- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] dyndbg: fix old BUG_ON in >control parser
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Jim Cromie <jim.cromie(a)gmail.com> stable inclusion from stable-v5.10.217 commit 41d8ac238ab1cab01a8c71798d61903304f4e79b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGMG CVE: CVE-2024-35947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 00e7d3bea2ce7dac7bee1cf501fb071fd0ea8f6c upstream. Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead. Cc: stable <stable(a)kernel.org> Signed-off-by: Jim Cromie <jim.cromie(a)gmail.com> Link: https://lore.kernel.org/r/20240429193145.66543-2-jim.cromie@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- lib/dynamic_debug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c index 10a50c03074e..685cf3e6771d 100644 --- a/lib/dynamic_debug.c +++ b/lib/dynamic_debug.c @@ -260,7 +260,11 @@ static int ddebug_tokenize(char *buf, char *words[], int maxwords) } else { for (end = buf; *end && !isspace(*end); end++) ; - BUG_ON(end == buf); + if (end == buf) { + pr_err("parse err after word:%d=%s\n", nwords, + nwords ? words[nwords - 1] : "<none>"); + return -EINVAL; + } } /* `buf' is start of word, `end' is one past its end */ -- 2.17.1

2 1

[PATCH OLK-5.10] dyndbg: fix old BUG_ON in >control parser
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Jim Cromie <jim.cromie(a)gmail.com> stable inclusion from stable-v5.10.217 commit 41d8ac238ab1cab01a8c71798d61903304f4e79b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGMG CVE: CVE-2024-35947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 00e7d3bea2ce7dac7bee1cf501fb071fd0ea8f6c upstream. Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead. Cc: stable <stable(a)kernel.org> Signed-off-by: Jim Cromie <jim.cromie(a)gmail.com> Link: https://lore.kernel.org/r/20240429193145.66543-2-jim.cromie@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- lib/dynamic_debug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c index 10a50c03074e..685cf3e6771d 100644 --- a/lib/dynamic_debug.c +++ b/lib/dynamic_debug.c @@ -260,7 +260,11 @@ static int ddebug_tokenize(char *buf, char *words[], int maxwords) } else { for (end = buf; *end && !isspace(*end); end++) ; - BUG_ON(end == buf); + if (end == buf) { + pr_err("parse err after word:%d=%s\n", nwords, + nwords ? words[nwords - 1] : "<none>"); + return -EINVAL; + } } /* `buf' is start of word, `end' is one past its end */ -- 2.17.1

2 1

[PATCH OLK-5.10] ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.212 commit 810fa7d5e5202fcfb22720304b755f1bdfd4c174 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8NB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10bfd453da64a057bcfd1a49fb6b271c48653cdb ] It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount. Fixes: 6ecf4c37eb3e ("ipv6: enable IFA_TARGET_NETNSID for RTM_GETADDR") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Christian Brauner <brauner(a)kernel.org> Cc: David Ahern <dsahern(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv6/addrconf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5e42149b954f..e4e2656b5ccb 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -5443,9 +5443,10 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh, } addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer); - if (!addr) - return -EINVAL; - + if (!addr) { + err = -EINVAL; + goto errout; + } ifm = nlmsg_data(nlh); if (ifm->ifa_index) dev = dev_get_by_index(tgt_net, ifm->ifa_index); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.212 commit 810fa7d5e5202fcfb22720304b755f1bdfd4c174 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8NB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10bfd453da64a057bcfd1a49fb6b271c48653cdb ] It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount. Fixes: 6ecf4c37eb3e ("ipv6: enable IFA_TARGET_NETNSID for RTM_GETADDR") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Christian Brauner <brauner(a)kernel.org> Cc: David Ahern <dsahern(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv6/addrconf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index a2bdefcd2b30..1d9efa737dd9 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -5414,9 +5414,10 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh, } addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer); - if (!addr) - return -EINVAL; - + if (!addr) { + err = -EINVAL; + goto errout; + } ifm = nlmsg_data(nlh); if (ifm->ifa_index) dev = dev_get_by_index(tgt_net, ifm->ifa_index); -- 2.17.1

2 1

[PATCH OLK-5.10] init/main.c: Fix potential static_command_line memory overflow
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Yuntao Wang <ytcoode(a)gmail.com> stable inclusion from stable-v5.10.216 commit 2ef607ea103616aec0289f1b65d103d499fa903a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5HF CVE: CVE-2024-26988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 46dad3c1e57897ab9228332f03e1c14798d2d3b9 upstream. We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line. When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow. This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()") Link: https://lore.kernel.org/all/20240412081733.35925-2-ytcoode@gmail.com/ Fixes: f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()") Cc: stable(a)vger.kernel.org Signed-off-by: Yuntao Wang <ytcoode(a)gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- init/main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/init/main.c b/init/main.c index f06fbe79a84a..2b466bd04110 100644 --- a/init/main.c +++ b/init/main.c @@ -631,6 +631,8 @@ static void __init setup_command_line(char *command_line) if (!saved_command_line) panic("%s: Failed to allocate %zu bytes\n", __func__, len + ilen); + len = xlen + strlen(command_line) + 1; + static_command_line = memblock_alloc(len, SMP_CACHE_BYTES); if (!static_command_line) panic("%s: Failed to allocate %zu bytes\n", __func__, len); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] init/main.c: Fix potential static_command_line memory overflow
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Yuntao Wang <ytcoode(a)gmail.com> stable inclusion from stable-v5.10.216 commit 2ef607ea103616aec0289f1b65d103d499fa903a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5HF CVE: CVE-2024-26988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 46dad3c1e57897ab9228332f03e1c14798d2d3b9 upstream. We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line. When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow. This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()") Link: https://lore.kernel.org/all/20240412081733.35925-2-ytcoode@gmail.com/ Fixes: f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()") Cc: stable(a)vger.kernel.org Signed-off-by: Yuntao Wang <ytcoode(a)gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- init/main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/init/main.c b/init/main.c index 21b65f18ba83..31f01f926329 100644 --- a/init/main.c +++ b/init/main.c @@ -633,6 +633,8 @@ static void __init setup_command_line(char *command_line) if (!saved_command_line) panic("%s: Failed to allocate %zu bytes\n", __func__, len + ilen); + len = xlen + strlen(command_line) + 1; + static_command_line = memblock_alloc(len, SMP_CACHE_BYTES); if (!static_command_line) panic("%s: Failed to allocate %zu bytes\n", __func__, len); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] scsi: core: Fix unremoved procfs host directory regression
by Guo Mengqi 19 Jun '24

19 Jun '24

From: "Guilherme G. Piccoli" <gpiccoli(a)igalia.com> stable inclusion from stable-v5.10.215 commit 5c2386ba80e779a92ec3bb64ccadbedd88f779b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5HN CVE: CVE-2024-26935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f23a4d6e07570826fe95023ca1aa96a011fa9f84 upstream. Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unloading, by adding a call to scsi_proc_hostdir_rm() on scsi_remove_host(). But that led to a potential duplicate call to the hostdir_rm() routine, since it's also called from scsi_host_dev_release(). That triggered a regression report, which was then fixed by commit be03df3d4bfe ("scsi: core: Fix a procfs host directory removal regression"). The fix just dropped the hostdir_rm() call from dev_release(). But it happens that this proc directory is created on scsi_host_alloc(), and that function "pairs" with scsi_host_dev_release(), while scsi_remove_host() pairs with scsi_add_host(). In other words, it seems the reason for removing the proc directory on dev_release() was meant to cover cases in which a SCSI host structure was allocated, but the call to scsi_add_host() didn't happen. And that pattern happens to exist in some error paths, for example. Syzkaller causes that by using USB raw gadget device, error'ing on usb-storage driver, at usb_stor_probe2(). By checking that path, we can see that the BadDevice label leads to a scsi_host_put() after a SCSI host allocation, but there's no call to scsi_add_host() in such path. That leads to messages like this in dmesg (and a leak of the SCSI host proc structure): usb-storage 4-1:87.51: USB Mass Storage device detected proc_dir_entry 'scsi/usb-storage' already registered WARNING: CPU: 1 PID: 3519 at fs/proc/generic.c:377 proc_register+0x347/0x4e0 fs/proc/generic.c:376 The proper fix seems to still call scsi_proc_hostdir_rm() on dev_release(), but guard that with the state check for SHOST_CREATED; there is even a comment in scsi_host_dev_release() detailing that: such conditional is meant for cases where the SCSI host was allocated but there was no calls to {add,remove}_host(), like the usb-storage case. This is what we propose here and with that, the error path of usb-storage does not trigger the warning anymore. Reported-by: syzbot+c645abf505ed21f931b5(a)syzkaller.appspotmail.com Fixes: be03df3d4bfe ("scsi: core: Fix a procfs host directory removal regression") Cc: stable(a)vger.kernel.org Cc: Bart Van Assche <bvanassche(a)acm.org> Cc: John Garry <john.g.garry(a)oracle.com> Cc: Shin'ichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Signed-off-by: Guilherme G. Piccoli <gpiccoli(a)igalia.com> Link: https://lore.kernel.org/r/20240313113006.2834799-1-gpiccoli@igalia.com Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/hosts.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c index 0553ad4571df..bc84ba58df14 100644 --- a/drivers/scsi/hosts.c +++ b/drivers/scsi/hosts.c @@ -335,12 +335,13 @@ static void scsi_host_dev_release(struct device *dev) if (shost->shost_state == SHOST_CREATED) { /* - * Free the shost_dev device name here if scsi_host_alloc() - * and scsi_host_put() have been called but neither + * Free the shost_dev device name and remove the proc host dir + * here if scsi_host_{alloc,put}() have been called but neither * scsi_host_add() nor scsi_host_remove() has been called. * This avoids that the memory allocated for the shost_dev - * name is leaked. + * name as well as the proc dir structure are leaked. */ + scsi_proc_hostdir_rm(shost->hostt); kfree(dev_name(&shost->shost_dev)); } -- 2.17.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: do not compare internal table flags on updates
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.214 commit fcf32a5bfcb8a57ac0ce717fcfa4d688c91f1005 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139 ] Restore skipping transaction if table update does not modify flags. Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 061fda7c076a..d464351925c7 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1121,7 +1121,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) if (flags & ~NFT_TABLE_F_DORMANT) return -EINVAL; - if (flags == ctx->table->flags) + if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) return 0; /* No dormant off/on/off/on games in single transaction */ -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Martin Kaistra <martin.kaistra(a)linutronix.de> stable inclusion from stable-v5.10.214 commit dddedfa3b29a63c2ca4336663806a6128b8545b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9M3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1213acb478a7181cd73eeaf00db430f1e45b1361 ] The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop(). Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna") Signed-off-by: Martin Kaistra <martin.kaistra(a)linutronix.de> Reviewed-by: Ping-Ke Shih <pkshih(a)realtek.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240111163628.320697-2-martin.kaistra@linutronix.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index e34cd6fed7e8..72bd674e82c6 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -6494,6 +6494,7 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw) if (priv->usb_interrupts) rtl8xxxu_write32(priv, REG_USB_HIMR, 0); + cancel_work_sync(&priv->c2hcmd_work); cancel_delayed_work_sync(&priv->ra_watchdog); rtl8xxxu_free_rx_resources(priv); -- 2.17.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: do not compare internal table flags on updates
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.214 commit fcf32a5bfcb8a57ac0ce717fcfa4d688c91f1005 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139 ] Restore skipping transaction if table update does not modify flags. Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 061fda7c076a..d464351925c7 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1121,7 +1121,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) if (flags & ~NFT_TABLE_F_DORMANT) return -EINVAL; - if (flags == ctx->table->flags) + if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) return 0; /* No dormant off/on/off/on games in single transaction */ -- 2.17.1

2 1

[PATCH OLK-5.10] wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Martin Kaistra <martin.kaistra(a)linutronix.de> stable inclusion from stable-v5.10.214 commit dddedfa3b29a63c2ca4336663806a6128b8545b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9M3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1213acb478a7181cd73eeaf00db430f1e45b1361 ] The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop(). Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna") Signed-off-by: Martin Kaistra <martin.kaistra(a)linutronix.de> Reviewed-by: Ping-Ke Shih <pkshih(a)realtek.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240111163628.320697-2-martin.kaistra@linutronix.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index 004778faf3d0..0a0688efb68e 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -6483,6 +6483,7 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw) if (priv->usb_interrupts) rtl8xxxu_write32(priv, REG_USB_HIMR, 0); + cancel_work_sync(&priv->c2hcmd_work); cancel_delayed_work_sync(&priv->ra_watchdog); rtl8xxxu_free_rx_resources(priv); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Martin Kaistra <martin.kaistra(a)linutronix.de> stable inclusion from stable-v5.10.214 commit dddedfa3b29a63c2ca4336663806a6128b8545b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9M3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1213acb478a7181cd73eeaf00db430f1e45b1361 ] The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop(). Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna") Signed-off-by: Martin Kaistra <martin.kaistra(a)linutronix.de> Reviewed-by: Ping-Ke Shih <pkshih(a)realtek.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240111163628.320697-2-martin.kaistra@linutronix.de Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c index e34cd6fed7e8..72bd674e82c6 100644 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c @@ -6494,6 +6494,7 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw) if (priv->usb_interrupts) rtl8xxxu_write32(priv, REG_USB_HIMR, 0); + cancel_work_sync(&priv->c2hcmd_work); cancel_delayed_work_sync(&priv->ra_watchdog); rtl8xxxu_free_rx_resources(priv); -- 2.17.1

