- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] xfs: Fix file creation failure
by Zizhi Wo 30 May '24

30 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9TDTA CVE: NA -------------------------------- In the file system expansion test and concurrent file creation and writing scenarios, file creation fails occasionally. The detailed test scheme is as follows: 1. If the remaining space is less than 128 MB, expand the space by 1 GB; --xfs_growfs /$DEV -D $bc -m 100 2. 32 processes create a file every 0.5s and write 4 KB to 4 MB data randomly. --filesize=$((RANDOM % 1024 + 1)) --dd if=/dev/zero oflag=direct of=$filename bs=4K count=$filesize And when the file creation fails, there are still hundreds of megabytes of free space. The overall analysis process is as follows: Direct write Create file xfs_file_write_iter ... xfs_direct_write_iomap_begin xfs_iomap_write_direct ... xfs_alloc_vextent xfs_alloc_ag_vextent xfs_alloc_ag_vextent_near xfs_alloc_cur_finish xfs_alloc_fixup_trees xfs_btree_delete xfs_btree_delrec xfs_allocbt_update_lastrec /* The longest update is 0 * because numrec == 0. */ agf->agf_longest = len = 0 xfs_create ... xfs_dialloc xfs_ialloc_ag_alloc xfs_alloc_vextent xfs_alloc_fix_freelist xfs_alloc_space_available -> as longest=0, it will return false, no space for inode alloc. The root cause of the problem is that allocation extents holds agf locks, but the inode creation process will quickly check whether there is space firstly, which does not have agf locks. And when the first judgment fails, it returns directly. If the first judgment passes, the lock is held before entering the second judgment, that's how the "check-lock-check again" algorithm is designed. If all AG fails in no lock check, an error will return. This problem occurs probably when there is not enough space left for all the AG's in front, and the last AG deletes the last CNT tree record and the new record is not inserted yet. Fix this issue by adding the bc_free_longest field to the xfs_btree_cur_t structure to store the longest count that will be updated. The assignment is done in xfs_alloc_fixup_trees() and xfs_free_ag_extent(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xfs/libxfs/xfs_alloc.c | 14 ++++++++++++++ fs/xfs/libxfs/xfs_alloc_btree.c | 9 ++++++++- fs/xfs/libxfs/xfs_btree.h | 1 + 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c index b901eedf3bb8..95bfe89651ad 100644 --- a/fs/xfs/libxfs/xfs_alloc.c +++ b/fs/xfs/libxfs/xfs_alloc.c @@ -543,6 +543,13 @@ xfs_alloc_fixup_trees( nfbno2 = rbno + rlen; nflen2 = (fbno + flen) - nfbno2; } + + /* + * Record the potential maximum free length in advance. + */ + if (nfbno1 != NULLAGBLOCK || nfbno2 != NULLAGBLOCK) + cnt_cur->bc_free_longest = max_t(xfs_extlen_t, nflen1, nflen2); + /* * Delete the entry from the by-size btree. */ @@ -2039,6 +2046,13 @@ xfs_free_ag_extent( * Now allocate and initialize a cursor for the by-size tree. */ cnt_cur = xfs_allocbt_init_cursor(mp, tp, agbp, agno, XFS_BTNUM_CNT); + /* + * Record the potential maximum free length in advance. + */ + if (haveleft) + cnt_cur->bc_free_longest = ltlen; + if (haveright) + cnt_cur->bc_free_longest = gtlen; /* * Have both left and right contiguous neighbors. * Merge all three into a single free block. diff --git a/fs/xfs/libxfs/xfs_alloc_btree.c b/fs/xfs/libxfs/xfs_alloc_btree.c index 613a1743fdd5..d6dbbe85e819 100644 --- a/fs/xfs/libxfs/xfs_alloc_btree.c +++ b/fs/xfs/libxfs/xfs_alloc_btree.c @@ -147,7 +147,14 @@ xfs_allocbt_update_lastrec( rrp = XFS_ALLOC_REC_ADDR(cur->bc_mp, block, numrecs); len = rrp->ar_blockcount; } else { - len = 0; + /* + * Update in advance to prevent file creation failure + * for concurrent processes even though there is no + * numrec currently. + * And there's no need to worry as the value that not + * less than bc_free_longest will be inserted later. + */ + len = cpu_to_be32(cur->bc_free_longest); } break; diff --git a/fs/xfs/libxfs/xfs_btree.h b/fs/xfs/libxfs/xfs_btree.h index d172046ae833..1d89b897c056 100644 --- a/fs/xfs/libxfs/xfs_btree.h +++ b/fs/xfs/libxfs/xfs_btree.h @@ -235,6 +235,7 @@ typedef struct xfs_btree_cur struct xfs_btree_cur_ag bc_ag; struct xfs_btree_cur_ino bc_ino; }; + xfs_extlen_t bc_free_longest; /* the actual longest free extent */ } xfs_btree_cur_t; /* cursor flags */ -- 2.39.2

2 1

[PATCH OLK-5.10 0/5] Fix CVE-2023-52732
by Zizhi Wo 30 May '24

30 May '24

Fix CVE-2023-52732. Jeff Layton (4): ceph: drop private list from remove_session_caps_cb ceph: fix auth cap handling logic in remove_session_caps_cb ceph: refactor remove_session_caps_cb ceph: shut down access to inode when async create fails Xiubo Li (1): ceph: blocklist the kclient when receiving corrupted snap trace fs/ceph/addr.c | 24 ++++-- fs/ceph/caps.c | 138 +++++++++++++++++++++++++++++++-- fs/ceph/export.c | 12 ++- fs/ceph/file.c | 13 +++- fs/ceph/inode.c | 33 +++++++- fs/ceph/locks.c | 7 ++ fs/ceph/mds_client.c | 144 ++++++++--------------------------- fs/ceph/snap.c | 36 ++++++++- fs/ceph/super.h | 12 +++ include/linux/ceph/libceph.h | 1 + 10 files changed, 289 insertions(+), 131 deletions(-) -- 2.39.2

2 6

[PATCH openEuler-1.0-LTS v2] powerpc/mm: Fix lockup on kernel exec fault
by Liu Shixin 30 May '24

