio The read bio length is 128K, crossing two 64K stripes. 2. The first run of btrfs_submit_chunk() 2.1 Call btrfs_map_block(), which returns 64K 2.2 Call btrfs_split_bio() Now there are two bios, one referring to the first 64K, the other referring to the second 64K. 2.3 The first half is submitted. 3. The second run of btrfs_submit_chunk() 3.1 Call btrfs_map_block(), which by somehow failed Now we call btrfs_bio_end_io() to handle the error 3.2 btrfs_bio_end_io() calls the original endio function Which is end_bbio_data_read(), and it calls bio_put() for the original bio. Now the original bio is freed. 4. The submitted first 64K bio finished Now we call into btrfs_check_read_bio() and tries to advance the bio iter. But since the original bio (thus its iter) is already freed, we trigger the above use-after free. And even if the memory is not poisoned/corrupted, we will later call the original endio function, causing a double freeing. [FIX] Instead of calling btrfs_bio_end_io(), call btrfs_orig_bbio_end_io(), which has the extra check on split bios and do the proper refcounting for cloned bios. Furthermore there is already one extra btrfs_cleanup_bio() call, but that is duplicated to btrfs_orig_bbio_end_io() call, so remove that label completely. Reported-by: David Sterba <dsterba(a)suse.com> Fixes: 852eee62d31a ("btrfs: allow btrfs_submit_bio to split bios") CC: stable(a)vger.kernel.org # 6.6+ Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/bio.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c index e47eb248309f..650972895652 100644 --- a/fs/btrfs/bio.c +++ b/fs/btrfs/bio.c @@ -646,7 +646,6 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) { struct btrfs_inode *inode = bbio->inode; struct btrfs_fs_info *fs_info = bbio->fs_info; - struct btrfs_bio *orig_bbio = bbio; struct bio *bio = &bbio->bio; u64 logical = bio->bi_iter.bi_sector << SECTOR_SHIFT; u64 length = bio->bi_iter.bi_size; @@ -682,7 +681,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) bbio->saved_iter = bio->bi_iter; ret = btrfs_lookup_bio_sums(bbio); if (ret) - goto fail_put_bio; + goto fail; } if (btrfs_op(bio) == BTRFS_MAP_WRITE) { @@ -704,13 +703,13 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) ret = btrfs_bio_csum(bbio); if (ret) - goto fail_put_bio; + goto fail; } else if (use_append || (btrfs_is_zoned(fs_info) && inode && inode->flags & BTRFS_INODE_NODATASUM)) { ret = btrfs_alloc_dummy_sum(bbio); if (ret) - goto fail_put_bio; + goto fail; } } @@ -718,12 +717,23 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num) done: return map_length == length; -fail_put_bio: - if (map_length < length) - btrfs_cleanup_bio(bbio); fail: btrfs_bio_counter_dec(fs_info); - btrfs_bio_end_io(orig_bbio, ret); + /* + * We have split the original bbio, now we have to end both the current + * @bbio and remaining one, as the remaining one will never be submitted. + */ + if (map_length < length) { + struct btrfs_bio *remaining = bbio->private; + + ASSERT(bbio->bio.bi_pool == &btrfs_clone_bioset); + ASSERT(remaining); + + remaining->bio.bi_status = ret; + btrfs_orig_bbio_end_io(remaining); + } + bbio->bio.bi_status = ret; + btrfs_orig_bbio_end_io(bbio); /* Do not submit another chunk */ return true; } -- 2.39.2

2 1

openEuler Kernel SIG双周例会
by openEuler conference 18 Sep '24

18 Sep '24

您好！ Kernel 邀请您参加 2024-09-20 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申请，或直接填写至会议纪要看板。）会议链接：https://meeting.huaweicloud.com:36443/#/j/988452631 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-09-20 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申请，或直接填写至会议纪要看板。） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/988452631. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10] fix: fix ethtool version and HINIC3_NIC_DRV_VERSION
by s00851154 18 Sep '24

18 Sep '24

--- hinic3_ethtool.c | 1 - hinic3_nic_dev.h | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/hinic3_ethtool.c b/hinic3_ethtool.c index 2b3561e..696d441 100644 --- a/hinic3_ethtool.c +++ b/hinic3_ethtool.c @@ -45,7 +45,6 @@ static void hinic3_get_drvinfo(struct net_device *netdev, int err; strlcpy(info->driver, HINIC3_NIC_DRV_NAME, sizeof(info->driver)); - strlcpy(info->version, HINIC3_NIC_DRV_VERSION, sizeof(info->version)); strlcpy(info->bus_info, pci_name(pdev), sizeof(info->bus_info)); err = hinic3_get_mgmt_version(nic_dev->hwdev, mgmt_ver, diff --git a/hinic3_nic_dev.h b/hinic3_nic_dev.h index 2967311..5868187 100644 --- a/hinic3_nic_dev.h +++ b/hinic3_nic_dev.h @@ -17,7 +17,7 @@ #include "hinic3_dcb.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "" +#define HINIC3_NIC_DRV_VERSION "1.0.1" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix general protection fault in nilfs_btree_insert()
by Yang Yingliang 18 Sep '24