2 1

[PATCH OLK-5.10] clk: Fix clk_core_get NULL dereference
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> stable inclusion from stable-v5.10.214 commit 239174535dba11f7b83de0eaaa27909024f8c185 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9MB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e97fe4901e0f59a0bfd524578fe3768f8ca42428 ] It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provider() __clk_get_hw() __clk_get_hw() can return NULL which is dereferenced by clk_core_get() at hw->core. Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") the check IS_ERR_OR_NULL() was performed which would have caught the NULL. Reading the description of this function it talks about returning NULL but that cannot be so at the moment. Update the function to check for hw before dereferencing it and return NULL if hw is NULL. Fixes: dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") Signed-off-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Link: https://lore.kernel.org/r/20240302-linux-next-24-03-01-simple-clock-fixes-v… Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/clk/clk.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c index 62572d59e7e3..aa2f1f8aa299 100644 --- a/drivers/clk/clk.c +++ b/drivers/clk/clk.c @@ -425,6 +425,9 @@ static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index) if (IS_ERR(hw)) return ERR_CAST(hw); + if (!hw) + return NULL; + return hw->core; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] clk: Fix clk_core_get NULL dereference
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> stable inclusion from stable-v5.10.214 commit 239174535dba11f7b83de0eaaa27909024f8c185 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9MB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e97fe4901e0f59a0bfd524578fe3768f8ca42428 ] It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provider() __clk_get_hw() __clk_get_hw() can return NULL which is dereferenced by clk_core_get() at hw->core. Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") the check IS_ERR_OR_NULL() was performed which would have caught the NULL. Reading the description of this function it talks about returning NULL but that cannot be so at the moment. Update the function to check for hw before dereferencing it and return NULL if hw is NULL. Fixes: dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") Signed-off-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Link: https://lore.kernel.org/r/20240302-linux-next-24-03-01-simple-clock-fixes-v… Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/clk/clk.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c index b355d3d40f63..d462c0b72f89 100644 --- a/drivers/clk/clk.c +++ b/drivers/clk/clk.c @@ -414,6 +414,9 @@ static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index) if (IS_ERR(hw)) return ERR_CAST(hw); + if (!hw) + return NULL; + return hw->core; } -- 2.17.1

2 1

[PATCH OLK-5.10] net: phy: fix phy_get_internal_delay accessing an empty array
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Kévin L'hôpital <kevin.lhopital(a)savoirfairelinux.com> stable inclusion from stable-v5.10.214 commit 06dd21045a7e8bc8701b0ebedcd9a30a6325878b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9N4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4469c0c5b14a0919f5965c7ceac96b523eb57b79 ] The phy_get_internal_delay function could try to access to an empty array in the case that the driver is calling phy_get_internal_delay without defining delay_values and rx-internal-delay-ps or tx-internal-delay-ps is defined to 0 in the device-tree. This will lead to "unable to handle kernel NULL pointer dereference at virtual address 0". To avoid this kernel oops, the test should be delay >= 0. As there is already delay < 0 test just before, the test could only be size == 0. Fixes: 92252eec913b ("net: phy: Add a helper to return the index for of the internal delay") Co-developed-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt(a)savoirfairelinux.com> Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt(a)savoirfairelinux.com> Signed-off-by: Kévin L'hôpital <kevin.lhopital(a)savoirfairelinux.com> Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/phy/phy_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 095d16ceafcf..8654e05ddc41 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -2769,7 +2769,7 @@ s32 phy_get_internal_delay(struct phy_device *phydev, struct device *dev, if (delay < 0) return delay; - if (delay && size == 0) + if (size == 0) return delay; if (delay < delay_values[0] || delay > delay_values[size - 1]) { -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: phy: fix phy_get_internal_delay accessing an empty array
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Kévin L'hôpital <kevin.lhopital(a)savoirfairelinux.com> stable inclusion from stable-v5.10.214 commit 06dd21045a7e8bc8701b0ebedcd9a30a6325878b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9N4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4469c0c5b14a0919f5965c7ceac96b523eb57b79 ] The phy_get_internal_delay function could try to access to an empty array in the case that the driver is calling phy_get_internal_delay without defining delay_values and rx-internal-delay-ps or tx-internal-delay-ps is defined to 0 in the device-tree. This will lead to "unable to handle kernel NULL pointer dereference at virtual address 0". To avoid this kernel oops, the test should be delay >= 0. As there is already delay < 0 test just before, the test could only be size == 0. Fixes: 92252eec913b ("net: phy: Add a helper to return the index for of the internal delay") Co-developed-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt(a)savoirfairelinux.com> Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt(a)savoirfairelinux.com> Signed-off-by: Kévin L'hôpital <kevin.lhopital(a)savoirfairelinux.com> Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/phy/phy_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index d2f6d8107595..f6e0560e898c 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -2768,7 +2768,7 @@ s32 phy_get_internal_delay(struct phy_device *phydev, struct device *dev, if (delay < 0) return delay; - if (delay && size == 0) + if (size == 0) return delay; if (delay < delay_values[0] || delay > delay_values[size - 1]) { -- 2.17.1

2 1

[PATCH OLK-5.10 0/3] spi: Fix deadlock when adding SPI controllers on SPI buses
by Zeng Heng 19 Jun '24

19 Jun '24

Mark Brown (1): spi: Fix deadlock when adding SPI controllers on SPI buses Michael Walle (1): spi: fix use-after-free of the add_lock mutex Zeng Heng (1): spi: fix kabi breakage in struct spi_controller drivers/spi/spi.c | 54 +++++++++++++++++++++++++----------------- include/linux/device.h | 8 +++++++ 2 files changed, 40 insertions(+), 22 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-22.03-LTS-SP1 0/3] spi: Fix deadlock when adding SPI controllers on SPI buses
by Zeng Heng 19 Jun '24

19 Jun '24

Mark Brown (1): spi: Fix deadlock when adding SPI controllers on SPI buses Michael Walle (1): spi: fix use-after-free of the add_lock mutex Zeng Heng (1): spi: fix kabi breakage in struct spi_controller drivers/spi/spi.c | 54 +++++++++++++++++++++++++----------------- include/linux/device.h | 8 +++++++ 2 files changed, 40 insertions(+), 22 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS] kprobes: Fix possible use-after-free issue on kprobe registration
by Chen Zhongjin 19 Jun '24

19 Jun '24

stable inclusion from stable-v4.19.313 commit b5808d40093403334d939e2c3c417144d12a6f33 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRI5 CVE: CVE-2024-35955 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8 upstream. When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE. Link: https://lore.kernel.org/all/20240410015802.265220-1-zhengyejian1@huawei.com/ Fixes: 28f6c37a2910 ("kprobes: Forbid probing on trampoline and BPF code areas") Cc: stable(a)vger.kernel.org Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> [Fix conflict due to lack dependency commit 223a76b268c9 ("kprobes: Fix coding style issues")] Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Fix conflict due to lack dependency commit 1efda38d6f9b ("kprobes: Prohibit probes in gate area")] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- kernel/kprobes.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index e431f8f567f9..a27fab1967be 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1557,9 +1557,17 @@ static int check_kprobe_address_safe(struct kprobe *p, jump_label_lock(); preempt_disable(); - /* Ensure it is not in reserved area nor out of text */ - if (!(core_kernel_text((unsigned long) p->addr) || - is_module_text_address((unsigned long) p->addr)) || + /* Ensure the address is in a text area, and find a module if exists. */ + *probed_mod = NULL; + if (!core_kernel_text((unsigned long) p->addr)) { + *probed_mod = __module_text_address((unsigned long) p->addr); + if (!(*probed_mod)) { + ret = -EINVAL; + goto out; + } + } + /* Ensure it is not in reserved area. */ + if (in_gate_area_no_mm((unsigned long) p->addr) || within_kprobe_blacklist((unsigned long) p->addr) || jump_label_text_reserved(p->addr, p->addr) || klp_is_addr_patched((unsigned long)p->addr)) { @@ -1567,8 +1575,7 @@ static int check_kprobe_address_safe(struct kprobe *p, goto out; } - /* Check if are we probing a module */ - *probed_mod = __module_text_address((unsigned long) p->addr); + /* Get module refcount and reject __init functions for loaded modules. */ if (*probed_mod) { /* * We must hold a refcount of the probed module while updating -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
by Chen Zhongjin 19 Jun '24

19 Jun '24

From: Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org> stable inclusion from stable-v4.19.198 commit 04bd77ef4f4d9fc6102023b85f4590fc2130aac5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4FH CVE: CVE-2021-47346 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5fae8a946ac2df879caf3f79a193d4766d00239b upstream. commit 6f755e85c332 ("coresight: Add helper for inserting synchronization packets") removed trailing '\0' from barrier_pkt array and updated the call sites like etb_update_buffer() to have proper checks for barrier_pkt size before read but missed updating tmc_update_etf_buffer() which still reads barrier_pkt past the array size resulting in KASAN out-of-bounds bug. Fix this by adding a check for barrier_pkt size before accessing like it is done in etb_update_buffer(). BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698 Read of size 4 at addr ffffffd05b7d1030 by task perf/2629 Call trace: dump_backtrace+0x0/0x27c show_stack+0x20/0x2c dump_stack+0x11c/0x188 print_address_description+0x3c/0x4a4 __kasan_report+0x140/0x164 kasan_report+0x10/0x18 __asan_report_load4_noabort+0x1c/0x24 tmc_update_etf_buffer+0x4b8/0x698 etm_event_stop+0x248/0x2d8 etm_event_del+0x20/0x2c event_sched_out+0x214/0x6f0 group_sched_out+0xd0/0x270 ctx_sched_out+0x2ec/0x518 __perf_event_task_sched_out+0x4fc/0xe6c __schedule+0x1094/0x16a0 preempt_schedule_irq+0x88/0x170 arm64_preempt_schedule_irq+0xf0/0x18c el1_irq+0xe8/0x180 perf_event_exec+0x4d8/0x56c setup_new_exec+0x204/0x400 load_elf_binary+0x72c/0x18c0 search_binary_handler+0x13c/0x420 load_script+0x500/0x6c4 search_binary_handler+0x13c/0x420 exec_binprm+0x118/0x654 __do_execve_file+0x77c/0xba4 __arm64_compat_sys_execve+0x98/0xac el0_svc_common+0x1f8/0x5e0 el0_svc_compat_handler+0x84/0xb0 el0_svc_compat+0x10/0x50 The buggy address belongs to the variable: barrier_pkt+0x10/0x40 Memory state around the buggy address: ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03 ^ ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa ================================================================== Link: https://lore.kernel.org/r/20210505093430.18445-1-saiprakash.ranjan@codeauro… Fixes: 0c3fc4d5fa26 ("coresight: Add barrier packet for synchronisation") Cc: stable(a)vger.kernel.org Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Link: https://lore.kernel.org/r/20210614175901.532683-6-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c index e31061308e19..988cbb5f3e0b 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etf.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c @@ -472,7 +472,7 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev, buf_ptr = buf->data_pages[cur] + offset; *buf_ptr = readl_relaxed(drvdata->base + TMC_RRD); - if (lost && *barrier) { + if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) { *buf_ptr = *barrier; barrier++; } -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: restore set elements when delete set fails
by Guo Mengqi 19 Jun '24