30 May '24

From: Christophe Leroy <christophe.leroy(a)csgroup.eu> stable inclusion from stable-v5.4.133 commit a82471a14aad90f79d1608d2bcbb019f0ffb53f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4CI CVE: CVE-2021-47350 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd5d5e602f502895e47e18cd46804d6d7014e65c upstream. The powerpc kernel is not prepared to handle exec faults from kernel. Especially, the function is_exec_fault() will return 'false' when an exec fault is taken by kernel, because the check is based on reading current->thread.regs->trap which contains the trap from user. For instance, when provoking a LKDTM EXEC_USERSPACE test, current->thread.regs->trap is set to SYSCALL trap (0xc00), and the fault taken by the kernel is not seen as an exec fault by set_access_flags_filter(). Commit d7df2443cd5f ("powerpc/mm: Fix spurious segfaults on radix with autonuma") made it clear and handled it properly. But later on commit d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") removed that handling, introducing test based on error_code. And here is the problem, because on the 603 all upper bits of SRR1 get cleared when the TLB instruction miss handler bails out to ISI. Until commit cbd7e6ca0210 ("powerpc/fault: Avoid heavy search_exception_tables() verification"), an exec fault from kernel at a userspace address was indirectly caught by the lack of entry for that address in the exception tables. But after that commit the kernel mainly relies on KUAP or on core mm handling to catch wrong user accesses. Here the access is not wrong, so mm handles it. It is a minor fault because PAGE_EXEC is not set, set_access_flags_filter() should set PAGE_EXEC and voila. But as is_exec_fault() returns false as explained in the beginning, set_access_flags_filter() bails out without setting PAGE_EXEC flag, which leads to a forever minor exec fault. As the kernel is not prepared to handle such exec faults, the thing to do is to fire in bad_kernel_fault() for any exec fault taken by the kernel, as it was prior to commit d3ca587404b3. Fixes: d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") Cc: stable(a)vger.kernel.org # v4.14+ Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Acked-by: Nicholas Piggin <npiggin(a)gmail.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/024bb05105050f704743a0083fe3548702be5706.16251382… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/powerpc/mm/fault.c [ Context conflicts due to lack of commit de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection"). ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- arch/powerpc/mm/fault.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c index 5b04d029f824..41f1de87edb6 100644 --- a/arch/powerpc/mm/fault.c +++ b/arch/powerpc/mm/fault.c @@ -221,9 +221,7 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr, static bool bad_kernel_fault(bool is_exec, unsigned long error_code, unsigned long address) { - /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */ - if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT | - DSISR_PROTFAULT))) { + if (is_exec) { printk_ratelimited(KERN_CRIT "kernel tried to execute" " exec-protected page (%lx) -" "exploit attempt? (uid: %d)\n", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] atm: iphase: fix possible use-after-free in ia_module_exit()
by Liu Shixin 30 May '24

30 May '24

From: Zou Wei <zou_wei(a)huawei.com> stable inclusion from stable-v4.19.198 commit 89ce0b0747f319eb70f85bc820dcc43cebbd5417 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4E8 CVE: CVE-2021-47357 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1c72e6ab66b9598cac741ed397438a52065a8f1f ] This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zou Wei <zou_wei(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/atm/iphase.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c index 008905d4152a..827c6d5e6177 100644 --- a/drivers/atm/iphase.c +++ b/drivers/atm/iphase.c @@ -3301,7 +3301,7 @@ static void __exit ia_module_exit(void) { pci_unregister_driver(&ia_driver); - del_timer(&ia_timer); + del_timer_sync(&ia_timer); } module_init(ia_module_init); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS 0/2] CVE-2023-52735
by Pu Lehui 30 May '24

30 May '24

Jakub Sitnicki (2): bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener include/linux/util_macros.h | 12 ++++++++++++ net/core/sock_map.c | 34 ++++++++++++++++++++-------------- net/ipv4/tcp_bpf.c | 4 ++-- 3 files changed, 34 insertions(+), 16 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2023-52735
by Pu Lehui 30 May '24

30 May '24

Jakub Sitnicki (2): bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener include/linux/util_macros.h | 12 ++++++++ net/core/sock_map.c | 59 +++++++++++++++++++++---------------- net/ipv4/tcp_bpf.c | 4 +-- 3 files changed, 47 insertions(+), 28 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
by Liu Chuang 30 May '24

30 May '24

From: Ma Ke <make_ruc2021(a)163.com> stable inclusion from stable-v5.10.202 commit 9acc2bc00135e9ecd13a70ce1140e2673e504cdc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9TCIL CVE: CVE-2023-52826 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f22def5970c423ea7f87d5247bd0ef91416b0658 ] In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke <make_ruc2021(a)163.com> Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://lore.kernel.org/r/20231009090446.4043798-1-make_ruc2021@163.com Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20231009090446.4043798-1-make… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/panel/panel-tpo-tpg110.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/panel/panel-tpo-tpg110.c b/drivers/gpu/drm/panel/panel-tpo-tpg110.c index d57ed75a977c..494cec50a682 100644 --- a/drivers/gpu/drm/panel/panel-tpo-tpg110.c +++ b/drivers/gpu/drm/panel/panel-tpo-tpg110.c @@ -378,6 +378,8 @@ static int tpg110_get_modes(struct drm_panel *panel, connector->display_info.bus_flags = tpg->panel_mode->bus_flags; mode = drm_mode_duplicate(connector->dev, &tpg->panel_mode->mode); + if (!mode) + return -ENOMEM; drm_mode_set_name(mode); mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: conntrack: serialize hash resizes and cleanups
by Liu Jian 30 May '24