18 Sep '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.165 commit 712bd74eccb9d3626a0a236641962eca8e11a243 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IALLDY CVE: CVE-2023-52900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7633355e5c7f29c049a9048e461427d1d8ed3051 upstream. If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave. When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete lookup path data, causing the following crash: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] ... RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline] RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline] RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238 Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02 ... Call Trace: <TASK> nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline] nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147 nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101 __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991 __block_write_begin fs/buffer.c:2041 [inline] block_write_begin+0x93/0x1e0 fs/buffer.c:2102 nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900 generic_file_write_iter+0xab/0x310 mm/filemap.c:3932 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK> This patch fixes the root cause of this problem by replacing the error code that __nilfs_btree_get_block() returns on block address conversion failure from -ENOENT to another internal code -EINVAL which means that the b-tree metadata is corrupted. By returning -EINVAL, it propagates without glitches, and for all relevant b-tree operations, functions in the upper bmap layer output an error message indicating corrupted b-tree metadata via nilfs_bmap_convert_error(), and code -EIO will be eventually returned as it should be. Link: https://lkml.kernel.org/r/000000000000bd89e205f0e38355@google.com Link: https://lkml.kernel.org/r/20230105055356.8811-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+ede796cecd5296353515(a)syzkaller.appspotmail.com Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/nilfs2/btree.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c index 270c5422df86..90842645328b 100644 --- a/fs/nilfs2/btree.c +++ b/fs/nilfs2/btree.c @@ -480,9 +480,18 @@ static int __nilfs_btree_get_block(const struct nilfs_bmap *btree, __u64 ptr, ret = nilfs_btnode_submit_block(btnc, ptr, 0, REQ_OP_READ, 0, &bh, &submit_ptr); if (ret) { - if (ret != -EEXIST) - return ret; - goto out_check; + if (likely(ret == -EEXIST)) + goto out_check; + if (ret == -ENOENT) { + /* + * Block address translation failed due to invalid + * value of 'ptr'. In this case, return internal code + * -EINVAL (broken bmap) to notify bmap layer of fatal + * metadata corruption. + */ + ret = -EINVAL; + } + return ret; } if (ra) { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] NFSD: Fix ia_size underflow
by Xia Fukun 18 Sep '24

18 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.221 commit 38d02ba22e43b6fc7d291cf724bc6e3b7be6626b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGCI CVE: CVE-2022-48828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit e6faac3f58c7c4176b66f63def17a34232a17b0e ] iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr(). Cc: stable(a)vger.kernel.org [ cel: context adjusted, 2f221d6f7b88 has not been applied ] Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nfsd/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 31edb883afd0d..7820945e2d075 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -448,6 +448,10 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, .ia_size = iap->ia_size, }; + host_err = -EFBIG; + if (iap->ia_size < 0) + goto out_unlock; + host_err = notify_change(dentry, &size_attr, NULL); if (host_err) goto out_unlock; -- 2.34.1

2 1

[PATCH OLK-5.10] NFSD: Fix ia_size underflow
by Xia Fukun 18 Sep '24

18 Sep '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.221 commit 38d02ba22e43b6fc7d291cf724bc6e3b7be6626b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADGCI CVE: CVE-2022-48828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit e6faac3f58c7c4176b66f63def17a34232a17b0e ] iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is already larger than Linux can handle. Currently decode_fattr4() dumps a full u64 value into ia_size. If that value happens to be larger than S64_MAX, then ia_size underflows. I'm about to fix up the NFSv3 behavior as well, so let's catch the underflow in the common code path: nfsd_setattr(). Cc: stable(a)vger.kernel.org [ cel: context adjusted, 2f221d6f7b88 has not been applied ] Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/nfsd/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 31edb883afd0d..7820945e2d075 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -448,6 +448,10 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, .ia_size = iap->ia_size, }; + host_err = -EFBIG; + if (iap->ia_size < 0) + goto out_unlock; + host_err = notify_change(dentry, &size_attr, NULL); if (host_err) goto out_unlock; -- 2.34.1

2 1

[PATCH OLK-6.6 0/8] support poison recover from migrate folio
by Tong Tiangen 18 Sep '24

18 Sep '24

The folio migration is widely used in kernel, memory compaction, memory hotplug, soft offline page, numa balance, memory demote/promotion, etc, but once access a poisoned source folio when migrating, the kernel will panic. There is a mechanism in the kernel to recover from uncorrectable memory errors, ARCH_HAS_COPY_MC(eg, Machine Check Safe Memory Copy on x86), which is already used in NVDIMM or core-mm paths(eg, CoW, khugepaged, coredump, ksm copy), see copy_mc_to_{user,kernel}, copy_mc_{user_}highpage callers. This series of patches provide the recovery mechanism from folio copy for the widely used folio migration. Please note, because folio migration is no guarantee of success, so we could chose to make folio migration tolerant of memory failures, adding folio_mc_copy() which is a #MC versions of folio_copy(), once accessing a poisoned source folio, we could return error and make the folio migration fail, and this could avoid the similar panic shown below. CPU: 1 PID: 88343 Comm: test_softofflin Kdump: loaded Not tainted 6.6.0 pc : copy_page+0x10/0xc0 lr : copy_highpage+0x38/0x50 ... Call trace: copy_page+0x10/0xc0 folio_copy+0x78/0x90 migrate_folio_extra+0x54/0xa0 move_to_new_folio+0xd8/0x1f0 migrate_folio_move+0xb8/0x300 migrate_pages_batch+0x528/0x788 migrate_pages_sync+0x8c/0x258 migrate_pages+0x440/0x528 soft_offline_in_use_page+0x2ec/0x3c0 soft_offline_page+0x238/0x310 soft_offline_page_store+0x6c/0xc0 dev_attr_store+0x20/0x40 sysfs_kf_write+0x4c/0x68 kernfs_fop_write_iter+0x130/0x1c8 new_sync_write+0xa4/0x138 vfs_write+0x238/0x2d8 ksys_write+0x74/0x110 Kefeng Wang (8): mm: migrate: simplify __buffer_migrate_folio() mm: migrate_device: unify migrate folio for MIGRATE_SYNC_NO_COPY mm: migrate: remove migrate_folio_extra() mm: move memory_failure_queue() into copy_mc_[user]_highpage() mm: add folio_mc_copy() mm: migrate: split folio_migrate_mapping() mm: migrate: support poisoned recover from migrate folio fs: hugetlbfs: support poisoned recover from hugetlbfs_migrate_folio() fs/hugetlbfs/inode.c | 5 +- include/linux/highmem.h | 6 +++ include/linux/migrate.h | 2 - include/linux/mm.h | 1 + mm/ksm.c | 1 - mm/memory.c | 13 ++--- mm/migrate.c | 102 ++++++++++++++++++++-------------------- mm/migrate_device.c | 16 ++++--- mm/util.c | 17 +++++++ 9 files changed, 88 insertions(+), 75 deletions(-) -- 2.25.1

2 9

[openeuler:openEuler-1.0-LTS 20295/23714] drivers/net/bonding/bond_sysctl.c:9:25: sparse: sparse: symbol 'bond_broadcast_arp_or_nd_table_header' was not declared. Should it be static?
by kernel test robot 17 Sep '24