19 Jun '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.9-rc5 commit e79b47a8615d42c68aaeb68971593333667382ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5G1 CVE: CVE-2024-27012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- From abort path, nft_mapelem_activate() needs to restore refcounters to the original state. Currently, it uses the set->ops->walk() to iterate over these set elements. The existing set iterator skips inactive elements in the next generation, this does not work from the abort path to restore the original state since it has to skip active elements instead (not inactive ones). This patch moves the check for inactive elements to the set iterator callback, then it reverses the logic for the .activate case which needs to skip active elements. Toggle next generation bit for elements when delete set command is invoked and call nft_clear() from .activate (abort) path to restore the next generation bit. The splat below shows an object in mappings memleak: [43929.457523] ------------[ cut here ]------------ [43929.457532] WARNING: CPU: 0 PID: 1139 at include/net/netfilter/nf_tables.h:1237 nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [...] [43929.458014] RIP: 0010:nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458076] Code: 83 f8 01 77 ab 49 8d 7c 24 08 e8 37 5e d0 de 49 8b 6c 24 08 48 8d 7d 50 e8 e9 5c d0 de 8b 45 50 8d 50 ff 89 55 50 85 c0 75 86 <0f> 0b eb 82 0f 0b eb b3 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 [43929.458081] RSP: 0018:ffff888140f9f4b0 EFLAGS: 00010246 [43929.458086] RAX: 0000000000000000 RBX: ffff8881434f5288 RCX: dffffc0000000000 [43929.458090] RDX: 00000000ffffffff RSI: ffffffffa26d28a7 RDI: ffff88810ecc9550 [43929.458093] RBP: ffff88810ecc9500 R08: 0000000000000001 R09: ffffed10281f3e8f [43929.458096] R10: 0000000000000003 R11: ffff0000ffff0000 R12: ffff8881434f52a0 [43929.458100] R13: ffff888140f9f5f4 R14: ffff888151c7a800 R15: 0000000000000002 [43929.458103] FS: 00007f0c687c4740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [43929.458107] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [43929.458111] CR2: 00007f58dbe5b008 CR3: 0000000123602005 CR4: 00000000001706f0 [43929.458114] Call Trace: [43929.458118] <TASK> [43929.458121] ? __warn+0x9f/0x1a0 [43929.458127] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458188] ? report_bug+0x1b1/0x1e0 [43929.458196] ? handle_bug+0x3c/0x70 [43929.458200] ? exc_invalid_op+0x17/0x40 [43929.458211] ? nft_setelem_data_deactivate+0xd7/0xf0 [nf_tables] [43929.458271] ? nft_setelem_data_deactivate+0xe4/0xf0 [nf_tables] [43929.458332] nft_mapelem_deactivate+0x24/0x30 [nf_tables] [43929.458392] nft_rhash_walk+0xdd/0x180 [nf_tables] [43929.458453] ? __pfx_nft_rhash_walk+0x10/0x10 [nf_tables] [43929.458512] ? rb_insert_color+0x2e/0x280 [43929.458520] nft_map_deactivate+0xdc/0x1e0 [nf_tables] [43929.458582] ? __pfx_nft_map_deactivate+0x10/0x10 [nf_tables] [43929.458642] ? __pfx_nft_mapelem_deactivate+0x10/0x10 [nf_tables] [43929.458701] ? __rcu_read_unlock+0x46/0x70 [43929.458709] nft_delset+0xff/0x110 [nf_tables] [43929.458769] nft_flush_table+0x16f/0x460 [nf_tables] [43929.458830] nf_tables_deltable+0x501/0x580 [nf_tables] Fixes: 628bd3e49cba ("netfilter: nf_tables: drop map element references from preparation phase") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_set_rbtree.c net/netfilter/nf_tables_api.c net/netfilter/nft_set_bitmap.c net/netfilter/nft_set_hash.c net/netfilter/nft_set_pipapo.c [commit 0e1ea651c971 wasnt merged, which lead to context conflicts (no function nft_map_catchall_deactivate()] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 24 ++++++++++++++++++++++++ net/netfilter/nft_set_bitmap.c | 4 +--- net/netfilter/nft_set_hash.c | 8 ++------ net/netfilter/nft_set_pipapo.c | 5 +---- net/netfilter/nft_set_rbtree.c | 4 +--- 5 files changed, 29 insertions(+), 16 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index cbe22f52d6c4..061fda7c076a 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -584,6 +584,12 @@ static int nft_mapelem_deactivate(const struct nft_ctx *ctx, const struct nft_set_iter *iter, struct nft_set_elem *elem) { + struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); + + if (!nft_set_elem_active(ext, iter->genmask)) + return 0; + + nft_set_elem_change_active(ctx->net, set, ext); nft_setelem_data_deactivate(ctx->net, set, elem); return 0; @@ -4735,6 +4741,11 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, const struct nft_set_iter *iter, struct nft_set_elem *elem) { + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); + + if (!nft_set_elem_active(ext, iter->genmask)) + return 0; + return nft_setelem_data_validate(ctx, set, elem); } @@ -4803,6 +4814,13 @@ static int nft_mapelem_activate(const struct nft_ctx *ctx, const struct nft_set_iter *iter, struct nft_set_elem *elem) { + struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); + + /* called from abort path, reverse check to undo changes. */ + if (nft_set_elem_active(ext, iter->genmask)) + return 0; + + nft_clear(ctx->net, ext); nft_setelem_data_activate(ctx->net, set, elem); return 0; @@ -5055,6 +5073,9 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx, const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); struct nft_set_dump_args *args; + if (!nft_set_elem_active(ext, iter->genmask)) + return 0; + if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext)) return 0; @@ -9124,6 +9145,9 @@ static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx, { const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); + if (!nft_set_elem_active(ext, iter->genmask)) + return 0; + if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) && *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END) return 0; diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c index 3c63f8acebd8..91c283cec751 100644 --- a/net/netfilter/nft_set_bitmap.c +++ b/net/netfilter/nft_set_bitmap.c @@ -170,7 +170,7 @@ static void nft_bitmap_activate(const struct net *net, nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off); /* Enter 11 state. */ priv->bitmap[idx] |= (genmask << off); - nft_set_elem_change_active(net, set, &be->ext); + nft_clear(net, &be->ext); } static bool nft_bitmap_flush(const struct net *net, @@ -222,8 +222,6 @@ static void nft_bitmap_walk(const struct nft_ctx *ctx, list_for_each_entry_rcu(be, &priv->list, head) { if (iter->count < iter->skip) goto cont; - if (!nft_set_elem_active(&be->ext, iter->genmask)) - goto cont; elem.priv = be; diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c index f0a9ad1c4ea4..f4a76ae8a11c 100644 --- a/net/netfilter/nft_set_hash.c +++ b/net/netfilter/nft_set_hash.c @@ -191,7 +191,7 @@ static void nft_rhash_activate(const struct net *net, const struct nft_set *set, { struct nft_rhash_elem *he = elem->priv; - nft_set_elem_change_active(net, set, &he->ext); + nft_clear(net, &he->ext); } static bool nft_rhash_flush(const struct net *net, @@ -279,8 +279,6 @@ static void nft_rhash_walk(const struct nft_ctx *ctx, struct nft_set *set, if (iter->count < iter->skip) goto cont; - if (!nft_set_elem_active(&he->ext, iter->genmask)) - goto cont; elem.priv = he; @@ -571,7 +569,7 @@ static void nft_hash_activate(const struct net *net, const struct nft_set *set, { struct nft_hash_elem *he = elem->priv; - nft_set_elem_change_active(net, set, &he->ext); + nft_clear(net, &he->ext); } static bool nft_hash_flush(const struct net *net, @@ -625,8 +623,6 @@ static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set, hlist_for_each_entry_rcu(he, &priv->table[i], node) { if (iter->count < iter->skip) goto cont; - if (!nft_set_elem_active(&he->ext, iter->genmask)) - goto cont; elem.priv = he; diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 8c43335d59f6..2a147e969c66 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1751,7 +1751,7 @@ static void nft_pipapo_activate(const struct net *net, { struct nft_pipapo_elem *e = elem->priv; - nft_set_elem_change_active(net, set, &e->ext); + nft_clear(net, &e->ext); } /** @@ -2053,9 +2053,6 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, e = f->mt[r].e; - if (!nft_set_elem_active(&e->ext, iter->genmask)) - goto cont; - elem.priv = e; iter->err = iter->fn(ctx, set, iter, &elem); diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 8b1daca932e0..323cbb446d19 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -512,7 +512,7 @@ static void nft_rbtree_activate(const struct net *net, { struct nft_rbtree_elem *rbe = elem->priv; - nft_set_elem_change_active(net, set, &rbe->ext); + nft_clear(net, &rbe->ext); } static bool nft_rbtree_flush(const struct net *net, @@ -581,8 +581,6 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx, if (iter->count < iter->skip) goto cont; - if (!nft_set_elem_active(&rbe->ext, iter->genmask)) - goto cont; elem.priv = rbe; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: wilc1000: fix RCU usage in connect path
by Jinjiang Tu 19 Jun '24

19 Jun '24

From: Alexis Lothoré <alexis.lothore(a)bootlin.com> stable inclusion from stable-v5.10.214 commit b4bbf38c350acb6500cbe667b1e2e68f896e4b38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9OG CVE: CVE-2024-27053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 205c50306acf58a335eb19fa84e40140f4fe814f ] With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ #333 Not tainted ----------------------------- drivers/net/wireless/microchip/wilc1000/hif.c:386 suspicious rcu_dereference_check() usage! [...] stack backtrace: CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333 Hardware name: Atmel SAMA5 unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x48 dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4 wilc_parse_join_bss_param from connect+0x2c4/0x648 connect from cfg80211_connect+0x30c/0xb74 cfg80211_connect from nl80211_connect+0x860/0xa94 nl80211_connect from genl_rcv_msg+0x3fc/0x59c genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8 netlink_rcv_skb from genl_rcv+0x2c/0x3c genl_rcv from netlink_unicast+0x3b0/0x550 netlink_unicast from netlink_sendmsg+0x368/0x688 netlink_sendmsg from ____sys_sendmsg+0x190/0x430 ____sys_sendmsg from ___sys_sendmsg+0x110/0x158 ___sys_sendmsg from sys_sendmsg+0xe8/0x150 sys_sendmsg from ret_fast_syscall+0x0/0x1c This warning is emitted because in the connect path, when trying to parse target BSS parameters, we dereference a RCU pointer whithout being in RCU critical section. Fix RCU dereference usage by moving it to a RCU read critical section. To avoid wrapping the whole wilc_parse_join_bss_param under the critical section, just use the critical section to copy ies data Fixes: c460495ee072 ("staging: wilc1000: fix incorrent type in initializer") Signed-off-by: Alexis Lothoré <alexis.lothore(a)bootlin.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240105075733.36331-3-alexis.lothore@bootlin.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/wireless/microchip/wilc1000/hif.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/net/wireless/microchip/wilc1000/hif.c | 36 ++++++++++++------- 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c index 884f45e627a7..7e5574b1df9c 100644 --- a/drivers/net/wireless/microchip/wilc1000/hif.c +++ b/drivers/net/wireless/microchip/wilc1000/hif.c @@ -361,36 +361,47 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, { struct wilc_join_bss_param *param; struct ieee80211_p2p_noa_attr noa_attr; - u8 rates_len = 0; - const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie; + u8 rates_len = 0, ies_len; + const u8 *ies_data, *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie; const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie; int ret; - const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies); + const struct cfg80211_bss_ies *ies; param = kzalloc(sizeof(*param), GFP_KERNEL); if (!param) return NULL; + rcu_read_lock(); + ies = rcu_dereference(bss->ies); + ies_data = kmemdup(ies->data, ies->len, GFP_ATOMIC); + if (!ies_data) { + rcu_read_unlock(); + kfree(param); + return NULL; + } + ies_len = ies->len; + rcu_read_unlock(); + param->beacon_period = cpu_to_le16(bss->beacon_interval); param->cap_info = cpu_to_le16(bss->capability); param->bss_type = WILC_FW_BSS_TYPE_INFRA; param->ch = ieee80211_frequency_to_channel(bss->channel->center_freq); ether_addr_copy(param->bssid, bss->bssid); - ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); + ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies_data, ies_len); if (ssid_elm) { if (ssid_elm[1] <= IEEE80211_MAX_SSID_LEN) memcpy(param->ssid, ssid_elm + 2, ssid_elm[1]); } - tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len); + tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies_data, ies_len); if (tim_elm && tim_elm[1] >= 2) param->dtim_period = tim_elm[3]; memset(param->p_suites, 0xFF, 3); memset(param->akm_suites, 0xFF, 3); - rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len); + rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies_data, ies_len); if (rates_ie) { rates_len = rates_ie[1]; if (rates_len > WILC_MAX_RATES_SUPPORTED) @@ -401,7 +412,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, if (rates_len < WILC_MAX_RATES_SUPPORTED) { supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, - ies->data, ies->len); + ies_data, ies_len); if (supp_rates_ie) { u8 ext_rates = supp_rates_ie[1]; @@ -416,11 +427,11 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, } } - ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len); + ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies_data, ies_len); if (ht_ie) param->ht_capable = true; - ret = cfg80211_get_p2p_attr(ies->data, ies->len, + ret = cfg80211_get_p2p_attr(ies_data, ies_len, IEEE80211_P2P_ATTR_ABSENCE_NOTICE, (u8 *)&noa_attr, sizeof(noa_attr)); if (ret > 0) { @@ -444,7 +455,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, } wmm_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, WLAN_OUI_TYPE_MICROSOFT_WMM, - ies->data, ies->len); + ies_data, ies_len); if (wmm_ie) { struct ieee80211_wmm_param_ie *ie; @@ -459,13 +470,13 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, wpa_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, WLAN_OUI_TYPE_MICROSOFT_WPA, - ies->data, ies->len); + ies_data, ies_len); if (wpa_ie) { param->mode_802_11i = 1; param->rsn_found = true; } - rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len); + rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies_data, ies_len); if (rsn_ie) { int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; int offset = 8; @@ -499,6 +510,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, param->akm_suites[i] = crypto->akm_suites[i] & 0xFF; } + kfree(ies_data); return (void *)param; } -- 2.25.1

2 1

[PATCH OLK-5.10] wifi: wilc1000: fix RCU usage in connect path
by Jinjiang Tu 19 Jun '24