30 May '24

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v5.15-rc4 commit e9edc188fc76499b0b9bd60364084037f6d03773 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4NQ CVE: CVE-2021-47408 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Syzbot was able to trigger the following warning [1] No repro found by syzbot yet but I was able to trigger similar issue by having 2 scripts running in parallel, changing conntrack hash sizes, and: for j in `seq 1 1000` ; do unshare -n /bin/true >/dev/null ; done It would take more than 5 minutes for net_namespace structures to be cleaned up. This is because nf_ct_iterate_cleanup() has to restart everytime a resize happened. By adding a mutex, we can serialize hash resizes and cleanups and also make get_next_corpse() faster by skipping over empty buckets. Even without resizes in the picture, this patch considerably speeds up network namespace dismantles. [1] INFO: task syz-executor.0:8312 can't die for more than 144 seconds. task:syz-executor.0 state:R running task stack:25672 pid: 8312 ppid: 6573 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:4955 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6236 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6408 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35 __local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390 local_bh_enable include/linux/bottom_half.h:32 [inline] get_next_corpse net/netfilter/nf_conntrack_core.c:2252 [inline] nf_ct_iterate_cleanup+0x15a/0x450 net/netfilter/nf_conntrack_core.c:2275 nf_conntrack_cleanup_net_list+0x14c/0x4f0 net/netfilter/nf_conntrack_core.c:2469 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171 setup_net+0x639/0xa30 net/core/net_namespace.c:349 copy_net_ns+0x319/0x760 net/core/net_namespace.c:470 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3128 __do_sys_unshare kernel/fork.c:3202 [inline] __se_sys_unshare kernel/fork.c:3200 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3200 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f63da68e739 RSP: 002b:00007f63d7c05188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f63da792f80 RCX: 00007f63da68e739 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007f63da6e8cc4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f63da792f80 R13: 00007fff50b75d3f R14: 00007f63d7c05300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8b980020 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446 2 locks held by kworker/u4:2/153: #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268 #1: ffffc9000140fdb0 ((kfence_timer).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272 1 lock held by systemd-udevd/2970: 1 lock held by in:imklog/6258: #0: ffff88807f970ff0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990 3 locks held by kworker/1:6/8158: 1 lock held by syz-executor.0/8312: 2 locks held by kworker/u4:13/9320: 1 lock held by syz-executor.5/10178: 1 lock held by syz-executor.4/10217: Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_core.c [This is because we did not backport commit 4608fdfc07e1.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_conntrack_core.c | 70 ++++++++++++++++--------------- 1 file changed, 37 insertions(+), 33 deletions(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 6bfdc8f6e961..755e1cee32cb 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -81,6 +81,9 @@ static __read_mostly spinlock_t nf_conntrack_locks_all_lock; static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock); static __read_mostly bool nf_conntrack_locks_all; +/* serialize hash resizes and nf_ct_iterate_cleanup */ +static DEFINE_MUTEX(nf_conntrack_mutex); + /* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */ #define GC_MAX_BUCKETS_DIV 128u /* upper bound of full table scan */ @@ -2054,28 +2057,31 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data), spinlock_t *lockp; for (; *bucket < nf_conntrack_htable_size; (*bucket)++) { + struct hlist_nulls_head *hslot = &nf_conntrack_hash[*bucket]; + + if (hlist_nulls_empty(hslot)) + continue; + lockp = &nf_conntrack_locks[*bucket % CONNTRACK_LOCKS]; local_bh_disable(); nf_conntrack_lock(lockp); - if (*bucket < nf_conntrack_htable_size) { - hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnnode) { - if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY) - continue; - /* All nf_conn objects are added to hash table twice, one - * for original direction tuple, once for the reply tuple. - * - * Exception: In the IPS_NAT_CLASH case, only the reply - * tuple is added (the original tuple already existed for - * a different object). - * - * We only need to call the iterator once for each - * conntrack, so we just use the 'reply' direction - * tuple while iterating. - */ - ct = nf_ct_tuplehash_to_ctrack(h); - if (iter(ct, data)) - goto found; - } + hlist_nulls_for_each_entry(h, n, hslot, hnnode) { + if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY) + continue; + /* All nf_conn objects are added to hash table twice, one + * for original direction tuple, once for the reply tuple. + * + * Exception: In the IPS_NAT_CLASH case, only the reply + * tuple is added (the original tuple already existed for + * a different object). + * + * We only need to call the iterator once for each + * conntrack, so we just use the 'reply' direction + * tuple while iterating. + */ + ct = nf_ct_tuplehash_to_ctrack(h); + if (iter(ct, data)) + goto found; } spin_unlock(lockp); local_bh_enable(); @@ -2093,26 +2099,20 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data), static void nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data), void *data, u32 portid, int report) { - unsigned int bucket = 0, sequence; + unsigned int bucket = 0; struct nf_conn *ct; might_sleep(); - for (;;) { - sequence = read_seqcount_begin(&nf_conntrack_generation); - - while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) { - /* Time to push up daises... */ + mutex_lock(&nf_conntrack_mutex); + while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) { + /* Time to push up daises... */ - nf_ct_delete(ct, portid, report); - nf_ct_put(ct); - cond_resched(); - } - - if (!read_seqcount_retry(&nf_conntrack_generation, sequence)) - break; - bucket = 0; + nf_ct_delete(ct, portid, report); + nf_ct_put(ct); + cond_resched(); } + mutex_unlock(&nf_conntrack_mutex); } struct iter_data { @@ -2346,8 +2346,10 @@ int nf_conntrack_hash_resize(unsigned int hashsize) if (!hash) return -ENOMEM; + mutex_lock(&nf_conntrack_mutex); old_size = nf_conntrack_htable_size; if (old_size == hashsize) { + mutex_unlock(&nf_conntrack_mutex); kvfree(hash); return 0; } @@ -2383,6 +2385,8 @@ int nf_conntrack_hash_resize(unsigned int hashsize) nf_conntrack_all_unlock(); local_bh_enable(); + mutex_unlock(&nf_conntrack_mutex); + synchronize_net(); kvfree(old_hash); return 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] locking/ww_mutex/test: Fix potential workqueue corruption
by Xie XiuQi 30 May '24