17 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 0397c33121652647d544d4bcdceb9f2d868146af [20295/23714] anolis: bond: broadcast ARP or ND messages to all slaves config: x86_64-randconfig-123-20240915 (https://download.01.org/0day-ci/archive/20240917/202409170243.8clAJD1d-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240917/202409170243.8clAJD1d-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409170243.8clAJD1d-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/bonding/bond_sysctl.c:9:25: sparse: sparse: symbol 'bond_broadcast_arp_or_nd_table_header' was not declared. Should it be static? vim +/bond_broadcast_arp_or_nd_table_header +9 drivers/net/bonding/bond_sysctl.c 8 > 9 struct ctl_table_header *bond_broadcast_arp_or_nd_table_header; 10 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19376/23714] net/ax25/ax25_dev.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 17 Sep '24

17 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 5ba8a3eb026f02aa75f4a22099250bfd4db659cb [19376/23714] ax25: add refcount in ax25_dev to avoid UAF bugs config: x86_64-buildonly-randconfig-005-20240915 (https://download.01.org/0day-ci/archive/20240917/202409170005.Q9skpI8V-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240917/202409170005.Q9skpI8V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409170005.Q9skpI8V-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/ax25/ax25_dev.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 9570/23714] drivers/scsi/scsi_logging.o: warning: objtool: missing symbol for section .text
by kernel test robot 16 Sep '24