19 Jun '24

From: Alexis Lothoré <alexis.lothore(a)bootlin.com> stable inclusion from stable-v5.10.214 commit b4bbf38c350acb6500cbe667b1e2e68f896e4b38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9OG CVE: CVE-2024-27053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 205c50306acf58a335eb19fa84e40140f4fe814f ] With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: suspicious RCU usage 6.7.0-rc1-wt+ #333 Not tainted ----------------------------- drivers/net/wireless/microchip/wilc1000/hif.c:386 suspicious rcu_dereference_check() usage! [...] stack backtrace: CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333 Hardware name: Atmel SAMA5 unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x48 dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4 wilc_parse_join_bss_param from connect+0x2c4/0x648 connect from cfg80211_connect+0x30c/0xb74 cfg80211_connect from nl80211_connect+0x860/0xa94 nl80211_connect from genl_rcv_msg+0x3fc/0x59c genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8 netlink_rcv_skb from genl_rcv+0x2c/0x3c genl_rcv from netlink_unicast+0x3b0/0x550 netlink_unicast from netlink_sendmsg+0x368/0x688 netlink_sendmsg from ____sys_sendmsg+0x190/0x430 ____sys_sendmsg from ___sys_sendmsg+0x110/0x158 ___sys_sendmsg from sys_sendmsg+0xe8/0x150 sys_sendmsg from ret_fast_syscall+0x0/0x1c This warning is emitted because in the connect path, when trying to parse target BSS parameters, we dereference a RCU pointer whithout being in RCU critical section. Fix RCU dereference usage by moving it to a RCU read critical section. To avoid wrapping the whole wilc_parse_join_bss_param under the critical section, just use the critical section to copy ies data Fixes: c460495ee072 ("staging: wilc1000: fix incorrent type in initializer") Signed-off-by: Alexis Lothoré <alexis.lothore(a)bootlin.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://msgid.link/20240105075733.36331-3-alexis.lothore@bootlin.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/wireless/microchip/wilc1000/hif.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/net/wireless/microchip/wilc1000/hif.c | 36 ++++++++++++------- 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c index 884f45e627a7..7e5574b1df9c 100644 --- a/drivers/net/wireless/microchip/wilc1000/hif.c +++ b/drivers/net/wireless/microchip/wilc1000/hif.c @@ -361,36 +361,47 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, { struct wilc_join_bss_param *param; struct ieee80211_p2p_noa_attr noa_attr; - u8 rates_len = 0; - const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie; + u8 rates_len = 0, ies_len; + const u8 *ies_data, *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie; const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie; int ret; - const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies); + const struct cfg80211_bss_ies *ies; param = kzalloc(sizeof(*param), GFP_KERNEL); if (!param) return NULL; + rcu_read_lock(); + ies = rcu_dereference(bss->ies); + ies_data = kmemdup(ies->data, ies->len, GFP_ATOMIC); + if (!ies_data) { + rcu_read_unlock(); + kfree(param); + return NULL; + } + ies_len = ies->len; + rcu_read_unlock(); + param->beacon_period = cpu_to_le16(bss->beacon_interval); param->cap_info = cpu_to_le16(bss->capability); param->bss_type = WILC_FW_BSS_TYPE_INFRA; param->ch = ieee80211_frequency_to_channel(bss->channel->center_freq); ether_addr_copy(param->bssid, bss->bssid); - ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len); + ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies_data, ies_len); if (ssid_elm) { if (ssid_elm[1] <= IEEE80211_MAX_SSID_LEN) memcpy(param->ssid, ssid_elm + 2, ssid_elm[1]); } - tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len); + tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies_data, ies_len); if (tim_elm && tim_elm[1] >= 2) param->dtim_period = tim_elm[3]; memset(param->p_suites, 0xFF, 3); memset(param->akm_suites, 0xFF, 3); - rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len); + rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies_data, ies_len); if (rates_ie) { rates_len = rates_ie[1]; if (rates_len > WILC_MAX_RATES_SUPPORTED) @@ -401,7 +412,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, if (rates_len < WILC_MAX_RATES_SUPPORTED) { supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, - ies->data, ies->len); + ies_data, ies_len); if (supp_rates_ie) { u8 ext_rates = supp_rates_ie[1]; @@ -416,11 +427,11 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, } } - ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len); + ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies_data, ies_len); if (ht_ie) param->ht_capable = true; - ret = cfg80211_get_p2p_attr(ies->data, ies->len, + ret = cfg80211_get_p2p_attr(ies_data, ies_len, IEEE80211_P2P_ATTR_ABSENCE_NOTICE, (u8 *)&noa_attr, sizeof(noa_attr)); if (ret > 0) { @@ -444,7 +455,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, } wmm_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, WLAN_OUI_TYPE_MICROSOFT_WMM, - ies->data, ies->len); + ies_data, ies_len); if (wmm_ie) { struct ieee80211_wmm_param_ie *ie; @@ -459,13 +470,13 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, wpa_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, WLAN_OUI_TYPE_MICROSOFT_WPA, - ies->data, ies->len); + ies_data, ies_len); if (wpa_ie) { param->mode_802_11i = 1; param->rsn_found = true; } - rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len); + rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies_data, ies_len); if (rsn_ie) { int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; int offset = 8; @@ -499,6 +510,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, param->akm_suites[i] = crypto->akm_suites[i] & 0xFF; } + kfree(ies_data); return (void *)param; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47232
by Zhang Changzhong 19 Jun '24

19 Jun '24

Oleksij Rempel (3): can: j1939: transport: add j1939_session_skb_find_by_offset() function can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_txtimer() can: j1939: fix Use-after-Free, hold skb ref while in use net/can/j1939/transport.c | 77 ++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 63 insertions(+), 14 deletions(-) -- 2.9.5

2 4

[PATCH OLK-6.6] sched: smart_grid: fix potential NULL pointer dereference
by Yipeng Zou 19 Jun '24

19 Jun '24

hulk inclusion Category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6J1H CVE: NA ---------------------------------------- There is a low probability that kernel panic will occur when we test with smart_grid. The log show below: [65160.746953] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [65160.746990] Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 [65160.756974] Mem abort info: [65160.766849] Mem abort info: [65160.770660] ESR = 0x96000004 [65160.770663] EC = 0x25: DABT (current EL), IL = 32 bits [65160.774374] ESR = 0x96000004 [65160.774377] EC = 0x25: DABT (current EL), IL = 32 bits [65160.778428] SET = 0, FnV = 0 [65160.778430] EA = 0, S1PTW = 0 [65160.784728] SET = 0, FnV = 0 [65160.784731] EA = 0, S1PTW = 0 [65160.786018] Detected VIPT I-cache on CPU104 [65160.786070] GICv3: CPU104: found redistributor 3a0000 region 104: 0x00002000aa300000 [65160.786240] CPU104: Booted secondary processor 0x00003a0000 [0x481fd010] [65160.788696] Data abort info: [65160.788699] ISV = 0, ISS = 0x00000004 [65160.794911] Data abort info: [65160.794913] ISV = 0, ISS = 0x00000004 [65160.798965] CM = 0, WnR = 0 [65160.798967] user pgtable: 4k pages, 48-bit VAs, pgdp=00000030059b2000 [65160.803102] CM = 0, WnR = 0 [65160.803104] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020ab07c000 [65160.807066] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.811113] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.816199] Internal error: Oops: 0000000096000004 [#1] SMP [65160.832723] Modules linked in: [65161.006841] CPU: 39 PID: 195931 Comm: (hrottler) Kdump: loaded Nottainted 5.10.0 #51 [65161.016660] Hardware name: Huawei TaiShan 200 (Model 5280)/BC82AMDD, BIOS 1.08 12/14/2019 [65161.026146] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--) [65161.033199] pc : set_task_select_cpus+0x8c/0x3d0 [65161.038865] lr : select_task_rq_fair+0x1c8/0x5cc [65161.044528] sp : ffff800172673ba0 [65161.048888] x29: ffff800172673ba0 x28: ffff00303f22cd00 [65161.055237] x27: 0000000000000027 x26: 0000000000000027 [65161.061583] x25: 0000aaaafd32b180 x24: 0000000000000002 [65161.067925] x23: ffff00303f22cd00 x22: 0000000000000000 [65161.074264] x21: ffff800172673cc4 x20: ffff00303f22cd00 [65161.080603] x19: ffff00303f22d7f4 x18: 0000000000000000 [65161.086938] x17: 0000000000000000 x16: 0000000000000000 [65161.093266] x15: 0000aaaafd365130 x14: 0000000000000000 [65161.099584] x13: 0000000000000000 x12: 0000000000000000 [65161.105892] x11: 0000000000000000 x10: 0000000000000000 [65161.112194] x9 : ffff800010129e80 x8 : 0000000000000000 [65161.118489] x7 : ffff00303f22cd00 x6 : 0000000000000001 [65161.124776] x5 : 0000000000000000 x4 : ffff8000118f5008 [65161.131058] x3 : 0000000000000000 x2 : 0000000000000002 [65161.137331] x1 : ffff800172673cc4 x0 : 0000000000000000 [65161.143598] Call trace: [65161.147005] set_task_select_cpus+0x8c/0x3d0 [65161.152225] select_task_rq_fair+0x1c8/0x5cc [65161.157439] sched_exec+0x94/0x1bc [65161.161782] bprm_execve.part.0+0x60/0x164 [65161.166813] bprm_execve+0x78/0xc0 [65161.171143] do_execveat_common+0x1c4/0x250 [65161.176244] __arm64_sys_execve+0x48/0x70 [65161.181167] invoke_syscall+0x50/0x130 [65161.185824] el0_svc_common.constprop.0+0x158/0x180 [65161.191601] do_el0_svc+0x34/0xe0 [65161.195816] el0_svc+0x20/0x30 [65161.199773] el0_sync_handler+0xb8/0xc0 [65161.204502] el0_sync+0x1e8/0x200 [65161.208712] Code: d50323bf d65f03c0 f941ac00 f941c400 (f9400400) It's panic on task_group(current)->auto_affinity dereference. In the scenario like: CPU0 CPU1 rmdir cgroup free auto_affinity try to wake up select_task_rq_fair auto_affinity(NULL) dereference panic Because there is no protect when remove task from one cgroup with task wakeup, so we need to check auto_affinity is NULL in task_prefer_cpus. Fixes: 6eb07f9925a9 ("sched: Introduce smart grid scheduling strategy for cfs") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 84af50f4285f..d2efd40fb784 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6833,7 +6833,8 @@ static void smart_grid_usage_dec(void) static inline struct cpumask *task_prefer_cpus(struct task_struct *p) { - if (!smart_grid_used()) + if (!smart_grid_used() || + !task_group(p)->auto_affinity) return p->prefer_cpus; if (task_group(p)->auto_affinity->mode == 0) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched: smart_grid: fix potential NULL pointer dereference
by Yipeng Zou 19 Jun '24

19 Jun '24

hulk inclusion Category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6J1H ---------------------------------------- There is a low probability that kernel panic will occur when we test with smart_grid. The log show below: [65160.746953] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [65160.746990] Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 [65160.756974] Mem abort info: [65160.766849] Mem abort info: [65160.770660] ESR = 0x96000004 [65160.770663] EC = 0x25: DABT (current EL), IL = 32 bits [65160.774374] ESR = 0x96000004 [65160.774377] EC = 0x25: DABT (current EL), IL = 32 bits [65160.778428] SET = 0, FnV = 0 [65160.778430] EA = 0, S1PTW = 0 [65160.784728] SET = 0, FnV = 0 [65160.784731] EA = 0, S1PTW = 0 [65160.786018] Detected VIPT I-cache on CPU104 [65160.786070] GICv3: CPU104: found redistributor 3a0000 region 104: 0x00002000aa300000 [65160.786240] CPU104: Booted secondary processor 0x00003a0000 [0x481fd010] [65160.788696] Data abort info: [65160.788699] ISV = 0, ISS = 0x00000004 [65160.794911] Data abort info: [65160.794913] ISV = 0, ISS = 0x00000004 [65160.798965] CM = 0, WnR = 0 [65160.798967] user pgtable: 4k pages, 48-bit VAs, pgdp=00000030059b2000 [65160.803102] CM = 0, WnR = 0 [65160.803104] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020ab07c000 [65160.807066] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.811113] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.816199] Internal error: Oops: 0000000096000004 [#1] SMP [65160.832723] Modules linked in: [65161.006841] CPU: 39 PID: 195931 Comm: (hrottler) Kdump: loaded Nottainted 5.10.0 #51 [65161.016660] Hardware name: Huawei TaiShan 200 (Model 5280)/BC82AMDD, BIOS 1.08 12/14/2019 [65161.026146] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--) [65161.033199] pc : set_task_select_cpus+0x8c/0x3d0 [65161.038865] lr : select_task_rq_fair+0x1c8/0x5cc [65161.044528] sp : ffff800172673ba0 [65161.048888] x29: ffff800172673ba0 x28: ffff00303f22cd00 [65161.055237] x27: 0000000000000027 x26: 0000000000000027 [65161.061583] x25: 0000aaaafd32b180 x24: 0000000000000002 [65161.067925] x23: ffff00303f22cd00 x22: 0000000000000000 [65161.074264] x21: ffff800172673cc4 x20: ffff00303f22cd00 [65161.080603] x19: ffff00303f22d7f4 x18: 0000000000000000 [65161.086938] x17: 0000000000000000 x16: 0000000000000000 [65161.093266] x15: 0000aaaafd365130 x14: 0000000000000000 [65161.099584] x13: 0000000000000000 x12: 0000000000000000 [65161.105892] x11: 0000000000000000 x10: 0000000000000000 [65161.112194] x9 : ffff800010129e80 x8 : 0000000000000000 [65161.118489] x7 : ffff00303f22cd00 x6 : 0000000000000001 [65161.124776] x5 : 0000000000000000 x4 : ffff8000118f5008 [65161.131058] x3 : 0000000000000000 x2 : 0000000000000002 [65161.137331] x1 : ffff800172673cc4 x0 : 0000000000000000 [65161.143598] Call trace: [65161.147005] set_task_select_cpus+0x8c/0x3d0 [65161.152225] select_task_rq_fair+0x1c8/0x5cc [65161.157439] sched_exec+0x94/0x1bc [65161.161782] bprm_execve.part.0+0x60/0x164 [65161.166813] bprm_execve+0x78/0xc0 [65161.171143] do_execveat_common+0x1c4/0x250 [65161.176244] __arm64_sys_execve+0x48/0x70 [65161.181167] invoke_syscall+0x50/0x130 [65161.185824] el0_svc_common.constprop.0+0x158/0x180 [65161.191601] do_el0_svc+0x34/0xe0 [65161.195816] el0_svc+0x20/0x30 [65161.199773] el0_sync_handler+0xb8/0xc0 [65161.204502] el0_sync+0x1e8/0x200 [65161.208712] Code: d50323bf d65f03c0 f941ac00 f941c400 (f9400400) It's panic on task_group(current)->auto_affinity dereference. In the scenario like: CPU0 CPU1 rmdir cgroup free auto_affinity try to wake up select_task_rq_fair auto_affinity(NULL) dereference panic Because there is no protect when remove task from one cgroup with task wakeup, so we need to check auto_affinity is NULL in task_prefer_cpus. Fixes: 21e5d85e205f ("sched: Fix possible deadlock in tg_set_dynamic_affinity_mode") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index aee13d30a7de..63f4344ac344 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5329,7 +5329,8 @@ static inline struct cpumask *task_prefer_cpus(struct task_struct *p) { struct affinity_domain *ad; - if (!smart_grid_used()) + if (!smart_grid_used() || + !task_group(p)->auto_affinity) return p->prefer_cpus; if (task_group(p)->auto_affinity->mode == 0) -- 2.34.1

2 1

[PATCH OLK-5.10] sched: smart_grid: fix potential NULL pointer dereference
by Yipeng Zou 19 Jun '24