30 May '24

From: John Stultz <jstultz(a)google.com> mainline inclusion from mainline-v6.7-rc1 commit bccdd808902f8c677317cec47c306e42b93b849e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFIG CVE: CVE-2023-52836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In some cases running with the test-ww_mutex code, I was seeing odd behavior where sometimes it seemed flush_workqueue was returning before all the work threads were finished. Often this would cause strange crashes as the mutexes would be freed while they were being used. Looking at the code, there is a lifetime problem as the controlling thread that spawns the work allocates the "struct stress" structures that are passed to the workqueue threads. Then when the workqueue threads are finished, they free the stress struct that was passed to them. Unfortunately the workqueue work_struct node is in the stress struct. Which means the work_struct is freed before the work thread returns and while flush_workqueue is waiting. It seems like a better idea to have the controlling thread both allocate and free the stress structures, so that we can be sure we don't corrupt the workqueue by freeing the structure prematurely. So this patch reworks the test to do so, and with this change I no longer see the early flush_workqueue returns. Signed-off-by: John Stultz <jstultz(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com (cherry picked from commit bccdd808902f8c677317cec47c306e42b93b849e) Signed-off-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- kernel/locking/test-ww_mutex.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c index 65a3b7e55b9f..4fd05d9d5d6d 100644 --- a/kernel/locking/test-ww_mutex.c +++ b/kernel/locking/test-ww_mutex.c @@ -439,7 +439,6 @@ static void stress_inorder_work(struct work_struct *work) } while (!time_after(jiffies, stress->timeout)); kfree(order); - kfree(stress); } struct reorder_lock { @@ -504,7 +503,6 @@ static void stress_reorder_work(struct work_struct *work) list_for_each_entry_safe(ll, ln, &locks, link) kfree(ll); kfree(order); - kfree(stress); } static void stress_one_work(struct work_struct *work) @@ -525,8 +523,6 @@ static void stress_one_work(struct work_struct *work) break; } } while (!time_after(jiffies, stress->timeout)); - - kfree(stress); } #define STRESS_INORDER BIT(0) @@ -537,15 +533,24 @@ static void stress_one_work(struct work_struct *work) static int stress(int nlocks, int nthreads, unsigned int flags) { struct ww_mutex *locks; - int n; + struct stress *stress_array; + int n, count; locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL); if (!locks) return -ENOMEM; + stress_array = kmalloc_array(nthreads, sizeof(*stress_array), + GFP_KERNEL); + if (!stress_array) { + kfree(locks); + return -ENOMEM; + } + for (n = 0; n < nlocks; n++) ww_mutex_init(&locks[n], &ww_class); + count = 0; for (n = 0; nthreads; n++) { struct stress *stress; void (*fn)(struct work_struct *work); @@ -569,9 +574,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags) if (!fn) continue; - stress = kmalloc(sizeof(*stress), GFP_KERNEL); - if (!stress) - break; + stress = &stress_array[count++]; INIT_WORK(&stress->work, fn); stress->locks = locks; @@ -586,6 +589,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags) for (n = 0; n < nlocks; n++) ww_mutex_destroy(&locks[n]); + kfree(stress_array); kfree(locks); return 0; -- 2.20.1

2 1

[openeuler:OLK-6.6 6865/9792] drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h:21:26: error: called object is not a function or function pointer
by kernel test robot 30 May '24

30 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c0b6b4438dc70167c4c16f6436499cde257f782a commit: 6adab536d69347a10c2366aaf6b86de963d5994b [6865/9792] drivers: initial support for rnpvf drivers from Mucse Technology config: loongarch-randconfig-002-20240530 (https://download.01.org/0day-ci/archive/20240530/202405300821.FdTsPW2u-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240530/202405300821.FdTsPW2u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405300821.FdTsPW2u-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:127:6: warning: no previous prototype for 'rnpvf_unmap_and_free_tx_resource' [-Wmissing-prototypes] 127 | void rnpvf_unmap_and_free_tx_resource(struct rnpvf_ring *ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:1365:6: warning: no previous prototype for 'rnpvf_alloc_rx_buffers' [-Wmissing-prototypes] 1365 | void rnpvf_alloc_rx_buffers(struct rnpvf_ring *rx_ring, u16 cleaned_count) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_clean_rx_irq': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:1659:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1659 | bool xdp_xmit = false; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: At top level: drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:1945:6: warning: no previous prototype for 'update_rx_count' [-Wmissing-prototypes] 1945 | void update_rx_count(int cleaned, struct rnpvf_q_vector *q_vector) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2420:6: warning: no previous prototype for 'rnpvf_write_eitr_rx' [-Wmissing-prototypes] 2420 | void rnpvf_write_eitr_rx(struct rnpvf_q_vector *q_vector) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2523:6: warning: no previous prototype for 'rnpvf_configure_tx_ring' [-Wmissing-prototypes] 2523 | void rnpvf_configure_tx_ring(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2589:6: warning: no previous prototype for 'rnpvf_disable_rx_queue' [-Wmissing-prototypes] 2589 | void rnpvf_disable_rx_queue(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2595:6: warning: no previous prototype for 'rnpvf_enable_rx_queue' [-Wmissing-prototypes] 2595 | void rnpvf_enable_rx_queue(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2601:6: warning: no previous prototype for 'rnpvf_configure_rx_ring' [-Wmissing-prototypes] 2601 | void rnpvf_configure_rx_ring(struct rnpvf_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_vlan_rx_kill_vid': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:2736:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 2736 | int err = -EOPNOTSUPP; | ^~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_acquire_msix_vectors': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:3307:13: warning: variable 'vector_threshold' set but not used [-Wunused-but-set-variable] 3307 | int vector_threshold; | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'irq_miss_check': drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:3456:26: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 3456 | struct rnpvf_hw *hw; | ^~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: At top level: drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:4590:6: warning: no previous prototype for 'rnpvf_tx_ctxtdesc' [-Wmissing-prototypes] 4590 | void rnpvf_tx_ctxtdesc(struct rnpvf_ring *tx_ring, u16 mss_seg_len, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5039:6: warning: no previous prototype for 'rnpvf_maybe_tx_ctxtdesc' [-Wmissing-prototypes] 5039 | void rnpvf_maybe_tx_ctxtdesc(struct rnpvf_ring *tx_ring, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5089:13: warning: no previous prototype for 'rnpvf_xmit_frame_ring' [-Wmissing-prototypes] 5089 | netdev_tx_t rnpvf_xmit_frame_ring(struct sk_buff *skb, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5580:6: warning: no previous prototype for 'rnpvf_assign_netdev_ops' [-Wmissing-prototypes] 5580 | void rnpvf_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/mucse/rnpvf/vf.h:14, from drivers/net/ethernet/mucse/rnpvf/rnpvf.h:14, from drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:26: drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c: In function 'rnpvf_vfnum': >> drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h:21:26: error: called object is not a function or function pointer 21 | #define RNP_DMA_RX_START (0x10) | ^ drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h:104:42: note: in definition of macro 'rnpvf_rd_reg' 104 | #define rnpvf_rd_reg(reg) readl((void *)(reg)) | ^~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5599:21: note: in expansion of macro 'rd32' 5599 | v = rd32(hw, RNP_DMA_RX_START(ring)); | ^~~~ drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5599:30: note: in expansion of macro 'RNP_DMA_RX_START' 5599 | v = rd32(hw, RNP_DMA_RX_START(ring)); | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.c:5591:13: warning: unused variable 'pfvfnum_reg' [-Wunused-variable] 5591 | u32 pfvfnum_reg; | ^~~~~~~~~~~ vim +21 drivers/net/ethernet/mucse/rnpvf/rnpvf_regs.h 13 14 #define RNP_DMA_RING_BASE 0x8000 15 #define RNP_DMA_RX_DESC_TIMEOUT_TH 0x8000 16 #define RNP_DMA_TX_DESC_FETCH_CTL 0x8004 17 #define RNP_DMA_TX_FLOW_CTRL_TM 0x8008 18 #define RNP_RING_BASE_N10 (0x8000) 19 #define RNP_RING_BASE_N500 (0x1000) 20 #define RNP_RING_OFFSET(i) (0x100 * (i)) > 21 #define RNP_DMA_RX_START (0x10) 22 #define RNP_DMA_RX_READY (0x14) 23 #define RNP_DMA_TX_START (0x18) 24 #define RNP_DMA_TX_READY (0x1c) 25 #define RNP_DMA_INT_STAT (0x20) 26 #define RNP_DMA_INT_MASK (0x24) 27 #define TX_INT_MASK (0x1 << 1) 28 #define RX_INT_MASK (0x1 << 0) 29 #define RNP_DMA_INT_CLR (0x28) 30 #define RNP_DMA_INT_TRIG (0x2c) 31 #define RNP_DMA_REG_RX_DESC_BUF_BASE_ADDR_HI (0x30) 32 #define RNP_DMA_REG_RX_DESC_BUF_BASE_ADDR_LO (0x34) 33 #define RNP_DMA_REG_RX_DESC_BUF_LEN (0x38) 34 #define RNP_DMA_REG_RX_DESC_BUF_HEAD (0x3c) 35 #define RNP_DMA_REG_RX_DESC_BUF_TAIL (0x40) 36 #define RNP_DMA_REG_RX_DESC_FETCH_CTRL (0x44) 37 #define RNP_DMA_REG_RX_INT_DELAY_TIMER (0x48) 38 #define RNP_DMA_REG_RX_INT_DELAY_PKTCNT (0x4c) 39 #define RNP_DMA_REG_RX_ARB_DEF_LVL (0x50) 40 #define PCI_DMA_REG_RX_DESC_TIMEOUT_TH (0x54) 41 #define PCI_DMA_REG_RX_SCATTER_LENGTH (0x58) 42 #define RNP_DMA_REG_TX_DESC_BUF_BASE_ADDR_HI (0x60) 43 #define RNP_DMA_REG_TX_DESC_BUF_BASE_ADDR_LO (0x64) 44 #define RNP_DMA_REG_TX_DESC_BUF_LEN (0x68) 45 #define RNP_DMA_REG_TX_DESC_BUF_HEAD (0x6c) 46 #define RNP_DMA_REG_TX_DESC_BUF_TAIL (0x70) 47 #define RNP_DMA_REG_TX_DESC_FETCH_CTRL (0x74) 48 #define RNP_DMA_REG_TX_INT_DELAY_TIMER (0x78) 49 #define RNP_DMA_REG_TX_INT_DELAY_PKTCNT (0x7c) 50 #define RNP_DMA_REG_TX_ARB_DEF_LVL (0x80) 51 #define RNP_DMA_REG_TX_FLOW_CTRL_TH (0x84) 52 #define RNP_DMA_REG_TX_FLOW_CTRL_TM (0x88) 53 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION aec283517697385e25d19ae7312a63bad805b4a7
by kernel test robot 30 May '24