16 Sep '24

Hi Bart, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 63b053c4efdb2e27f350bc9c1db4fed08a30801d [9570/23714] scsi: core: Reduce memory required for SCSI logging config: x86_64-buildonly-randconfig-002-20240915 (https://download.01.org/0day-ci/archive/20240916/202409162223.ddty3va3-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162223.ddty3va3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162223.ddty3va3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/scsi/scsi_logging.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17157/23714] drivers/md/bcache/request.c:1333:27: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: cb004e127a5500466043986dbc4cc43ec63d849e [17157/23714] Add traffic policy for low cache available. config: x86_64-randconfig-123-20240915 (https://download.01.org/0day-ci/archive/20240916/202409162232.mD47BzHq-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162232.mD47BzHq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162232.mD47BzHq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/md/bcache/request.c: note: in included file (through drivers/md/bcache/bcache.h): include/uapi/linux/bcache.h:294:38: sparse: sparse: array of flexible structures drivers/md/bcache/request.c: note: in included file (through drivers/md/bcache/bcache.h): drivers/md/bcache/bset.h:231:36: sparse: sparse: array of flexible structures >> drivers/md/bcache/request.c:1333:27: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got struct get_bcache_status * @@ drivers/md/bcache/request.c:1333:27: sparse: expected void [noderef] <asn:1> *to drivers/md/bcache/request.c:1333:27: sparse: got struct get_bcache_status * >> drivers/md/bcache/request.c:1346:33: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got struct set_bcache_status * @@ drivers/md/bcache/request.c:1346:33: sparse: expected void const [noderef] <asn:1> *from drivers/md/bcache/request.c:1346:33: sparse: got struct set_bcache_status * vim +1333 drivers/md/bcache/request.c 1315 1316 static int bcache_get_write_status(struct cached_dev *dc, unsigned long arg) 1317 { 1318 struct get_bcache_status a; 1319 uint64_t cache_sectors; 1320 struct cache_set *c = dc->disk.c; 1321 1322 if (c == NULL) 1323 return -ENODEV; 1324 1325 a.writeback_sector_size_per_sec = dc->writeback_sector_size_per_sec; 1326 a.writeback_io_num_per_sec = dc->writeback_io_num_per_sec; 1327 a.front_io_num_per_sec = dc->front_io_num_per_sec; 1328 cache_sectors = c->nbuckets * c->sb.bucket_size - 1329 atomic_long_read(&c->flash_dev_dirty_sectors); 1330 a.dirty_rate = div64_u64(bcache_dev_sectors_dirty(&dc->disk) * 100, 1331 cache_sectors); 1332 a.available = 100 - c->gc_stats.in_use; > 1333 if (copy_to_user((struct get_bcache_status *)arg, &a, 1334 sizeof(struct get_bcache_status))) 1335 return -EFAULT; 1336 return 0; 1337 } 1338 1339 static int bcache_set_write_status(struct cached_dev *dc, unsigned long arg) 1340 { 1341 struct set_bcache_status a; 1342 struct cache_set *c = dc->disk.c; 1343 1344 if (c == NULL) 1345 return -ENODEV; > 1346 if (copy_from_user(&a, (struct set_bcache_status *)arg, 1347 sizeof(struct set_bcache_status))) 1348 return -EFAULT; 1349 1350 if (c->traffic_policy_start != a.traffic_policy_start) 1351 pr_info("%s traffic policy %s", dc->disk.disk->disk_name, 1352 (a.traffic_policy_start == true) ? "enable" : "disable"); 1353 if (c->force_write_through != a.force_write_through) 1354 pr_info("%s force write through %s", dc->disk.disk->disk_name, 1355 (a.force_write_through == true) ? "enable" : "disable"); 1356 if (a.trigger_gc) { 1357 pr_info("trigger %s gc", dc->disk.disk->disk_name); 1358 atomic_set(&c->sectors_to_gc, -1); 1359 wake_up_gc(c); 1360 } 1361 if ((a.cutoff_writeback_sync >= MIN_CUTOFF_WRITEBACK_SYNC) && 1362 (a.cutoff_writeback_sync <= MAX_CUTOFF_WRITEBACK_SYNC)) { 1363 c->cutoff_writeback_sync = a.cutoff_writeback_sync; 1364 } 1365 1366 dc->max_sector_size = a.write_token_sector_size; 1367 dc->max_io_num = a.write_token_io_num; 1368 c->traffic_policy_start = a.traffic_policy_start; 1369 c->force_write_through = a.force_write_through; 1370 c->gc_sectors = a.gc_sectors; 1371 dc->writeback_state = a.writeback_state; 1372 return 0; 1373 } 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15748/23714] include/linux/uaccess.h:112:17: warning: 'kmask' may be used uninitialized
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: b77633c8236f2383f8d994249b40ed1bd3d012c0 [15748/23714] signal: simplify set_user_sigmask/restore_user_sigmask config: arm64-randconfig-001-20240913 (https://download.01.org/0day-ci/archive/20240916/202409162133.aY7fqmYk-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162133.aY7fqmYk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162133.aY7fqmYk-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): | ^~~~~~~~~~~ In file included from include/asm-generic/termios.h:6, from ./arch/arm64/include/generated/uapi/asm/termios.h:1, from include/uapi/linux/termios.h:6, from include/linux/tty.h:7, from kernel/signal.c:23: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_sigaltstack' at kernel/signal.c:3635:13, inlined from '__se_sys_sigaltstack' at kernel/signal.c:3631:1: include/linux/uaccess.h:112:17: warning: 'new' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/asm-generic/bug.h:5, from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/gfp.h:5, from include/linux/slab.h:15, from kernel/signal.c:13: include/linux/kasan-checks.h: In function '__se_sys_sigaltstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3633:17: note: 'new' declared here 3633 | stack_t new, old; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_compat_sigaltstack' at kernel/signal.c:3678:7: include/linux/uaccess.h:112:17: warning: 'uss32' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'do_compat_sigaltstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3677:32: note: 'uss32' declared here 3677 | compat_stack_t uss32; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_tgsigqueueinfo' at kernel/signal.c:3496:6, inlined from '__se_sys_rt_tgsigqueueinfo' at kernel/signal.c:3491:1: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_tgsigqueueinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3494:19: note: 'info' declared here 3494 | siginfo_t info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigqueueinfo' at kernel/signal.c:3454:6, inlined from '__se_sys_rt_sigqueueinfo' at kernel/signal.c:3450:1: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigqueueinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3453:19: note: 'info' declared here 3453 | siginfo_t info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_sigprocmask' at kernel/signal.c:3783:7, inlined from '__se_sys_sigprocmask' at kernel/signal.c:3774:1: include/linux/uaccess.h:112:17: warning: 'new_set' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_sigprocmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3777:31: note: 'new_set' declared here 3777 | old_sigset_t old_set, new_set; | ^~~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigprocmask' at kernel/signal.c:2887:7, inlined from '__se_sys_rt_sigprocmask' at kernel/signal.c:2874:1: include/linux/uaccess.h:112:17: warning: 'new_set' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigprocmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:2877:27: note: 'new_set' declared here 2877 | sigset_t old_set, new_set; | ^~~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'set_user_sigmask' at kernel/signal.c:2836:6: >> include/linux/uaccess.h:112:17: warning: 'kmask' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'set_user_sigmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:2830:18: note: 'kmask' declared here 2830 | sigset_t kmask; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigtimedwait' at kernel/signal.c:3281:6, inlined from '__se_sys_rt_sigtimedwait' at kernel/signal.c:3268:1: include/linux/uaccess.h:112:17: warning: 'these' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigtimedwait': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3272:18: note: 'these' declared here 3272 | sigset_t these; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'copy_siginfo_from_user32' at kernel/signal.c:3125:6: include/linux/uaccess.h:112:17: warning: 'from' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'copy_siginfo_from_user32': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3123:31: note: 'from' declared here 3123 | struct compat_siginfo from; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigaction' at kernel/signal.c:3834:13, inlined from '__se_sys_rt_sigaction' at kernel/signal.c:3822:1: include/linux/uaccess.h:112:17: warning: 'new_sa' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigaction': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3827:28: note: 'new_sa' declared here 3827 | struct k_sigaction new_sa, old_sa; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'restore_altstack' at kernel/signal.c:3648:6: include/linux/uaccess.h:112:17: warning: 'new' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'restore_altstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3647:17: note: 'new' declared here 3647 | stack_t new; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigsuspend' at kernel/signal.c:4053:6, inlined from '__se_sys_rt_sigsuspend' at kernel/signal.c:4045:1, inlined from '__arm64_sys_rt_sigsuspend' at kernel/signal.c:4045:1: include/linux/uaccess.h:112:17: warning: 'newset' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__arm64_sys_rt_sigsuspend': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:4047:18: note: 'newset' declared here 4047 | sigset_t newset; | ^~~~~~ vim +/kmask +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 16693/23714] arch/x86/kernel/unwind_orc.o: warning: objtool: missing symbol for section .text
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: badd79c400ed404df871e1d035bed971d20ead4c [16693/23714] x86/unwind/orc: Remove boot-time ORC unwind tables sorting config: x86_64-buildonly-randconfig-005-20240915 (https://download.01.org/0day-ci/archive/20240916/202409162123.h3UocbtQ-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409162123.h3UocbtQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409162123.h3UocbtQ-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/unwind_orc.c:179:13: warning: unused function 'orc_sort_swap' [-Wunused-function] 179 | static void orc_sort_swap(void *_a, void *_b, int size) | ^~~~~~~~~~~~~ arch/x86/kernel/unwind_orc.c:199:12: warning: unused function 'orc_sort_cmp' [-Wunused-function] 199 | static int orc_sort_cmp(const void *_a, const void *_b) | ^~~~~~~~~~~~ 2 warnings generated. >> arch/x86/kernel/unwind_orc.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15692/23714] include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized
by kernel test robot 16 Sep '24