19 Jun '24

hulk inclusion Category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6J1H CVE: NA ---------------------------------------- There is a low probability that kernel panic will occur when we test with smart_grid. The log show below: [65160.746953] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [65160.746990] Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 [65160.756974] Mem abort info: [65160.766849] Mem abort info: [65160.770660] ESR = 0x96000004 [65160.770663] EC = 0x25: DABT (current EL), IL = 32 bits [65160.774374] ESR = 0x96000004 [65160.774377] EC = 0x25: DABT (current EL), IL = 32 bits [65160.778428] SET = 0, FnV = 0 [65160.778430] EA = 0, S1PTW = 0 [65160.784728] SET = 0, FnV = 0 [65160.784731] EA = 0, S1PTW = 0 [65160.786018] Detected VIPT I-cache on CPU104 [65160.786070] GICv3: CPU104: found redistributor 3a0000 region 104: 0x00002000aa300000 [65160.786240] CPU104: Booted secondary processor 0x00003a0000 [0x481fd010] [65160.788696] Data abort info: [65160.788699] ISV = 0, ISS = 0x00000004 [65160.794911] Data abort info: [65160.794913] ISV = 0, ISS = 0x00000004 [65160.798965] CM = 0, WnR = 0 [65160.798967] user pgtable: 4k pages, 48-bit VAs, pgdp=00000030059b2000 [65160.803102] CM = 0, WnR = 0 [65160.803104] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020ab07c000 [65160.807066] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.811113] [0000000000000008] pgd=0000000000000000, p4d=0000000000000000 [65160.816199] Internal error: Oops: 0000000096000004 [#1] SMP [65160.832723] Modules linked in: [65161.006841] CPU: 39 PID: 195931 Comm: (hrottler) Kdump: loaded Nottainted 5.10.0 #51 [65161.016660] Hardware name: Huawei TaiShan 200 (Model 5280)/BC82AMDD, BIOS 1.08 12/14/2019 [65161.026146] pstate: 80400089 (Nzcv daIf +PAN -UAO -TCO BTYPE=--) [65161.033199] pc : set_task_select_cpus+0x8c/0x3d0 [65161.038865] lr : select_task_rq_fair+0x1c8/0x5cc [65161.044528] sp : ffff800172673ba0 [65161.048888] x29: ffff800172673ba0 x28: ffff00303f22cd00 [65161.055237] x27: 0000000000000027 x26: 0000000000000027 [65161.061583] x25: 0000aaaafd32b180 x24: 0000000000000002 [65161.067925] x23: ffff00303f22cd00 x22: 0000000000000000 [65161.074264] x21: ffff800172673cc4 x20: ffff00303f22cd00 [65161.080603] x19: ffff00303f22d7f4 x18: 0000000000000000 [65161.086938] x17: 0000000000000000 x16: 0000000000000000 [65161.093266] x15: 0000aaaafd365130 x14: 0000000000000000 [65161.099584] x13: 0000000000000000 x12: 0000000000000000 [65161.105892] x11: 0000000000000000 x10: 0000000000000000 [65161.112194] x9 : ffff800010129e80 x8 : 0000000000000000 [65161.118489] x7 : ffff00303f22cd00 x6 : 0000000000000001 [65161.124776] x5 : 0000000000000000 x4 : ffff8000118f5008 [65161.131058] x3 : 0000000000000000 x2 : 0000000000000002 [65161.137331] x1 : ffff800172673cc4 x0 : 0000000000000000 [65161.143598] Call trace: [65161.147005] set_task_select_cpus+0x8c/0x3d0 [65161.152225] select_task_rq_fair+0x1c8/0x5cc [65161.157439] sched_exec+0x94/0x1bc [65161.161782] bprm_execve.part.0+0x60/0x164 [65161.166813] bprm_execve+0x78/0xc0 [65161.171143] do_execveat_common+0x1c4/0x250 [65161.176244] __arm64_sys_execve+0x48/0x70 [65161.181167] invoke_syscall+0x50/0x130 [65161.185824] el0_svc_common.constprop.0+0x158/0x180 [65161.191601] do_el0_svc+0x34/0xe0 [65161.195816] el0_svc+0x20/0x30 [65161.199773] el0_sync_handler+0xb8/0xc0 [65161.204502] el0_sync+0x1e8/0x200 [65161.208712] Code: d50323bf d65f03c0 f941ac00 f941c400 (f9400400) It's panic on task_group(current)->auto_affinity dereference. In the scenario like: CPU0 CPU1 rmdir cgroup free auto_affinity try to wake up select_task_rq_fair auto_affinity(NULL) dereference panic Because there is no protect when remove task from one cgroup with task wakeup, so we need to check auto_affinity is NULL in task_prefer_cpus. Fixes: 90ef693102cc ("sched: Fix possible deadlock in tg_set_dynamic_affinity_mode") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/fair.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 273f6844bc2a..a6145cc1426d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5988,7 +5988,8 @@ static void smart_grid_usage_dec(void) static inline struct cpumask *task_prefer_cpus(struct task_struct *p) { - if (!smart_grid_used()) + if (!smart_grid_used() || + !task_group(p)->auto_affinity) return p->prefer_cpus; if (task_group(p)->auto_affinity->mode == 0) -- 2.34.1

2 1

[PATCH OLK-5.10] crypto: jitter - change subsys_initcall(jent_mod_init) back to module_init(jent_mod_init)
by Xiang Yang 19 Jun '24

19 Jun '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6GL4 -------------------------------- jent_entropy_init depend on the clocksource being initialized, with the subsys_initcall(jent_mod_init) called in arm32, the initialization of clocksource is after jent_mod_init, so change the subsys_initcall in arm32 to module_init. And the fips depend on jitter init, this feature is controlled by CONFIG_CRYPTO_FIPS, so use CONFIG_CRYPTO_FIPS to isolate the case of the fips problem for arm64/x86 with the dependance of clocksource for arm32. Fixes: 793bff91b406 ("[Huawei] crypto: jitter - change module_init(jent_mod_init) to subsys_initcall(jent_mod_init)") Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- crypto/jitterentropy-kcapi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/crypto/jitterentropy-kcapi.c b/crypto/jitterentropy-kcapi.c index b1d7b5a6e61c..4424664496e1 100644 --- a/crypto/jitterentropy-kcapi.c +++ b/crypto/jitterentropy-kcapi.c @@ -214,7 +214,11 @@ static void __exit jent_mod_exit(void) crypto_unregister_rng(&jent_alg); } +#if defined(CONFIG_CRYPTO_FIPS) && (defined(CONFIG_ARM64) || defined(CONFIG_X86)) subsys_initcall(jent_mod_init); +#else +module_init(jent_mod_init); +#endif module_exit(jent_mod_exit); MODULE_LICENSE("Dual BSD/GPL"); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] spi: Fix deadlock when adding SPI controllers on SPI buses
by Zeng Heng 19 Jun '24

19 Jun '24

Mark Brown (1): spi: Fix deadlock when adding SPI controllers on SPI buses Zeng Heng (1): spi: fix kabi breakage in struct spi_controller drivers/spi/spi.c | 15 +++++---------- include/linux/device.h | 8 ++++++++ 2 files changed, 13 insertions(+), 10 deletions(-) -- 2.25.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 19 Jun '24

19 Jun '24

您好！ Kernel 邀请您参加 2024-06-21 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/960944013 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-06-21 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申请，或直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/960944013. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[openeuler:openEuler-1.0-LTS 14909/22966] drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: sparse: sparse: symbol 'hclge_reset_tqp_cmd' was not declared. Should it be static?
by kernel test robot 19 Jun '24

19 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26bfb7d9b0ef31487312e8e9e6eb097acaf5d739 commit: 729f96a4e0c32f1c1bfa60e4ff485aa91890963d [14909/22966] net: hns3: optimize the process of queue reset config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240619/202406191011.L7AJtzLw-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240619/202406191011.L7AJtzLw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406191011.L7AJtzLw-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3345:5: sparse: sparse: symbol 'hclge_set_all_vf_rst' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: sparse: sparse: symbol 'hclge_reset_tqp_cmd' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9603:5: sparse: sparse: symbol 'hclge_reset_rcb' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:11592:21: sparse: sparse: symbol 'hclge_ops' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3345:5: warning: no previous prototype for 'hclge_set_all_vf_rst' [-Wmissing-prototypes] 3345 | int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9556:5: warning: no previous prototype for 'hclge_reset_tqp_cmd' [-Wmissing-prototypes] 9556 | int hclge_reset_tqp_cmd(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9603:5: warning: no previous prototype for 'hclge_reset_rcb' [-Wmissing-prototypes] 9603 | int hclge_reset_rcb(struct hnae3_handle *handle) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:11699:5: warning: no previous prototype for 'hclge_init' [-Wmissing-prototypes] 11699 | int hclge_init(void) | ^~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_get_strings': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:50: warning: '%s' directive output may be truncated writing up to 3359 bytes into a region of size 32 [-Wformat-truncation=] 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~ In function 'hclge_comm_get_strings', inlined from 'hclge_get_strings' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:774:7: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:668:17: note: 'snprintf' output between 1 and 3360 bytes into a destination of size 32 668 | snprintf(buff, ETH_GSTRING_LEN, "%s", strs[i].desc); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h:9, from drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:18: In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); 35- | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 721 | (origin) |= ((val) << (shift)) & (mask); 47- | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:726:9: note: in expansion of macro 'hnae3_set_field' 726 | hnae3_set_field((origin), (0x1 << (shift)), (shift), (val)) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ In function 'hclge_func_reset_cmd', inlined from 'hclge_reset_prepare_wait' at drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3608:9: drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:29: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_prepare_wait': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_func_reset_cmd': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' 720 | (origin) &= (~(mask)); 73- | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:721:18: note: in definition of macro 'hnae3_set_field' 721 | (origin) |= ((val) << (shift)) & (mask); 85- | ^~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3467:9: note: in expansion of macro 'hnae3_set_bit' 3467 | hnae3_set_bit(req->mac_func_reset, HCLGE_CFG_RESET_FUNC_B, 1); | ^~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3468:12: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 3468 | req->fun_reset_vfid = func_id; | ^~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:3462:27: note: at offset 8 into object 'desc' of size 32 3462 | struct hclge_desc desc; | ^~~~ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c: In function 'hclge_reset_rcb': drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c:9619:26: warning: array subscript 'struct hclge_reset_cmd[0]' is partly outside array bounds of 'struct hclge_desc[1]' [-Warray-bounds=] 9619 | hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); | ^~ drivers/net/ethernet/hisilicon/hns3/hnae3.h:720:18: note: in definition of macro 'hnae3_set_field' vim +/hclge_reset_tqp_cmd +9556 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c 9555 > 9556 int hclge_reset_tqp_cmd(struct hnae3_handle *handle) 9557 { 9558 struct hclge_vport *vport = hclge_get_vport(handle); 9559 struct hclge_dev *hdev = vport->back; 9560 u16 reset_try_times = 0; 9561 int reset_status; 9562 u16 queue_gid; 9563 int ret; 9564 u16 i; 9565 9566 for (i = 0; i < handle->kinfo.num_tqps; i++) { 9567 queue_gid = hclge_covert_handle_qid_global(handle, i); 9568 ret = hclge_reset_tqp_cmd_send(hdev, queue_gid, true); 9569 if (ret) { 9570 dev_err(&hdev->pdev->dev, 9571 "failed to send reset tqp cmd, ret = %d\n", 9572 ret); 9573 return ret; 9574 } 9575 9576 while (reset_try_times++ < HCLGE_TQP_RESET_TRY_TIMES) { 9577 reset_status = hclge_get_reset_status(hdev, queue_gid); 9578 if (reset_status) 9579 break; 9580 9581 /* Wait for tqp hw reset */ 9582 usleep_range(1000, 1200); 9583 } 9584 9585 if (reset_try_times >= HCLGE_TQP_RESET_TRY_TIMES) { 9586 dev_err(&hdev->pdev->dev, 9587 "wait for tqp hw reset timeout\n"); 9588 return -ETIME; 9589 } 9590 9591 ret = hclge_reset_tqp_cmd_send(hdev, queue_gid, false); 9592 if (ret) { 9593 dev_err(&hdev->pdev->dev, 9594 "failed to deassert soft reset, ret = %d\n", 9595 ret); 9596 return ret; 9597 } 9598 reset_try_times = 0; 9599 } 9600 return 0; 9601 } 9602 > 9603 int hclge_reset_rcb(struct hnae3_handle *handle) 9604 { 9605 #define HCLGE_RESET_RCB_NOT_SUPPORT 0U 9606 #define HCLGE_RESET_RCB_SUCCESS 1U 9607 struct hclge_vport *vport = hclge_get_vport(handle); 9608 struct hclge_dev *hdev = vport->back; 9609 struct hclge_reset_cmd *req; 9610 struct hclge_desc desc; 9611 u8 return_status; 9612 u16 queue_gid; 9613 int ret; 9614 9615 queue_gid = hclge_covert_handle_qid_global(handle, 0); 9616 9617 req = (struct hclge_reset_cmd *)desc.data; 9618 hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CFG_RST_TRIGGER, false); 9619 hnae3_set_bit(req->fun_reset_rcb, HCLGE_CFG_RESET_RCB_B, 1); 9620 req->fun_reset_rcb_vqid_start = cpu_to_le16(queue_gid); 9621 req->fun_reset_rcb_vqid_num = cpu_to_le16(handle->kinfo.num_tqps); 9622 9623 ret = hclge_cmd_send(&hdev->hw, &desc, 1); 9624 if (ret) { 9625 dev_err(&hdev->pdev->dev, 9626 "failed to send rcb reset cmd, ret = %d\n", ret); 9627 return ret; 9628 } 9629 9630 return_status = req->fun_reset_rcb_return_status; 9631 if (return_status == HCLGE_RESET_RCB_SUCCESS) 9632 return 0; 9633 9634 if (return_status != HCLGE_RESET_RCB_NOT_SUPPORT) { 9635 dev_err(&hdev->pdev->dev, "failed to reset rcb, ret = %u\n", 9636 return_status); 9637 return -EIO; 9638 } 9639 9640 /* if reset rcb cmd is unsupported, we need to send reset tqp cmd 9641 * again to reset all tqps 9642 */ 9643 return hclge_reset_tqp_cmd(handle); 9644 } 9645 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/5] cachefiles: Introduce failover mechanism for on-demand mode
by Zizhi Wo 19 Jun '24