30 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: aec283517697385e25d19ae7312a63bad805b4a7 !7804 v2 selinux: avoid dereference of garbage after mount failure Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405292306.oKi0pqkq-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405300401.gTFtRxYB-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/hid/i2c-hid/.tmp_i2c-hid-core.o: warning: objtool: missing symbol for section .exit.text drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c:234:30: error: no member named 'physfn' in 'struct pci_dev' drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:53:32: error: no member named 'physfn' in 'struct pci_dev' Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-004-20240530 | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20240527 | `-- drivers-hid-i2c-hid-.tmp_i2c-hid-core.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-randconfig-013-20240530 | `-- kernel-sched-sparsemask.h:warning:array-subscript-is-outside-array-bounds-of-const-struct-sparsemask_chunk |-- x86_64-randconfig-014-20240530 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-randconfig-076-20240530 `-- kernel-sched-sparsemask.h:warning:array-subscript-is-outside-array-bounds-of-const-struct-sparsemask_chunk clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- fs-f2fs-.tmp_recovery.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20240530 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-buildonly-randconfig-002-20240530 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-004-20240530 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-015-20240530 | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_adapter_mgmt.c:error:no-member-named-physfn-in-struct-pci_dev | `-- drivers-net-ethernet-3snic-sssnic-hw-sss_pci_probe.c:error:no-member-named-physfn-in-struct-pci_dev `-- x86_64-randconfig-072-20240530 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension elapsed time: 817m configs tested: 35 configs skipped: 148 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240529 gcc arm64 randconfig-002-20240529 gcc arm64 randconfig-003-20240529 gcc arm64 randconfig-004-20240529 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240530 clang x86_64 buildonly-randconfig-002-20240530 clang x86_64 buildonly-randconfig-003-20240530 gcc x86_64 buildonly-randconfig-004-20240530 gcc x86_64 buildonly-randconfig-005-20240530 clang x86_64 buildonly-randconfig-006-20240530 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240530 clang x86_64 randconfig-002-20240530 clang x86_64 randconfig-003-20240530 clang x86_64 randconfig-004-20240530 clang x86_64 randconfig-005-20240530 clang x86_64 randconfig-006-20240530 clang x86_64 randconfig-011-20240530 clang x86_64 randconfig-012-20240530 gcc x86_64 randconfig-013-20240530 gcc x86_64 randconfig-014-20240530 gcc x86_64 randconfig-015-20240530 clang x86_64 randconfig-016-20240530 gcc x86_64 randconfig-071-20240530 clang x86_64 randconfig-072-20240530 clang x86_64 randconfig-073-20240530 clang x86_64 randconfig-074-20240530 clang x86_64 randconfig-075-20240530 gcc x86_64 randconfig-076-20240530 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION c0b6b4438dc70167c4c16f6436499cde257f782a
by kernel test robot 30 May '24