16 Sep '24

Hi Jens, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 6c08191286995b0594d2ecf12fe7fca3cea1a5ca [15692/23714] io_uring: add support for pre-mapped user IO buffers config: arm64-randconfig-001-20240913 (https://download.01.org/0day-ci/archive/20240916/202409161843.Wdlfbwor-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161843.Wdlfbwor-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161843.Wdlfbwor-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/linux/poll.h:12, from include/linux/ring_buffer.h:7, from include/linux/trace_events.h:6, from include/trace/syscall.h:7, from include/linux/syscalls.h:86, from fs/io_uring.c:32: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_copy_iov.isra' at fs/io_uring.c:1457:7: >> include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/export.h:45, from include/linux/linkage.h:7, from include/linux/kernel.h:7, from fs/io_uring.c:29: include/linux/kasan-checks.h: In function 'io_copy_iov.isra': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/io_uring.c:1454:37: note: 'ciov' declared here 1454 | struct compat_iovec ciov; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_uring_setup' at fs/io_uring.c:1960:6: include/linux/uaccess.h:112:17: warning: 'p' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'io_uring_setup': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/io_uring.c:1956:32: note: 'p' declared here 1956 | struct io_uring_params p; | ^ In file included from include/linux/uaccess.h:11: In function 'set_fs', inlined from 'io_sq_wq_submit_work' at fs/io_uring.c:1114:3: arch/arm64/include/asm/uaccess.h:59:12: warning: 'old_fs' may be used uninitialized [-Wmaybe-uninitialized] 59 | if (IS_ENABLED(CONFIG_ARM64_UAO) && fs == KERNEL_DS) | ^ fs/io_uring.c: In function 'io_sq_wq_submit_work': fs/io_uring.c:1074:22: note: 'old_fs' was declared here 1074 | mm_segment_t old_fs; | ^~~~~~ vim +/ciov +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 8359/23714] fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 484798bc8218ce6a0f8269675897b870a12c49e2 [8359/23714] gfs2: gfs2_walk_metadata fix config: x86_64-buildonly-randconfig-006-20240915 (https://download.01.org/0day-ci/archive/20240916/202409161757.QAy2sdT1-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161757.QAy2sdT1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161757.QAy2sdT1-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): fs/gfs2/bmap.c: In function 'gfs2_iomap_alloc': fs/gfs2/bmap.c:748:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 748 | if (n == 0) | ^ fs/gfs2/bmap.c:751:17: note: here 751 | case ALLOC_GROW_DEPTH: | ^~~~ fs/gfs2/bmap.c:759:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 759 | if (n == 0) | ^ fs/gfs2/bmap.c:762:17: note: here 762 | case ALLOC_DATA: | ^~~~ fs/gfs2/bmap.c: In function 'gfs2_iomap_get': >> fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:851:18: note: 'lblock' was declared here 851 | sector_t lblock; | ^~~~~~ fs/gfs2/bmap.c:960:31: warning: 'len' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:855:13: note: 'len' was declared here 855 | u64 len; | ^~~ fs/gfs2/bmap.c:959:32: warning: 'height' may be used uninitialized [-Wmaybe-uninitialized] 959 | if (pos < size && height == ip->i_height) | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:857:12: note: 'height' was declared here 857 | u8 height; | ^~~~~~ fs/gfs2/bmap.c:1290: warning: Function parameter or member 'inode' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'from' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'length' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1493: warning: Function parameter or member 'rd_gh' not described in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1493: warning: Excess function parameter 'rg_gh' description in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'sdp' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_list' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_aligned' not described in 'find_nonnull_ptr' vim +/lblock +960 fs/gfs2/bmap.c 7ee66c03e40a57 Christoph Hellwig 2018-06-01 831 3974320ca6aa68 Bob Peterson 2017-02-16 832 /** 628e366df11c0a Andreas Gruenbacher 2018-06-04 833 * gfs2_iomap_get - Map blocks from an inode to disk blocks 3974320ca6aa68 Bob Peterson 2017-02-16 834 * @inode: The inode 3974320ca6aa68 Bob Peterson 2017-02-16 835 * @pos: Starting position in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 836 * @length: Length to map, in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 837 * @flags: iomap flags 3974320ca6aa68 Bob Peterson 2017-02-16 838 * @iomap: The iomap structure 628e366df11c0a Andreas Gruenbacher 2018-06-04 839 * @mp: The metapath 3974320ca6aa68 Bob Peterson 2017-02-16 840 * 3974320ca6aa68 Bob Peterson 2017-02-16 841 * Returns: errno 3974320ca6aa68 Bob Peterson 2017-02-16 842 */ 628e366df11c0a Andreas Gruenbacher 2018-06-04 843 static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, 628e366df11c0a Andreas Gruenbacher 2018-06-04 844 unsigned flags, struct iomap *iomap, 628e366df11c0a Andreas Gruenbacher 2018-06-04 845 struct metapath *mp) b3b94faa5fe596 David Teigland 2006-01-16 846 { feaa7bba026c18 Steven Whitehouse 2006-06-14 847 struct gfs2_inode *ip = GFS2_I(inode); feaa7bba026c18 Steven Whitehouse 2006-06-14 848 struct gfs2_sbd *sdp = GFS2_SB(inode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 849 loff_t size = i_size_read(inode); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 850 __be64 *ptr; 3974320ca6aa68 Bob Peterson 2017-02-16 851 sector_t lblock; 628e366df11c0a Andreas Gruenbacher 2018-06-04 852 sector_t lblock_stop; 628e366df11c0a Andreas Gruenbacher 2018-06-04 853 int ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 854 int eob; 628e366df11c0a Andreas Gruenbacher 2018-06-04 855 u64 len; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 856 struct buffer_head *dibh = NULL, *bh; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 857 u8 height; 7276b3b0c77101 Steven Whitehouse 2006-09-21 858 628e366df11c0a Andreas Gruenbacher 2018-06-04 859 if (!length) 628e366df11c0a Andreas Gruenbacher 2018-06-04 860 return -EINVAL; b3b94faa5fe596 David Teigland 2006-01-16 861 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 862 down_read(&ip->i_rw_mutex); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 863 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 864 ret = gfs2_meta_inode_buffer(ip, &dibh); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 865 if (ret) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 866 goto unlock; 38084377af4fc8 Andreas Gruenbacher 2018-11-11 867 