19 Jun '24

Introduce failover mechanism for on-demand mode Jia Zhu (5): cachefiles: introduce object ondemand state cachefiles: extract ondemand info field from cachefiles_object cachefiles: resend an open request if the read request's object is closed cachefiles: narrow the scope of triggering EPOLLIN events in ondemand mode cachefiles: add restore command to recover inflight ondemand read requests fs/cachefiles/daemon.c | 15 +++- fs/cachefiles/interface.c | 7 +- fs/cachefiles/internal.h | 59 +++++++++++++- fs/cachefiles/ondemand.c | 166 ++++++++++++++++++++++++++++---------- 4 files changed, 201 insertions(+), 46 deletions(-) -- 2.39.2

2 6

[openeuler:openEuler-1.0-LTS 11568/22966] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_led.c:37:39: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 19 Jun '24

19 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26bfb7d9b0ef31487312e8e9e6eb097acaf5d739 commit: eb3a8c90a2b27a2f2dbe26e8a2e7edff6b61417c [11568/22966] net: HNS3: Increase the dft for the command of led config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240619/202406190521.KlNZgJpz-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240619/202406190521.KlNZgJpz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406190521.KlNZgJpz-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_led.c:37:39: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_led.c:37:39: sparse: expected unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_led.c:37:39: sparse: got restricted __le32 vim +37 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_led.c 10 11 int hns3_led_cfg_ncl_info(struct hns3_nic_priv *net_priv, void *buf_in, 12 u32 in_size, void *buf_out, u32 out_size) 13 { 14 struct hnae3_handle *handle = hns3_get_handle(net_priv->netdev); 15 struct hclge_vport *vport = hns3_cae_get_vport(handle); 16 struct led_statistic_param *parm_out = buf_out; 17 struct hclge_dev *hdev = vport->back; 18 struct hclge_desc desc = {0}; 19 bool check; 20 int index; 21 int ret; 22 23 check = !buf_out || out_size < sizeof(struct led_statistic_param); 24 if (check) { 25 pr_err("input param buf_out error in %s function\n", __func__); 26 return -EFAULT; 27 } 28 29 hns3_cae_cmd_setup_basic_desc(&desc, HCLGE_OPC_LED_CFG_NCL_INFO, true); 30 ret = hns3_cae_cmd_send(hdev, &desc, 1); 31 if (ret) { 32 dev_err(&hdev->pdev->dev, "send led command failed %d\n", ret); 33 return ret; 34 } 35 36 for (index = 0; index < HCLGE_DESC_DATA_LEN; index++) > 37 parm_out->data[index] = desc.data[index]; -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 11566/22966] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:29:22: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 19 Jun '24

19 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26bfb7d9b0ef31487312e8e9e6eb097acaf5d739 commit: cf7415aa7aae0ef2c815ab271528a29a5ea68c51 [11566/22966] net: hns3: cae module now provides an independent pfc storm cfg feature config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240619/202406190057.DrPNl3Zc-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240619/202406190057.DrPNl3Zc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406190057.DrPNl3Zc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:29:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] dir @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:29:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:29:22: sparse: got unsigned int [usertype] dir >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:30:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] enable @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:30:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:30:22: sparse: got unsigned int [usertype] enable >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:31:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] period_ms @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:31:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:31:22: sparse: got unsigned int [usertype] period_ms >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:32:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] times @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:32:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:32:22: sparse: got unsigned int [usertype] times >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:33:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] recovery_period_ms @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:33:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:33:22: sparse: got unsigned int [usertype] recovery_period_ms drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:74:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int [usertype] dir @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:74:22: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:74:22: sparse: got unsigned int [usertype] dir >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:84:48: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] enable @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:84:48: sparse: expected unsigned int [usertype] enable drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:84:48: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:85:51: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] period_ms @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:85:51: sparse: expected unsigned int [usertype] period_ms drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:85:51: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:86:47: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] times @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:86:47: sparse: expected unsigned int [usertype] times drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:86:47: sparse: got restricted __le32 >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:87:60: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] recovery_period_ms @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:87:60: sparse: expected unsigned int [usertype] recovery_period_ms drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c:87:60: sparse: got restricted __le32 vim +29 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c 8 9 static int hns3_cae_set_pfc_storm_cfg(struct hns3_nic_priv *net_priv, 10 void *buf_in, u32 in_size) 11 { 12 struct cmd_pfc_storm_param *prelude_in; 13 struct net_device *netdev; 14 struct hclge_vport *vport; 15 struct hnae3_handle *h; 16 struct hclge_dev *hdev; 17 struct hclge_desc desc; 18 int ret; 19 20 prelude_in = (struct cmd_pfc_storm_param *)buf_in; 21 netdev = net_priv->netdev; 22 h = hns3_get_handle(netdev); 23 vport = hns3_cae_get_vport(h); 24 hdev = vport->back; 25 26 hns3_cae_cmd_setup_basic_desc(&desc, 27 HCLGE_OPC_CFG_PAUSE_STORM_PARA, 28 false); > 29 desc.data[0] = prelude_in->pfc_storm_param_mkii.dir; > 30 desc.data[1] = prelude_in->pfc_storm_param_mkii.enable; > 31 desc.data[2] = prelude_in->pfc_storm_param_mkii.period_ms; > 32 desc.data[3] = prelude_in->pfc_storm_param_mkii.times; > 33 desc.data[4] = prelude_in->pfc_storm_param_mkii.recovery_period_ms; 34 ret = hns3_cae_cmd_send(hdev, &desc, 1); 35 if (ret) { 36 dev_err(&hdev->pdev->dev, "set pfc storm para failed %d\n", 37 ret); 38 return ret; 39 } 40 41 return 0; 42 } 43 44 static int hns3_cae_get_pfc_storm_cfg(struct hns3_nic_priv *net_priv, 45 void *buf_in, u32 in_size, void *buf_out, 46 u32 out_size) 47 { 48 struct cmd_pfc_storm_param *prelude_in; 49 struct cmd_pfc_storm_param *info_dstn; 50 struct net_device *netdev; 51 struct hclge_vport *vport; 52 struct hnae3_handle *h; 53 struct hclge_dev *hdev; 54 struct hclge_desc desc; 55 int check; 56 int ret; 57 58 check = !buf_out || out_size < sizeof(struct cmd_pfc_storm_param); 59 if (check) { 60 pr_err("input param buf_out error in %s.\n", __func__); 61 return -EFAULT; 62 } 63 64 prelude_in = (struct cmd_pfc_storm_param *)buf_in; 65 info_dstn = (struct cmd_pfc_storm_param *)buf_out; 66 netdev = net_priv->netdev; 67 h = hns3_get_handle(netdev); 68 vport = hns3_cae_get_vport(h); 69 hdev = vport->back; 70 71 hns3_cae_cmd_setup_basic_desc(&desc, 72 HCLGE_OPC_CFG_PAUSE_STORM_PARA, 73 true); 74 desc.data[0] = prelude_in->pfc_storm_param_mkii.dir; 75 ret = hns3_cae_cmd_send(hdev, &desc, 1); 76 if (ret) { 77 dev_err(&hdev->pdev->dev, "get pfc storm para failed %d\n", 78 ret); 79 return ret; 80 } 81 82 info_dstn->pfc_storm_param_mkii.dir = 83 prelude_in->pfc_storm_param_mkii.dir; > 84 info_dstn->pfc_storm_param_mkii.enable = desc.data[1]; > 85 info_dstn->pfc_storm_param_mkii.period_ms = desc.data[2]; > 86 info_dstn->pfc_storm_param_mkii.times = desc.data[3]; > 87 info_dstn->pfc_storm_param_mkii.recovery_period_ms = desc.data[4]; 88 89 return 0; 90 } 91 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 00/10] UBIFS: fixes a series of issues that caused by power cut
by Wang Zhaolong 18 Jun '24

18 Jun '24

Yang Li (1): ubifs: Fix some kernel-doc comments Zheng Yongjun (1): ubifs: Fix spelling mistakes Zhihao Cheng (8): ubifs: Fix unattached xattr inode if powercut happens after deleting ubifs: Don't add xattr inode into orphan area ubifs: Remove insert_dead_orphan from replaying orphan process ubifs: Fix adding orphan entry twice for the same inode ubifs: Move ui->data initialization after initializing security ubifs: Fix space leak when powercut happens in linking tmpfile ubifs: Fix unattached inode when powercut happens in creating ubifs: dbg_orphan_check: Fix missed key type checking fs/ubifs/dir.c | 89 ++++++++++++++---------- fs/ubifs/journal.c | 24 +++++-- fs/ubifs/master.c | 2 +- fs/ubifs/orphan.c | 155 +++++++----------------------------------- fs/ubifs/replay.c | 2 +- fs/ubifs/super.c | 2 +- fs/ubifs/tnc_commit.c | 2 +- fs/ubifs/ubifs.h | 7 +- fs/ubifs/xattr.c | 2 +- 9 files changed, 103 insertions(+), 182 deletions(-) -- 2.34.3

2 11

[PATCH OLK-5.10 00/10] UBIFS: fixes a series of issues that caused by power cut
by Wang Zhaolong 18 Jun '24

18 Jun '24

Yang Li (1): ubifs: Fix some kernel-doc comments Zheng Yongjun (1): ubifs: Fix spelling mistakes Zhihao Cheng (8): ubifs: Fix unattached xattr inode if powercut happens after deleting ubifs: Don't add xattr inode into orphan area ubifs: Remove insert_dead_orphan from replaying orphan process ubifs: Fix adding orphan entry twice for the same inode ubifs: Move ui->data initialization after initializing security ubifs: Fix space leak when powercut happens in linking tmpfile ubifs: Fix unattached inode when powercut happens in creating ubifs: dbg_orphan_check: Fix missed key type checking fs/ubifs/dir.c | 89 ++++++++++++++---------- fs/ubifs/journal.c | 24 +++++-- fs/ubifs/master.c | 2 +- fs/ubifs/orphan.c | 155 +++++++----------------------------------- fs/ubifs/replay.c | 2 +- fs/ubifs/super.c | 2 +- fs/ubifs/tnc_commit.c | 2 +- fs/ubifs/ubifs.h | 7 +- fs/ubifs/xattr.c | 2 +- 9 files changed, 103 insertions(+), 182 deletions(-) -- 2.34.3

2 11

[PATCH openEuler-1.0-LTS] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
by Chen Zhongjin 18 Jun '24

18 Jun '24

From: Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org> stable inclusion from stable-v4.19.198 commit 04bd77ef4f4d9fc6102023b85f4590fc2130aac5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4FH CVE: CVE-2021-47346 -------------------------------- commit 5fae8a946ac2df879caf3f79a193d4766d00239b upstream. commit 6f755e85c332 ("coresight: Add helper for inserting synchronization packets") removed trailing '\0' from barrier_pkt array and updated the call sites like etb_update_buffer() to have proper checks for barrier_pkt size before read but missed updating tmc_update_etf_buffer() which still reads barrier_pkt past the array size resulting in KASAN out-of-bounds bug. Fix this by adding a check for barrier_pkt size before accessing like it is done in etb_update_buffer(). BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698 Read of size 4 at addr ffffffd05b7d1030 by task perf/2629 Call trace: dump_backtrace+0x0/0x27c show_stack+0x20/0x2c dump_stack+0x11c/0x188 print_address_description+0x3c/0x4a4 __kasan_report+0x140/0x164 kasan_report+0x10/0x18 __asan_report_load4_noabort+0x1c/0x24 tmc_update_etf_buffer+0x4b8/0x698 etm_event_stop+0x248/0x2d8 etm_event_del+0x20/0x2c event_sched_out+0x214/0x6f0 group_sched_out+0xd0/0x270 ctx_sched_out+0x2ec/0x518 __perf_event_task_sched_out+0x4fc/0xe6c __schedule+0x1094/0x16a0 preempt_schedule_irq+0x88/0x170 arm64_preempt_schedule_irq+0xf0/0x18c el1_irq+0xe8/0x180 perf_event_exec+0x4d8/0x56c setup_new_exec+0x204/0x400 load_elf_binary+0x72c/0x18c0 search_binary_handler+0x13c/0x420 load_script+0x500/0x6c4 search_binary_handler+0x13c/0x420 exec_binprm+0x118/0x654 __do_execve_file+0x77c/0xba4 __arm64_compat_sys_execve+0x98/0xac el0_svc_common+0x1f8/0x5e0 el0_svc_compat_handler+0x84/0xb0 el0_svc_compat+0x10/0x50 The buggy address belongs to the variable: barrier_pkt+0x10/0x40 Memory state around the buggy address: ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00 ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03 ^ ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa ================================================================== Link: https://lore.kernel.org/r/20210505093430.18445-1-saiprakash.ranjan@codeauro… Fixes: 0c3fc4d5fa26 ("coresight: Add barrier packet for synchronisation") Cc: stable(a)vger.kernel.org Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan(a)codeaurora.org> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Signed-off-by: Mathieu Poirier <mathieu.poirier(a)linaro.org> Link: https://lore.kernel.org/r/20210614175901.532683-6-mathieu.poirier@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c index e31061308e19..988cbb5f3e0b 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etf.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c @@ -472,7 +472,7 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev, buf_ptr = buf->data_pages[cur] + offset; *buf_ptr = readl_relaxed(drvdata->base + TMC_RRD); - if (lost && *barrier) { + if (lost && i < CORESIGHT_BARRIER_PKT_SIZE) { *buf_ptr = *barrier; barrier++; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/4] A Solution to Re-enable hugetlb vmemmap optimize on ARM64
by Nanyong Sun 18 Jun '24