30 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c0b6b4438dc70167c4c16f6436499cde257f782a !7948 【OLK-6.6】Fix BUILD REGRESSION warnings in bzwx N5/N6 series NIC drivers Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202405300112.F3n9I6tZ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405300401.Q7EpPsSe-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202405300505.GzvBHBcM-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/gpu/drm/phytium/phytium_pci.c:236:9: error: call to undeclared function 'pci_enable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] drivers/gpu/drm/phytium/phytium_pci.c:271:3: error: call to undeclared function 'pci_disable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1008:35: error: 'struct rnpm_tx_buffer' has no member named 'gso_need_padding' drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6449:38: error: 'struct rnpm_tx_buffer' has no member named 'gso_need_padding' vgettimeofday.c:(.text+0x28): undefined reference to `__tsan_volatile_read4' vgettimeofday.c:(.text+0x584): undefined reference to `__tsan_write8' vgettimeofday.c:(.text.startup+0x8): undefined reference to `__tsan_init' Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-003-20240530 | |-- vgettimeofday.c:(.text):undefined-reference-to-__tsan_volatile_read4 | |-- vgettimeofday.c:(.text):undefined-reference-to-__tsan_write8 | `-- vgettimeofday.c:(.text.startup):undefined-reference-to-__tsan_init |-- loongarch-alldefconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) `-- loongarch-randconfig-002-20240530 |-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:error:struct-rnpm_tx_buffer-has-no-member-named-gso_need_padding `-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:error:struct-rnpm_tx_buffer-has-no-member-named-gso_need_padding clang_recent_errors |-- arm64-allmodconfig | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-004-20240530 | |-- drivers-char-ipmi-ipmi_bt_sm.c:error:call-to-undeclared-function-acpi_evaluate_integer-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:call-to-undeclared-function-pci_disable_msi-ISO-C99-and-later-do-not-support-implicit-function-declarations | |-- drivers-gpu-drm-phytium-phytium_pci.c:error:call-to-undeclared-function-pci_enable_msi-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- mm-page_alloc.c:error:call-to-undeclared-function-dynamic_pool_should_alloc-ISO-C99-and-later-do-not-support-implicit-function-declarations `-- x86_64-randconfig-161-20240530 `-- arch-x86-kernel-zhaoxin_kh40000.c:warning:bitwise-or-with-non-zero-value-always-evaluates-to-true elapsed time: 741m configs tested: 17 configs skipped: 142 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240530 clang arm64 randconfig-002-20240530 gcc arm64 randconfig-003-20240530 gcc arm64 randconfig-004-20240530 clang loongarch alldefconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240530 gcc loongarch randconfig-002-20240530 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS c7a6065e6fa19c661225cda7f76c04f2bd5cf381
by kernel test robot 30 May '24

30 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c7a6065e6fa19c661225cda7f76c04f2bd5cf381 !8238 arm: unwinder: Fix pc off-by-one in arm unwinder Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:common-qp.h-is-included-more-than-once. |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 745m configs tested: 35 configs skipped: 146 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240529 clang arm64 randconfig-002-20240529 clang arm64 randconfig-003-20240529 gcc arm64 randconfig-004-20240529 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240530 clang x86_64 buildonly-randconfig-002-20240530 clang x86_64 buildonly-randconfig-003-20240530 gcc x86_64 buildonly-randconfig-004-20240530 gcc x86_64 buildonly-randconfig-005-20240530 clang x86_64 buildonly-randconfig-006-20240530 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240530 clang x86_64 randconfig-002-20240530 clang x86_64 randconfig-003-20240530 clang x86_64 randconfig-004-20240530 clang x86_64 randconfig-005-20240530 clang x86_64 randconfig-006-20240530 clang x86_64 randconfig-011-20240530 clang x86_64 randconfig-012-20240530 gcc x86_64 randconfig-013-20240530 gcc x86_64 randconfig-014-20240530 gcc x86_64 randconfig-015-20240530 clang x86_64 randconfig-016-20240530 gcc x86_64 randconfig-071-20240530 clang x86_64 randconfig-072-20240530 clang x86_64 randconfig-073-20240530 clang x86_64 randconfig-074-20240530 clang x86_64 randconfig-075-20240530 gcc x86_64 randconfig-076-20240530 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 4037/9792] drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6449:38: error: 'struct rnpm_tx_buffer' has no member named 'gso_need_padding'
by kernel test robot 30 May '24