mp->mp_bh[0] = dibh; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 868 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 869 if (gfs2_is_stuffed(ip)) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 870 if (flags & IOMAP_WRITE) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 871 loff_t max_size = gfs2_max_stuffed_size(ip); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 872 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 873 if (pos + length > max_size) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 874 goto unstuff; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 875 iomap->length = max_size; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 876 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 877 if (pos >= size) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 878 if (flags & IOMAP_REPORT) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 879 ret = -ENOENT; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 880 goto unlock; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 881 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 882 /* report a hole */ d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 883 iomap->offset = pos; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 884 iomap->length = length; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 885 goto do_alloc; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 886 } 3974320ca6aa68 Bob Peterson 2017-02-16 887 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 888 iomap->length = size; 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 889 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 890 iomap->addr = (ip->i_no_addr << inode->i_blkbits) + d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 891 sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 892 iomap->type = IOMAP_INLINE; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 893 iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 894 goto out; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 895 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 896 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 897 unstuff: 3974320ca6aa68 Bob Peterson 2017-02-16 898 lblock = pos >> inode->i_blkbits; 3974320ca6aa68 Bob Peterson 2017-02-16 899 iomap->offset = lblock << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 900 lblock_stop = (pos + length - 1) >> inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 901 len = lblock_stop - lblock + 1; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 902 iomap->length = len << inode->i_blkbits; 20cdc1931ee8e0 Andreas Gruenbacher 2017-09-22 903 9b8c81d1de4994 Steven Whitehouse 2008-02-22 904 height = ip->i_height; 9a38662ba4e268 Andreas Gruenbacher 2018-04-16 905 while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height]) ecc30c79157103 Steven Whitehouse 2008-01-28 906 height++; 628e366df11c0a Andreas Gruenbacher 2018-06-04 907 find_metapath(sdp, lblock, mp, height); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 908 if (height > ip->i_height || gfs2_is_stuffed(ip)) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 909 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 910 628e366df11c0a Andreas Gruenbacher 2018-06-04 911 ret = lookup_metapath(ip, mp); e8b43fe0c1e035 Andreas Gruenbacher 2017-12-08 912 if (ret) 628e366df11c0a Andreas Gruenbacher 2018-06-04 913 goto unlock; 3974320ca6aa68 Bob Peterson 2017-02-16 914 628e366df11c0a Andreas Gruenbacher 2018-06-04 915 if (mp->mp_aheight != ip->i_height) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 916 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 917 628e366df11c0a Andreas Gruenbacher 2018-06-04 918 ptr = metapointer(ip->i_height - 1, mp); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 919 if (*ptr == 0) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 920 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 921 628e366df11c0a Andreas Gruenbacher 2018-06-04 922 bh = mp->mp_bh[ip->i_height - 1]; bcfe94139a45fa Andreas Gruenbacher 2018-05-11 923 len = gfs2_extent_length(bh, ptr, len, &eob); 3974320ca6aa68 Bob Peterson 2017-02-16 924 628e366df11c0a Andreas Gruenbacher 2018-06-04 925 iomap->addr = be64_to_cpu(*ptr) << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 926 iomap->length = len << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 927 iomap->type = IOMAP_MAPPED; 0ed91eca1130e6 Andreas Gruenbacher 2018-07-25 928 iomap->flags |= IOMAP_F_MERGED; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 929 if (eob) 7ee66c03e40a57 Christoph Hellwig 2018-06-01 930 iomap->flags |= IOMAP_F_GFS2_BOUNDARY; 3974320ca6aa68 Bob Peterson 2017-02-16 931 3974320ca6aa68 Bob Peterson 2017-02-16 932 out: 628e366df11c0a Andreas Gruenbacher 2018-06-04 933 iomap->bdev = inode->i_sb->s_bdev; 628e366df11c0a Andreas Gruenbacher 2018-06-04 934 unlock: 628e366df11c0a Andreas Gruenbacher 2018-06-04 935 up_read(&ip->i_rw_mutex); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 936 return ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 937 9b8c81d1de4994 Steven Whitehouse 2008-02-22 938 do_alloc: 628e366df11c0a Andreas Gruenbacher 2018-06-04 939 iomap->addr = IOMAP_NULL_ADDR; 628e366df11c0a Andreas Gruenbacher 2018-06-04 940 iomap->type = IOMAP_HOLE; 628e366df11c0a Andreas Gruenbacher 2018-06-04 941 if (flags & IOMAP_REPORT) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 942 if (pos >= size) 3974320ca6aa68 Bob Peterson 2017-02-16 943 ret = -ENOENT; 628e366df11c0a Andreas Gruenbacher 2018-06-04 944 else if (height == ip->i_height) 628e366df11c0a Andreas Gruenbacher 2018-06-04 945 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 946 else 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 947 iomap->length = size - pos; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 948 } else if (flags & IOMAP_WRITE) { 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 949 u64 alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 950 967bcc91b04493 Andreas Gruenbacher 2018-06-19 951 if (flags & IOMAP_DIRECT) 967bcc91b04493 Andreas Gruenbacher 2018-06-19 952 goto out; /* (see gfs2_file_direct_write) */ 967bcc91b04493 Andreas Gruenbacher 2018-06-19 953 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 954 len = gfs2_alloc_size(inode, mp, len); 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 955 alloc_size = len << inode->i_blkbits; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 956 if (alloc_size < iomap->length) 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 957 iomap->length = alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 958 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 959 if (pos < size && height == ip->i_height) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 @960 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 3974320ca6aa68 Bob Peterson 2017-02-16 961 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 962 goto out; 628e366df11c0a Andreas Gruenbacher 2018-06-04 963 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 964 :::::: The code at line 960 was first introduced by commit :::::: d505a96a3b16f46455035dc0296bc2da6014e163 gfs2: Further iomap cleanups :::::: TO: Andreas Gruenbacher <agruenba(a)redhat.com> :::::: CC: Andreas Gruenbacher <agruenba(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 16489/23714] drivers/md/bcache/acache.c:29:5: sparse: sparse: symbol 'acache_prefetch_workers' was not declared. Should it be static?