18 Jun '24

HVO was previously disabled on arm64 [1] due to the lack of necessary BBM(break-before-make) logic when changing page tables. This set of patches fix this by adding necessary BBM sequence when changing page table, and supporting vmemmap page fault handling to fixup kernel address translation fault if vmemmap is concurrently accessed. I have tested this patch set with concurrently accessing the vmemmap address when do BBM and can recover by vmemmap fault handler. Also tested under the config of 2/3/4 pgtable levels with 4K/64K page size and all works well. [1] commit 060a2c92d1b6 ("arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP") Mark Rutland (1): arm64: mm: kfence: only handle translation faults Nanyong Sun (2): mm: HVO: introduce helper function to update and flush pgtable arm64: mm: HVO: support BBM of vmemmap pgtable safely Wang Kefeng (1): ARM: 9278/1: kfence: only handle translation faults arch/arm/mm/fault.c | 18 +++++- arch/arm/mm/fault.h | 9 ++- arch/arm64/include/asm/esr.h | 4 ++ arch/arm64/include/asm/pgtable.h | 6 ++ arch/arm64/include/asm/tlbflush.h | 16 +++++ arch/arm64/mm/fault.c | 98 +++++++++++++++++++++++++++++-- arch/arm64/mm/mmu.c | 29 +++++++++ mm/sparse-vmemmap.c | 49 +++++++++++++--- 8 files changed, 211 insertions(+), 18 deletions(-) -- 2.25.1

2 5

[openeuler:openEuler-1.0-LTS 11564/22966] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:53:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static?
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26bfb7d9b0ef31487312e8e9e6eb097acaf5d739 commit: 9e1cec03a3abb934592272fc19603d00bb62f7cb [11564/22966] net: hns3: place cae entrance procedure implementations in a separate file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240618/202406182019.kf6McR7e-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240618/202406182019.kf6McR7e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406182019.kf6McR7e-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:53:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:54:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:57:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:58:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: got void *in_buff >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: got void *out_buf >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: got void * vim +/g_hns3_cae_class +53 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c 52 > 53 struct class *g_hns3_cae_class; > 54 struct cdev g_hns3_cae_cdev; 55 static const char hns3_driver_name[] = "hns3"; 56 > 57 int g_hns3_cae_init_flag; > 58 int g_hns3_cae_ref_cnt; 59 60 typedef int (*driv_module) (struct hns3_nic_priv *nic_dev, void *buf_in, 61 u32 in_size, void *buf_out, u32 out_size); 62 63 struct drv_module_handle { 64 enum driver_cmd_type driv_cmd_name; 65 driv_module driv_func; 66 }; 67 68 static void free_buff_in(void *buf_in) 69 { 70 if (!buf_in) 71 return; 72 73 kfree(buf_in); 74 } 75 76 static int alloc_buff_in(struct msg_module *nt_msg, u32 in_size, void **buf_in) 77 { 78 void *msg_buf; 79 80 if (!in_size) 81 return 0; 82 83 if (in_size > MAX_MSG_IN_SIZE) { 84 pr_err("msg in size(%u) more than %u\n", 85 in_size, MAX_MSG_IN_SIZE); 86 return -ENOMEM; 87 } 88 89 msg_buf = kzalloc((unsigned long)in_size, GFP_KERNEL); 90 *buf_in = msg_buf; 91 if (ZERO_OR_NULL_PTR(*buf_in)) { 92 pr_err("alloc buf_in failed\n"); 93 return -ENOMEM; 94 } 95 > 96 if (copy_from_user(msg_buf, nt_msg->in_buff, (unsigned long)in_size)) { 97 pr_err("Copy from user failed in %s function\n", __func__); 98 kfree(msg_buf); 99 return -EFAULT; 100 } 101 102 return 0; 103 } 104 105 static void free_buff_out(void *buf_out) 106 { 107 if (!buf_out) 108 return; 109 110 kfree(buf_out); 111 } 112 113 static int alloc_buff_out(u32 out_size, void **buf_out) 114 { 115 if (!out_size) 116 return 0; 117 118 if (out_size > MAX_MSG_OUT_SIZE) { 119 pr_err("msg out size(%u) more than %u\n", 120 out_size, MAX_MSG_OUT_SIZE); 121 return -ENOMEM; 122 } 123 124 *buf_out = kzalloc((unsigned long)out_size, GFP_KERNEL); 125 if (ZERO_OR_NULL_PTR(*buf_out)) { 126 pr_err("alloc buf_out failed\n"); 127 return -ENOMEM; 128 } 129 130 return 0; 131 } 132 133 static int copy_buf_out_to_user(struct msg_module *nt_msg, u32 out_size, 134 void **buf_out) 135 { 136 int ret = 0; 137 void *msg_out = buf_out; 138 > 139 if (copy_to_user(nt_msg->out_buf, msg_out, out_size)) 140 ret = -EFAULT; 141 142 return ret; 143 } 144 145 static int hns3_cae_netdev_match_check(struct net_device *netdev) 146 { 147 struct ethtool_drvinfo drv_info; 148 149 if (netdev->ethtool_ops->get_drvinfo) 150 netdev->ethtool_ops->get_drvinfo(netdev, &drv_info); 151 152 if (!strncmp(drv_info.driver, hns3_driver_name, 153 strlen(hns3_driver_name))) 154 return 0; 155 156 netdev_err(netdev, "match hns3 driver name(%s) failed\n", 157 drv_info.driver); 158 return -1; 159 } 160 161 #if (KERNEL_VERSION(4, 16, 0) < LINUX_VERSION_CODE) 162 static int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg) 163 { 164 mm_segment_t oldfs = get_fs(); 165 int err; 166 167 set_fs(KERNEL_DS); 168 err = sock->ops->ioctl(sock, cmd, arg); 169 set_fs(oldfs); 170 171 return err; 172 } 173 #endif 174 175 static struct net_device *get_netdev_by_ifname(char *ifname) 176 { 177 struct socket *temp_sock = NULL; 178 struct net_device *netdev = NULL; 179 struct ifreq ifr; 180 int err; 181 182 err = sock_create(PF_INET, SOCK_DGRAM, 0, &temp_sock); 183 if (err < 0) { 184 pr_err("fail to enter sock_create, err = %d\n", err); 185 return NULL; 186 } 187 188 strncpy(ifr.ifr_ifrn.ifrn_name, ifname, (unsigned long)IFNAMSIZ); 189 kernel_sock_ioctl(temp_sock, SIOCSIFNAME, (unsigned long)&ifr); 190 netdev = dev_get_by_name(sock_net(temp_sock->sk), ifname); 191 if (!netdev) 192 goto out; 193 194 dev_put(netdev); 195 196 out: 197 sock_release(temp_sock); 198 return netdev; 199 } 200 201 static int hns3_cae_k_get_netdev_by_ifname(char *ifname, 202 struct hns3_nic_priv **nic_dev) 203 { 204 struct net_device *netdev = NULL; 205 206 netdev = get_netdev_by_ifname(ifname); 207 if (!netdev) { 208 pr_err("not find the netdevice(%s)!\n", ifname); 209 return -EFAULT; 210 } 211 212 if (hns3_cae_netdev_match_check(netdev)) { 213 netdev_err(netdev, "netdevice is not hns device.\n"); 214 return -EFAULT; 215 } 216 217 *nic_dev = (struct hns3_nic_priv *)netdev_priv(netdev); 218 if (!(*nic_dev)) { 219 netdev_err(netdev, "no private data\n"); 220 return -EFAULT; 221 } 222 223 return 0; 224 } 225 > 226 struct drv_module_handle driv_module_cmd_handle[] = { 227 {FW_VER, hns3_cae_get_fw_ver}, 228 {DRIVER_VER, hns3_cae_get_driver_ver}, 229 {CHECKSUM_CFG, hns3_cae_chs_cfg}, 230 {TM_QUEUE_CFG, hns3_cae_queue_cfg}, 231 {TM_QSET_CFG, hns3_cae_qs_cfg}, 232 {TM_PRI_CFG, hns3_cae_pri_cfg}, 233 {TM_PG_CFG, hns3_cae_pg_cfg}, 234 {TM_PORT_CFG, hns3_cae_port_cfg}, 235 {TM_ETS_CFG, hns3_cae_ets_cfg}, 236 {DCB_MODE_CFG, hns3_cae_dcb_cfg}, 237 {ETS_MODE_CFG, hns3_cae_dcb_ets_cfg}, 238 {PFC_MODE_CFG, hns3_cae_dcb_pfc_cfg}, 239 {MAC_LOOP_CFG, hns3_cae_mac_loop_cfg}, 240 {DFX_INFO_CMD, hns3_cae_get_dfx_info}, 241 {DFX_READ_CMD, hns3_cae_read_dfx_info}, 242 {EVENT_INJECTION_CMD, hns3_cae_event_injection}, 243 {SEND_PKT, hns3_cae_send_pkt}, 244 {RX_PRIV_BUFF_WL_CFG, hns3_cae_rx_priv_buff_wl_cfg}, 245 {RX_COMMON_THRD_CFG, hns3_cae_common_thrd_cfg}, 246 {RX_COMMON_WL_CFG, hns3_cae_common_wl_cfg}, 247 {SHOW_RX_PRIV_WL, hns3_cae_show_rx_priv_wl}, 248 {SHOW_RX_COMM_THRES, hns3_cae_show_comm_thres}, 249 {QCN_EN_CFG, hns3_cae_qcn_cfg}, 250 {RX_BUFF_CFG, hns3_cae_rx_buff_cfg}, 251 {TX_BUFF_CFG, hns3_cae_tx_buff_cfg}, 252 {RESET_CFG, hns3_cae_nic_reset}, 253 {TIMEOUT_CFG, hns3_cae_nic_timeout_cfg}, 254 {PROMISC_MODE_CFG, hns3_promisc_mode_cfg}, 255 {QINFO_CFG, hns3_cae_qinfo_cfg}, 256 #ifdef CONFIG_IT_VALIDATION 257 {MACTABLE_CFG, hns3_cae_opt_mactbl}, 258 #endif 259 {CLEAN_STATS, hns3_cae_clean_stats}, 260 {FD_CFG, hns3_cae_fd_cfg}, 261 {RSS_GENERIC_CFG, hns3_cae_rss_cfg}, 262 {REG_CFG, hns3_cae_reg_cfg}, 263 {COM_REG_CFG, hns3_cae_common_cmd_send}, 264 {GRO_CFG, hns3_gro_age_handle}, 265 {M7_CMD_MODE_CFG, hns3_m7_cmd_handle}, 266 {QRES_CFG, hns3_cae_qres_cfg}, 267 {STAT_CFG, hns3_stat_mode_cfg}, 268 {IRQ_CFG, hns3_irq_lli_cfg}, 269 {VLAN_UPMAPPING, hns3_cae_upmapping_cfg}, 270 #ifdef CONFIG_EXT_TEST 271 {LAMP_CFG, hns3_lamp_cfg}, 272 {EXTERN_INTERFACE_CFG, hns3_ext_interface_test}, 273 #endif 274 {XSFP_CFG, hns3_xsfp_cfg}, 275 {SHOW_PORT_INFO, hns3_get_port_info}, 276 {SHOW_HILINK_PARAM, hns3_get_hilink_param}, 277 {DCQCN_PARM_CFG, hns3_nic_dcqcn}, 278 {DCQCN_GET_MSG_CNT_CMD, hns3_dcqcn_get_msg_cnt} 279 }; 280 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] genirq: introduce handle_fasteoi_edge_irq flow handler
by Yipeng Zou 18 Jun '24

18 Jun '24

Rebase to here Yipeng Zou (2): genirq: introduce handle_fasteoi_edge_irq flow handler genirq: introduce handle_fasteoi_edge_irq for phytium drivers/irqchip/irq-gic-phytium-2500.c | 2 +- drivers/irqchip/irq-gic-v3.c | 2 +- include/linux/irq.h | 1 + kernel/irq/chip.c | 67 ++++++++++++++++++++++++++ 4 files changed, 70 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/3] A Solution to Re-enable hugetlb vmemmap optimize on ARM64
by Nanyong Sun 18 Jun '24

18 Jun '24

HVO was previously disabled on arm64 [1] due to the lack of necessary BBM(break-before-make) logic when changing page tables. This set of patches fix this by adding necessary BBM sequence when changing page table, and supporting vmemmap page fault handling to fixup kernel address translation fault if vmemmap is concurrently accessed. I have tested this patch set with concurrently accessing the vmemmap address when do BBM and can recover by vmemmap fault handler. Also tested under the config of 2/3/4 pgtable levels with 4K/64K page size and all works well. [1] commit 060a2c92d1b6 ("arm64: mm: hugetlb: Disable HUGETLB_PAGE_OPTIMIZE_VMEMMAP") Mark Rutland (1): arm64: mm: kfence: only handle translation faults Nanyong Sun (2): mm: HVO: introduce helper function to update and flush pgtable arm64: mm: HVO: support BBM of vmemmap pgtable safely arch/arm64/include/asm/esr.h | 4 ++ arch/arm64/include/asm/pgtable.h | 6 ++ arch/arm64/include/asm/tlbflush.h | 16 +++++ arch/arm64/mm/fault.c | 98 +++++++++++++++++++++++++++++-- arch/arm64/mm/mmu.c | 29 +++++++++ mm/sparse-vmemmap.c | 49 +++++++++++++--- 6 files changed, 189 insertions(+), 13 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/2] genirq: introduce handle_fasteoi_edge_irq flow handler
by Yipeng Zou 18 Jun '24