30 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c0b6b4438dc70167c4c16f6436499cde257f782a commit: 5deaf74c4b3edcf88f67f18aa352690deb9dc212 [4037/9792] drivers: initial support for rnpm drivers from Mucse Technology config: loongarch-randconfig-002-20240530 (https://download.01.org/0day-ci/archive/20240530/202405300505.GzvBHBcM-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240530/202405300505.GzvBHBcM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405300505.GzvBHBcM-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpm/rnpm_main.c:256:6: warning: no previous prototype for 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 256 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1137:5: warning: no previous prototype for 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1137 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: In function 'rnpm_clean_rx_irq': drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2015:14: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 2015 | bool xdp_xmit = false; | ^~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: At top level: drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2207:6: warning: no previous prototype for 'rnpm_write_eitr' [-Wmissing-prototypes] 2207 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3013:5: warning: no previous prototype for 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 3013 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3037:5: warning: no previous prototype for 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 3037 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3909:6: warning: no previous prototype for 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3909 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:4031:6: warning: no previous prototype for 'control_mac_rx' [-Wmissing-prototypes] 4031 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5803:6: warning: no previous prototype for 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5803 | void rnpm_pf_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5821:6: warning: no previous prototype for 'rnpm_service_timer' [-Wmissing-prototypes] 5821 | void rnpm_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5962:21: warning: no previous prototype for 'wait_all_port_resetting' [-Wmissing-prototypes] 5962 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5974:21: warning: no previous prototype for 'clean_all_port_resetting' [-Wmissing-prototypes] 5974 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6185:5: warning: no previous prototype for 'rnpm_check_mc_addr' [-Wmissing-prototypes] 6185 | int rnpm_check_mc_addr(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6211:6: warning: no previous prototype for 'update_pf_vlan' [-Wmissing-prototypes] 6211 | void update_pf_vlan(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6262:6: warning: no previous prototype for 'rnpm_pf_service_task' [-Wmissing-prototypes] 6262 | void rnpm_pf_service_task(struct work_struct *work) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: In function 'rnpm_tso': >> drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6449:38: error: 'struct rnpm_tx_buffer' has no member named 'gso_need_padding' 6449 | first->gso_need_padding = !!gso_need_pad; | ^~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: In function 'rnpm_tx_csum': drivers/net/ethernet/mucse/rnpm/rnpm_main.c:6517:30: error: 'struct rnpm_tx_buffer' has no member named 'gso_need_padding' 6517 | first->gso_need_padding = true; | ^~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c: At top level: drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7528:6: warning: no previous prototype for 'rnpm_clear_udp_tunnel_port' [-Wmissing-prototypes] 7528 | void rnpm_clear_udp_tunnel_port(struct rnpm_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7692:6: warning: no previous prototype for 'rnpm_assign_netdev_ops' [-Wmissing-prototypes] 7692 | void rnpm_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:7785:6: warning: no previous prototype for 'rnpm_fix_queue_number' [-Wmissing-prototypes] 7785 | void rnpm_fix_queue_number(struct rnpm_hw *hw) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:8760:5: warning: no previous prototype for 'rnpm_can_rpu_start' [-Wmissing-prototypes] 8760 | int rnpm_can_rpu_start(struct rnpm_pf_adapter *pf_adapter) | ^~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnpm/rnpm_lib.c: In function 'rnpm_maybe_tx_ctxtdesc': >> drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1008:35: error: 'struct rnpm_tx_buffer' has no member named 'gso_need_padding' 1008 | if (!first->gso_need_padding) | ^~ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1010:30: error: 'struct rnpm_tx_buffer' has no member named 'gso_need_padding' 1010 | first->gso_need_padding = false; | ^~ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c: At top level: drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1185:6: warning: no previous prototype for 'rnpm_setup_layer2_remapping' [-Wmissing-prototypes] 1185 | void rnpm_setup_layer2_remapping(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1209:6: warning: no previous prototype for 'rnpm_setup_tuple5_remapping' [-Wmissing-prototypes] 1209 | void rnpm_setup_tuple5_remapping(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_lib.c:1280:6: warning: no previous prototype for 'rnpm_setup_tuple5_remapping_tcam' [-Wmissing-prototypes] 1280 | void rnpm_setup_tuple5_remapping_tcam(struct rnpm_hw *hw, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +6449 drivers/net/ethernet/mucse/rnpm/rnpm_main.c 6309 6310 static int rnpm_tso(struct rnpm_ring *tx_ring, struct rnpm_tx_buffer *first, 6311 u8 *hdr_len) 6312 { 6313 struct rnpm_adapter *adapter = netdev_priv(tx_ring->netdev); 6314 struct sk_buff *skb = first->skb; 6315 union { 6316 struct iphdr *v4; 6317 struct ipv6hdr *v6; 6318 unsigned char *hdr; 6319 } ip; 6320 union { 6321 struct tcphdr *tcp; 6322 struct udphdr *udp; 6323 unsigned char *hdr; 6324 } l4; 6325 u32 paylen, l4_offset; 6326 int err; 6327 u8 *inner_mac; 6328 u16 gso_segs, gso_size; 6329 u16 gso_need_pad; 6330 6331 if (skb->ip_summed != CHECKSUM_PARTIAL) 6332 return 0; 6333 6334 if (!skb_is_gso(skb)) 6335 return 0; 6336 6337 err = skb_cow_head(skb, 0); 6338 if (err < 0) 6339 return err; 6340 6341 inner_mac = skb->data; 6342 ip.hdr = skb_network_header(skb); 6343 l4.hdr = skb_transport_header(skb); 6344 6345 first->tx_flags |= 6346 RNPM_TXD_FLAG_TSO | RNPM_TXD_IP_CSUM | RNPM_TXD_L4_CSUM; 6347 6348 /* initialize outer IP header fields */ 6349 if (ip.v4->version == 4) { 6350 /* IP header will have to cancel out any data that 6351 * is not a part of the outer IP header 6352 */ 6353 ip.v4->check = 0x0000; 6354 } else { 6355 ip.v6->payload_len = 0; 6356 } 6357 #ifdef HAVE_ENCAP_TSO_OFFLOAD 6358 if (skb_shinfo(skb)->gso_type & 6359 (SKB_GSO_GRE | 6360 #ifdef NETIF_F_GSO_PARTIAL 6361 SKB_GSO_GRE_CSUM | 6362 #endif 6363 SKB_GSO_UDP_TUNNEL | SKB_GSO_UDP_TUNNEL_CSUM)) { 6364 #ifndef NETIF_F_GSO_PARTIAL 6365 if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM) { 6366 #else 6367 if (!(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) && 6368 (skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM)) { 6369 #endif 6370 } 6371 /* we should always do this */ 6372 inner_mac = skb_inner_mac_header(skb); 6373 6374 first->tunnel_hdr_len = (inner_mac - skb->data); 6375 if (skb_shinfo(skb)->gso_type & 6376 (SKB_GSO_UDP_TUNNEL | SKB_GSO_UDP_TUNNEL_CSUM)) { 6377 first->tx_flags |= RNPM_TXD_TUNNEL_VXLAN; 6378 l4.udp->check = 0; 6379 tx_dbg("set outer l4.udp to 0\n"); 6380 } else { 6381 first->tx_flags |= RNPM_TXD_TUNNEL_NVGRE; 6382 } 6383 6384 /* reset pointers to inner headers */ 6385 ip.hdr = skb_inner_network_header(skb); 6386 l4.hdr = skb_inner_transport_header(skb); 6387 } 6388 6389 #endif /* HAVE_ENCAP_TSO_OFFLOAD */ 6390 if (ip.v4->version == 4) { 6391 /* IP header will have to cancel out any data that 6392 * is not a part of the outer IP header 6393 */ 6394 ip.v4->check = 0x0000; 6395 6396 } else { 6397 ip.v6->payload_len = 0; 6398 /* set ipv6 type */ 6399 6400 first->tx_flags |= (RNPM_TXD_FLAG_IPv6); 6401 } 6402 6403 /* determine offset of inner transport header */ 6404 l4_offset = l4.hdr - skb->data; 6405 6406 paylen = skb->len - l4_offset; 6407 tx_dbg("before l4 checksum is %x\n", l4.tcp->check); 6408 6409 // csum_replace_by_diff(&l4.tcp->check, htonl(paylen)); 6410 6411 tx_dbg("l4 checksum is %x\n", l4.tcp->check); 6412 6413 if (skb->csum_offset == offsetof(struct tcphdr, check)) { 6414 tx_dbg("tcp before l4 checksum is %x\n", l4.tcp->check); 6415 // first->tx_flags |= RNP_TXD_L4_TYPE_TCP; 6416 first->tx_flags |= RNPM_TXD_L4_TYPE_TCP; 6417 /* compute length of segmentation header */ 6418 *hdr_len = (l4.tcp->doff * 4) + l4_offset; 6419 csum_replace_by_diff(&l4.tcp->check, 6420 (__force __wsum)htonl(paylen)); 6421 tx_dbg("tcp l4 checksum is %x\n", l4.tcp->check); 6422 // we should clear tcp.flags.push flas 6423 l4.tcp->psh = 0; 6424 } else { 6425 tx_dbg("paylen is %x\n", paylen); 6426 // first->tx_flags |= RNP_TXD_L4_TYPE_UDP; 6427 first->tx_flags |= RNPM_TXD_L4_TYPE_UDP; 6428 /* compute length of segmentation header */ 6429 tx_dbg("udp before l4 checksum is %x\n", l4.udp->check); 6430 *hdr_len = sizeof(*l4.udp) + l4_offset; 6431 csum_replace_by_diff(&l4.udp->check, 6432 (__force __wsum)htonl(paylen)); 6433 tx_dbg("udp l4 checksum is %x\n", l4.udp->check); 6434 } 6435 6436 first->mac_ip_len = l4.hdr - ip.hdr; 6437 first->mac_ip_len |= (ip.hdr - inner_mac) << 9; 6438 /* pull values out of skb_shinfo */ 6439 gso_size = skb_shinfo(skb)->gso_size; 6440 gso_segs = skb_shinfo(skb)->gso_segs; 6441 6442 if (adapter->priv_flags & RNPM_PRIV_FLAG_TX_PADDING) { 6443 gso_need_pad = (first->skb->len - *hdr_len) % gso_size; 6444 if (gso_need_pad) { 6445 if ((gso_need_pad + *hdr_len) <= 6446 tx_ring->gso_padto_bytes) { 6447 gso_need_pad = tx_ring->gso_padto_bytes - 6448 (gso_need_pad + *hdr_len); > 6449 first->gso_need_padding = !!gso_need_pad; 6450 } 6451 } 6452 } 6453 /* update gso size and bytecount with header size */ 6454 /* to fix tx status */ 6455 first->gso_segs = gso_segs; 6456 first->bytecount += (first->gso_segs - 1) * *hdr_len; 6457 6458 first->mss_len_vf_num |= (gso_size | ((l4.tcp->doff * 4) << 24)); 6459 // rnpm_tx_ctxtdesc(tx_ring,skb_shinfo(skb)->gso_size ,l4len, 0, 0, 6460 // type_tucmd); 6461 6462 first->ctx_flag = true; 6463 return 1; 6464 } 6465 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 701/9792] vgettimeofday.c:undefined reference to `__tsan_volatile_read4'
by kernel test robot 30 May '24