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 1c09f1b02db96b8277226cbe64fe5bbd185a7149 [16489/23714] bcache: add a framework to perform prefetch config: x86_64-randconfig-123-20240915 (https://download.01.org/0day-ci/archive/20240916/202409161647.o9SQbpWe-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161647.o9SQbpWe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161647.o9SQbpWe-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/md/bcache/acache.c:29:5: sparse: sparse: symbol 'acache_prefetch_workers' was not declared. Should it be static? >> drivers/md/bcache/acache.c:65:5: sparse: sparse: symbol 'acache_open' was not declared. Should it be static? >> drivers/md/bcache/acache.c:83:5: sparse: sparse: symbol 'acache_release' was not declared. Should it be static? >> drivers/md/bcache/acache.c:89:9: sparse: sparse: symbol 'read_circ_slice' was not declared. Should it be static? >> drivers/md/bcache/acache.c:224:6: sparse: sparse: symbol 'init_acache_circ' was not declared. Should it be static? >> drivers/md/bcache/acache.c:253:5: sparse: sparse: symbol 'acache_prefetch_init' was not declared. Should it be static? >> drivers/md/bcache/acache.c:401:19: sparse: sparse: symbol 'get_cached_device_by_dev' was not declared. Should it be static? >> drivers/md/bcache/acache.c:414:12: sparse: sparse: symbol 'get_bio_by_item' was not declared. Should it be static? drivers/md/bcache/acache.c:65:5: warning: no previous prototype for 'acache_open' [-Wmissing-prototypes] 65 | int acache_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ drivers/md/bcache/acache.c:83:5: warning: no previous prototype for 'acache_release' [-Wmissing-prototypes] 83 | int acache_release(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~~~ drivers/md/bcache/acache.c:89:9: warning: no previous prototype for 'read_circ_slice' [-Wmissing-prototypes] 89 | ssize_t read_circ_slice(struct acache_circ *circ, struct acache_info *buf, | ^~~~~~~~~~~~~~~ drivers/md/bcache/acache.c:224:6: warning: no previous prototype for 'init_acache_circ' [-Wmissing-prototypes] 224 | void init_acache_circ(struct acache_circ **circ, void *startaddr) | ^~~~~~~~~~~~~~~~ drivers/md/bcache/acache.c:253:5: warning: no previous prototype for 'acache_prefetch_init' [-Wmissing-prototypes] 253 | int acache_prefetch_init(struct acache_device *adev) | ^~~~~~~~~~~~~~~~~~~~ drivers/md/bcache/acache.c:401:20: warning: no previous prototype for 'get_cached_device_by_dev' [-Wmissing-prototypes] 401 | struct cached_dev *get_cached_device_by_dev(dev_t dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/md/bcache/acache.c:414:13: warning: no previous prototype for 'get_bio_by_item' [-Wmissing-prototypes] 414 | struct bio *get_bio_by_item(struct cached_dev *dc, struct acache_info *item) | ^~~~~~~~~~~~~~~ vim +/acache_prefetch_workers +29 drivers/md/bcache/acache.c 28 > 29 int acache_prefetch_workers = 1000; 30 31 module_param_named(prefetch_workers, acache_prefetch_workers, int, 0444); 32 MODULE_PARM_DESC(prefetch_workers, "num of workers for processing prefetch requests"); 33 34 struct prefetch_worker { 35 struct acache_info s; 36 struct work_struct work; 37 struct list_head list; 38 }; 39 40 struct acache_device { 41 bool initialized; 42 43 dev_t devno; 44 struct cdev cdev; 45 struct class *class; 46 struct mem_reg *mem_regionp; 47 48 struct acache_info *readbuf; 49 struct acache_info *writebuf; 50 51 struct acache_circ *acache_info_circ; 52 53 struct workqueue_struct *wq; 54 struct prefetch_worker *prefetch_workers; 55 struct list_head prefetch_workers_free; 56 spinlock_t prefetch_workers_free_list_lock; 57 } adev; 58 59 #define MAX_TRANSFER_SIZE (1024 * 1024) 60 61 static atomic_t acache_opened_dev = ATOMIC_INIT(0); 62 static struct acache_metadata metadata; 63 64 > 65 int acache_open(struct inode *inode, struct file *filp) 66 { 67 struct mem_reg *dev; 68 69 int minor = MINOR(inode->i_rdev); 70 71 if (minor >= ACACHE_NR_DEVS) 72 return -ENODEV; 73 if (atomic_xchg(&acache_opened_dev, 1)) 74 return -EPERM; 75 76 dev = &adev.mem_regionp[minor]; 77 78 filp->private_data = dev; 79 80 return 0; 81 } 82 > 83 int acache_release(struct inode *inode, struct file *filp) 84 { 85 atomic_dec(&acache_opened_dev); 86 return 0; 87 } 88 > 89 ssize_t read_circ_slice(struct acache_circ *circ, struct acache_info *buf, 90 size_t size) 91 { 92 unsigned long first, todo, flags; 93 94 spin_lock_irqsave(&circ->lock, flags); 95 96 todo = CIRC_CNT(circ->head, circ->tail, circ->size); 97 if (todo == 0) { 98 spin_unlock_irqrestore(&circ->lock, flags); 99 return 0; 100 } 101 if (todo > size / sizeof(struct acache_info)) 102 todo = size / sizeof(struct acache_info); 103 104 first = CIRC_CNT_TO_END(circ->head, circ->tail, circ->size); 105 if (first > todo) 106 first = todo; 107 108 memcpy(buf, circ->data + circ->tail, first * sizeof(struct acache_info)); 109 if (first < todo) 110 memcpy(buf + first, circ->data, 111 (todo - first) * sizeof(struct acache_info)); 112 circ->tail = (circ->tail + todo) & (circ->size - 1); 113 114 spin_unlock_irqrestore(&circ->lock, flags); 115 return todo * sizeof(struct acache_info); 116 } 117 118 static ssize_t acache_read(struct file *filp, char __user *buf, 119 size_t size, loff_t *ppos) 120 { 121 long ret, cut; 122 123 if (metadata.conntype != ACACHE_READWRITE_CONN) 124 return -EINVAL; 125 126 if (size > MAX_TRANSFER_SIZE) 127 size = MAX_TRANSFER_SIZE; 128 129 ret = read_circ_slice(adev.acache_info_circ, adev.readbuf, size); 130 if (ret <= 0) 131 return ret; 132 133 cut = copy_to_user(buf, adev.readbuf, size); 134 return ret - cut; 135 } 136 137 int process_one_request(struct acache_info *item); 138 static void prefetch_worker_func(struct work_struct *work) 139 { 140 struct prefetch_worker *sw = 141 container_of(work, struct prefetch_worker, work); 142 