18 Jun '24

Rebase to here Yipeng Zou (2): genirq: introduce handle_fasteoi_edge_irq flow handler genirq: introduce handle_fasteoi_edge_irq for phytium drivers/irqchip/irq-gic-phytium-2500.c | 2 +- drivers/irqchip/irq-gic-v3.c | 2 +- include/linux/irq.h | 1 + kernel/irq/chip.c | 67 ++++++++++++++++++++++++++ 4 files changed, 70 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/scrub/common.c | 4 +--- fs/xfs/xfs_aops.c | 7 ------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 4 files changed, 7 insertions(+), 21 deletions(-) diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c index 23944fcc1a6c..08e292485268 100644 --- a/fs/xfs/scrub/common.c +++ b/fs/xfs/scrub/common.c @@ -978,9 +978,7 @@ xchk_irele( struct xfs_scrub *sc, struct xfs_inode *ip) { - if (current->journal_info != NULL) { - ASSERT(current->journal_info == sc->tp); - + if (sc->tp) { /* * If we are in a transaction, we /cannot/ drop the inode * ourselves, because the VFS will trigger writeback, which diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index a2e1f73f84dd..82f18f28c1c1 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -477,13 +477,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index f4971bd1de05..370c0df1a7a5 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2037,8 +2037,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2046,7 +2048,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 4e38357237c3..ead65f5f8dc3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -277,19 +277,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -297,10 +292,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

2 1

[PATCH OLK-5.10] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/scrub/common.c fs/xfs/xfs_aops.c [ a03297a0ca9f2("xfs: manage inode DONTCACHE status at irele time") is not applied. 21b4ee7029c90("xfs: drop ->writepage completely") is not applied.] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/xfs_aops.c | 13 ------------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index ef7db9defef1..e751cf34ccba 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -552,12 +552,6 @@ xfs_vm_writepage( { struct xfs_writepage_ctx wpc = { }; - if (WARN_ON_ONCE(current->journal_info)) { - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return 0; - } - return iomap_writepage(page, wbc, &wpc.ctx, &xfs_writeback_ops); } @@ -568,13 +562,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index bdf55ed88680..fae443e0d120 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2043,8 +2043,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2052,7 +2054,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 731af3f04c83..d512fdd5f7c3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -271,19 +271,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -291,10 +286,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

2 1

[PATCH OLK-5.10] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/scrub/common.c fs/xfs/xfs_aops.c [ a03297a0ca9f2("xfs: manage inode DONTCACHE status at irele time") is not applied. 21b4ee7029c90("xfs: drop ->writepage completely") is not applied.] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/xfs_aops.c | 13 ------------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index ef7db9defef1..e751cf34ccba 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -552,12 +552,6 @@ xfs_vm_writepage( { struct xfs_writepage_ctx wpc = { }; - if (WARN_ON_ONCE(current->journal_info)) { - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return 0; - } - return iomap_writepage(page, wbc, &wpc.ctx, &xfs_writeback_ops); } @@ -568,13 +562,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index bdf55ed88680..fae443e0d120 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2043,8 +2043,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2052,7 +2054,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 731af3f04c83..d512fdd5f7c3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -271,19 +271,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -291,10 +286,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

1 0

[PATCH OLK-6.6] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/xfs/scrub/common.c | 4 +--- fs/xfs/xfs_aops.c | 7 ------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 4 files changed, 7 insertions(+), 21 deletions(-) diff --git a/fs/xfs/scrub/common.c b/fs/xfs/scrub/common.c index 23944fcc1a6c..08e292485268 100644 --- a/fs/xfs/scrub/common.c +++ b/fs/xfs/scrub/common.c @@ -978,9 +978,7 @@ xchk_irele( struct xfs_scrub *sc, struct xfs_inode *ip) { - if (current->journal_info != NULL) { - ASSERT(current->journal_info == sc->tp); - + if (sc->tp) { /* * If we are in a transaction, we /cannot/ drop the inode * ourselves, because the VFS will trigger writeback, which diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index a2e1f73f84dd..82f18f28c1c1 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -477,13 +477,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index f4971bd1de05..370c0df1a7a5 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2037,8 +2037,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2046,7 +2048,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 4e38357237c3..ead65f5f8dc3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -277,19 +277,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -297,10 +292,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

1 0

[PATCH openEuler-22.03-LTS-SP1] xfs: don't use current->journal_info
by Zhihao Cheng 18 Jun '24

18 Jun '24

From: Dave Chinner <dchinner(a)redhat.com> mainline inclusion from mainline-v6.9-rc2 commit f2e812c1522dab847912309b00abcc762dd696da category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA6CG1 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- syzbot reported an ext4 panic during a page fault where found a journal handle when it didn't expect to find one. The structure it tripped over had a value of 'TRAN' in the first entry in the structure, and that indicates it tripped over a struct xfs_trans instead of a jbd2 handle. The reason for this is that the page fault was taken during a copy-out to a user buffer from an xfs bulkstat operation. XFS uses an "empty" transaction context for bulkstat to do automated metadata buffer cleanup, and so the transaction context is valid across the copyout of the bulkstat info into the user buffer. We are using empty transaction contexts like this in XFS to reduce the risk of failing to release objects we reference during the operation, especially during error handling. Hence we really need to ensure that we can take page faults from these contexts without leaving landmines for the code processing the page fault to trip over. However, this same behaviour could happen from any other filesystem that triggers a page fault or any other exception that is handled on-stack from within a task context that has current->journal_info set. Having a page fault from some other filesystem bounce into XFS where we have to run a transaction isn't a bug at all, but the usage of current->journal_info means that this could result corruption of the outer task's journal_info structure. The problem is purely that we now have two different contexts that now think they own current->journal_info. IOWs, no filesystem can allow page faults or on-stack exceptions while current->journal_info is set by the filesystem because the exception processing might use current->journal_info itself. If we end up with nested XFS transactions whilst holding an empty transaction, then it isn't an issue as the outer transaction does not hold a log reservation. If we ignore the current->journal_info usage, then the only problem that might occur is a deadlock if the exception tries to take the same locks the upper context holds. That, however, is not a problem that setting current->journal_info would solve, so it's largely an irrelevant concern here. IOWs, we really only use current->journal_info for a warning check in xfs_vm_writepages() to ensure we aren't doing writeback from a transaction context. Writeback might need to do allocation, so it can need to run transactions itself. Hence it's a debug check to warn us that we've done something silly, and largely it is not all that useful. So let's just remove all the use of current->journal_info in XFS and get rid of all the potential issues from nested contexts where current->journal_info might get misused by another filesystem context. Reported-by: syzbot+cdee56dbcdf0096ef605(a)syzkaller.appspotmail.com Signed-off-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Mark Tinguely <mark.tinguely(a)oracle.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Chandan Babu R <chandanbabu(a)kernel.org> Conflicts: fs/xfs/scrub/common.c fs/xfs/xfs_aops.c [ a03297a0ca9f2("xfs: manage inode DONTCACHE status at irele time") is not applied. 21b4ee7029c90("xfs: drop ->writepage completely") is not applied.] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/xfs/xfs_aops.c | 13 ------------- fs/xfs/xfs_icache.c | 8 +++++--- fs/xfs/xfs_trans.h | 9 +-------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c index ef7db9defef1..e751cf34ccba 100644 --- a/fs/xfs/xfs_aops.c +++ b/fs/xfs/xfs_aops.c @@ -552,12 +552,6 @@ xfs_vm_writepage( { struct xfs_writepage_ctx wpc = { }; - if (WARN_ON_ONCE(current->journal_info)) { - redirty_page_for_writepage(wbc, page); - unlock_page(page); - return 0; - } - return iomap_writepage(page, wbc, &wpc.ctx, &xfs_writeback_ops); } @@ -568,13 +562,6 @@ xfs_vm_writepages( { struct xfs_writepage_ctx wpc = { }; - /* - * Writing back data in a transaction context can result in recursive - * transactions. This is bad, so issue a warning and get out of here. - */ - if (WARN_ON_ONCE(current->journal_info)) - return 0; - xfs_iflags_clear(XFS_I(mapping->host), XFS_ITRUNCATED); return iomap_writepages(mapping, wbc, &wpc.ctx, &xfs_writeback_ops); } diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c index bdf55ed88680..fae443e0d120 100644 --- a/fs/xfs/xfs_icache.c +++ b/fs/xfs/xfs_icache.c @@ -2043,8 +2043,10 @@ xfs_inodegc_want_queue_work( * - Memory shrinkers queued the inactivation worker and it hasn't finished. * - The queue depth exceeds the maximum allowable percpu backlog. * - * Note: If the current thread is running a transaction, we don't ever want to - * wait for other transactions because that could introduce a deadlock. + * Note: If we are in a NOFS context here (e.g. current thread is running a + * transaction) the we don't want to block here as inodegc progress may require + * filesystem resources we hold to make progress and that could result in a + * deadlock. Hence we skip out of here if we are in a scoped NOFS context. */ static inline bool xfs_inodegc_want_flush_work( @@ -2052,7 +2054,7 @@ xfs_inodegc_want_flush_work( unsigned int items, unsigned int shrinker_hits) { - if (current->journal_info) + if (current->flags & PF_MEMALLOC_NOFS) return false; if (shrinker_hits > 0) diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h index 731af3f04c83..d512fdd5f7c3 100644 --- a/fs/xfs/xfs_trans.h +++ b/fs/xfs/xfs_trans.h @@ -271,19 +271,14 @@ static inline void xfs_trans_set_context( struct xfs_trans *tp) { - ASSERT(current->journal_info == NULL); tp->t_pflags = memalloc_nofs_save(); - current->journal_info = tp; } static inline void xfs_trans_clear_context( struct xfs_trans *tp) { - if (current->journal_info == tp) { - memalloc_nofs_restore(tp->t_pflags); - current->journal_info = NULL; - } + memalloc_nofs_restore(tp->t_pflags); } static inline void @@ -291,10 +286,8 @@ xfs_trans_switch_context( struct xfs_trans *old_tp, struct xfs_trans *new_tp) { - ASSERT(current->journal_info == old_tp); new_tp->t_pflags = old_tp->t_pflags; old_tp->t_pflags = 0; - current->journal_info = new_tp; } #endif /* __XFS_TRANS_H__ */ -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 11561/22966] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 18 Jun '24

18 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26bfb7d9b0ef31487312e8e9e6eb097acaf5d739 commit: fb55aa477dfa7f488f112a8b87116962d623ff63 [11561/22966] net: hns3: place cae regconfig-related implementations in an independent file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240618/202406181827.cAEjNIex-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240618/202406181827.cAEjNIex-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406181827.cAEjNIex-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:51:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:52:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:55:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:56:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: sparse: sparse: symbol 'hns3_cae_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: expected unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: warning: no previous prototype for 'hns3_cae_get_commit_id' [-Wmissing-prototypes] 224 | int hns3_cae_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ vim +597 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c 558 559 int hns3_cae_common_cmd_send(struct hns3_nic_priv *net_priv, void *buf_in, 560 u32 in_size, void *buf_out, u32 out_size) 561 { 562 #define MAX_DESC_DATA_LEN 6 563 struct cmd_desc_param *param_in; 564 struct hclge_vport *vport; 565 struct hclge_dev *hdev; 566 struct hclge_desc desc; 567 bool check; 568 int ret; 569 int i; 570 571 check = !buf_in || in_size < sizeof(struct cmd_desc_param); 572 vport = hns3_cae_get_vport(net_priv->ae_handle); 573 hdev = vport->back; 574 575 param_in = (struct cmd_desc_param *)buf_in; 576 hns3_cae_cmd_setup_basic_desc(&desc, param_in->fw_dw_opcode, 577 param_in->is_read); 578 for (i = 0; i < MAX_DESC_DATA_LEN; i++) 579 desc.data[i] = param_in->reg_desc.data[i]; 580 ret = hns3_cae_cmd_send(hdev, &desc, 1); 581 if (ret) { 582 dev_err(&hdev->pdev->dev, "%s, ret is %d.\n", __func__, 583 ret); 584 return ret; 585 } 586 if (param_in->is_read) { 587 struct cmd_desc_param *param_out = 588 (struct cmd_desc_param *)buf_out; 589 590 check = !buf_out || out_size < sizeof(struct cmd_desc_param); 591 if (check) { 592 pr_err("input param buf_out error in %s function\n", 593 __func__); 594 return -EFAULT; 595 } 596 for (i = 0; i < MAX_DESC_DATA_LEN; i++) > 597 param_out->reg_desc.data[i] = desc.data[i]; -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] fix CVE-2023-52791
by Kaixiong Yu 18 Jun '24

18 Jun '24

Benjamin Bara (2): i2c: core: Run atomic i2c xfer when !preemptible i2c: core: Fix atomic xfer check for non-preempt config drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] block: check io size before submit discard
by Li Nan 18 Jun '24

18 Jun '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9K0H3 -------------------------------- In __blkdev_issue_discard(), q->limits.discard_granularity is read multi times. WARN_ON_ONCE(!q->limits.discard_granularity) [1] ... q->limits.discard_granularity >> SECTOR_SHIFT [2] ... bio_aligned_discard_max_sectors [3] It can be changed to 0 after check [1], such as submitting ioctl 'LOOP_SET_STATUS'. This is undesirable. If 'discard_granularity' is set to 0, BUG_ON might be triggered and the loop of 'while(nr_sects)' will never exit(see fixes commit). Fix it by checking 'req_sects' before submit io, return error code directly if it is 0. Fixes: b35fd7422c2f ("block: check queue's limits.discard_granularity in __blkdev_issue_discard()") Signed-off-by: Li Nan <linan122(a)huawei.com> --- block/blk-lib.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/block/blk-lib.c b/block/blk-lib.c index e90614fd8d6a..59ff99bc4698 100644 --- a/block/blk-lib.c +++ b/block/blk-lib.c @@ -27,7 +27,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, struct bio **biop) { struct request_queue *q = bdev_get_queue(bdev); - struct bio *bio = *biop; + struct bio *bio = NULL; unsigned int op; sector_t bs_mask, part_offset = 0; @@ -92,6 +92,17 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, req_sects = min_t(sector_t, nr_sects, granularity_aligned_lba - sector_mapped); + if (!req_sects) { + /* just put the bio allocated in this function */ + if (bio) { + bio_io_error(bio); + bio_put(bio); + } + return -EOPNOTSUPP; + } + if (!bio) + bio = *biop; + WARN_ON_ONCE((req_sects << 9) > UINT_MAX); bio = blk_next_bio(bio, 0, gfp_mask); -- 2.39.2

2 1