143 process_one_request(&sw->s); 144 spin_lock(&adev.prefetch_workers_free_list_lock); 145 list_add_tail(&sw->list, &adev.prefetch_workers_free); 146 spin_unlock(&adev.prefetch_workers_free_list_lock); 147 } 148 149 static int queue_prefetch_item(struct acache_info *s) 150 { 151 struct prefetch_worker *sw; 152 153 spin_lock(&adev.prefetch_workers_free_list_lock); 154 sw = list_first_entry_or_null(&adev.prefetch_workers_free, 155 struct prefetch_worker, list); 156 if (!sw) { 157 spin_unlock(&adev.prefetch_workers_free_list_lock); 158 return -1; 159 } 160 list_del_init(&sw->list); 161 spin_unlock(&adev.prefetch_workers_free_list_lock); 162 163 memcpy(&sw->s, s, sizeof(struct acache_info)); 164 INIT_WORK(&sw->work, prefetch_worker_func); 165 queue_work(adev.wq, &sw->work); 166 return 0; 167 } 168 169 static ssize_t acache_write(struct file *filp, const char __user *buf, 170 size_t size, loff_t *ppos) 171 { 172 long cut; 173 int i; 174 175 if (metadata.conntype != ACACHE_READWRITE_CONN) 176 return -EINVAL; 177 178 if (size > MAX_TRANSFER_SIZE) 179 size = MAX_TRANSFER_SIZE; 180 181 cut = copy_from_user(adev.writebuf, buf, size); 182 for (i = 0; i < (size - cut) / sizeof(struct acache_info); i++) { 183 if (queue_prefetch_item(adev.writebuf + i)) 184 break; 185 } 186 return i * sizeof(struct acache_info); 187 } 188 189 static long acache_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 190 { 191 switch (cmd) { 192 case ACACHE_GET_METADATA: 193 return copy_to_user((struct acache_metadata __user *)arg, 194 &metadata, sizeof(struct acache_metadata)); 195 default: 196 return -EINVAL; 197 } 198 } 199 200 static const struct file_operations acache_fops = { 201 .owner = THIS_MODULE, 202 .read = acache_read, 203 .write = acache_write, 204 .open = acache_open, 205 .release = acache_release, 206 .unlocked_ioctl = acache_ioctl, 207 }; 208 209 void save_circ_item(struct acache_info *data) 210 { 211 unsigned long flags; 212 struct acache_circ *circ = adev.acache_info_circ; 213 214 spin_lock_irqsave(&circ->lock, flags); 215 if (CIRC_SPACE(circ->head, circ->tail, circ->size) >= 1) { 216 memcpy(&circ->data[circ->head], data, sizeof(struct acache_info)); 217 circ->head = (circ->head + 1) & (circ->size - 1); 218 } else { 219 pr_debug("ringbuffer is full; discard new request."); 220 } 221 spin_unlock_irqrestore(&circ->lock, flags); 222 } 223 > 224 void init_acache_circ(struct acache_circ **circ, void *startaddr) 225 { 226 *circ = (struct acache_circ *)startaddr; 227 (*circ)->head = 0; 228 (*circ)->tail = 0; 229 (*circ)->size = ACACHE_CIRC_SIZE; 230 spin_lock_init(&(*circ)->lock); 231 } 232 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 15686/23714] include/linux/uaccess.h:112:17: warning: 'p' may be used uninitialized
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: a2491968ab51323208d2d1a4d4b28325886d41b8 [15686/23714] Add io_uring IO interface config: arm64-randconfig-001-20240913 (https://download.01.org/0day-ci/archive/20240916/202409161422.WtkE4KWn-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161422.WtkE4KWn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161422.WtkE4KWn-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/linux/poll.h:12, from include/linux/ring_buffer.h:7, from include/linux/trace_events.h:6, from include/trace/syscall.h:7, from include/linux/syscalls.h:86, from fs/io_uring.c:31: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_uring_setup' at fs/io_uring.c:1224:6: >> include/linux/uaccess.h:112:17: warning: 'p' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/export.h:45, from include/linux/linkage.h:7, from include/linux/kernel.h:7, from fs/io_uring.c:28: include/linux/kasan-checks.h: In function 'io_uring_setup': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/io_uring.c:1220:32: note: 'p' declared here 1220 | struct io_uring_params p; | ^ vim +/p +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17815/23714] drivers/edac/skx_common.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 3b7ad71a0a415eb51fb41ddc01ef538a7e163de4 [17815/23714] Intel: EDAC, i10nm: Add a driver for Intel 10nm server processors config: x86_64-buildonly-randconfig-001-20240915 (https://download.01.org/0day-ci/archive/20240916/202409161418.IlepWryM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161418.IlepWryM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161418.IlepWryM-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/edac/skx_common.c: In function 'skx_mce_output_error': drivers/edac/skx_common.c:470:15: warning: variable 'type' set but not used [-Wunused-but-set-variable] 470 | char *type, *optype; | ^~~~ drivers/edac/skx_common.c: In function 'skx_get_dimm_info': drivers/edac/skx_common.c:309:79: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=] 309 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~ drivers/edac/skx_common.c:309:52: note: using the range [0, 4294967295] for directive argument 309 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c:309:9: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32 309 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 310 | imc->src_id, imc->lmc, chan, dimmno); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c: In function 'skx_get_nvdimm_info': drivers/edac/skx_common.c:357:79: warning: '_DIMM#' directive output may be truncated writing 6 bytes into a region of size between 0 and 9 [-Wformat-truncation=] 357 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~ drivers/edac/skx_common.c:357:52: note: using the range [0, 4294967295] for directive argument 357 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/edac/skx_common.c:357:9: note: 'snprintf' output between 31 and 53 bytes into a destination of size 32 357 | snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 358 | imc->src_id, imc->lmc, chan, dimmno); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/edac/skx_common.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 2962/23714] fs/pstore/inode.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 16 Sep '24

16 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 37aeb7e817053fbf532b214aa02858b3c23af0b1 commit: 68bc9e8812a24c4a04fd18a9e1ede123eaff0420 [2962/23714] pstore: Centralize init/exit routines config: x86_64-buildonly-randconfig-006-20240915 (https://download.01.org/0day-ci/archive/20240916/202409161416.tZCUlfeW-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240916/202409161416.tZCUlfeW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409161416.tZCUlfeW-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/pstore/inode.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0