30 May '24

Hi Andrew, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c0b6b4438dc70167c4c16f6436499cde257f782a commit: f9b54a6714445cde83aeff0318cf767b3b81229d [701/9792] arm64:ilp32: add ARM64_ILP32 to Kconfig config: arm64-randconfig-003-20240530 (https://download.01.org/0day-ci/archive/20240530/202405300401.Q7EpPsSe-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240530/202405300401.Q7EpPsSe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405300401.Q7EpPsSe-lkp@intel.com/ All errors (new ones prefixed by >>): scripts/genksyms/parse.y: warning: 9 shift/reduce conflicts [-Wconflicts-sr] scripts/genksyms/parse.y: warning: 5 reduce/reduce conflicts [-Wconflicts-rr] scripts/genksyms/parse.y: note: rerun with option '-Wcounterexamples' to generate conflict counterexamples arch/arm64/kernel/vdso-ilp32/Makefile:87: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:84: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:90: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:68: FORCE prerequisite is missing ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__cvdso_gettimeofday_data.constprop.0': >> vgettimeofday.c:(.text+0x28): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x40): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x6c): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x7c): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x88): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x94): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0xa0): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0xb0): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0xc0): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x120): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x12c): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x184): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x190): undefined reference to `__tsan_write4' ld: vgettimeofday.c:(.text+0x19c): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x1a8): undefined reference to `__tsan_write4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__cvdso_clock_gettime_data.constprop.0': vgettimeofday.c:(.text+0x24c): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x264): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x298): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2a8): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2b4): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2c4): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x2d0): undefined reference to `__tsan_read4' ld: vgettimeofday.c:(.text+0x2e0): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x2f0): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x350): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x35c): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x438): undefined reference to `__tsan_volatile_read4' ld: vgettimeofday.c:(.text+0x44c): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x458): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x464): undefined reference to `__tsan_read8' ld: vgettimeofday.c:(.text+0x470): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x480): undefined reference to `__tsan_volatile_read4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `__kernel_clock_getres': >> vgettimeofday.c:(.text+0x584): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x590): undefined reference to `__tsan_write8' ld: vgettimeofday.c:(.text+0x5c0): undefined reference to `__tsan_volatile_read4' ld: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o: in function `_sub_I_00099_0': >> vgettimeofday.c:(.text.startup+0x8): undefined reference to `__tsan_init' collect2: error: ld returned 1 exit status make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:68: arch/arm64/kernel/vdso-ilp32/vdso-ilp32.so.dbg] Error 1 shuffle=1722226854 make[3]: Target 'include/generated/vdso-ilp32-offsets.h' not remade because of errors. make[2]: *** [arch/arm64/Makefile:201: vdso_prepare] Error 2 shuffle=1722226854 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 shuffle=1722226854 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 shuffle=1722226854 make: Target 'prepare' not remade because of errors. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM64_ERRATUM_845719 Depends on [n]: AARCH32_EL0 [=n] Selected by [y]: - ARCH_MXC [=y] && ARCH_NXP [=y] && COMPAT [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 21121/22575] drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c:234:30: error: no member named 'physfn' in 'struct pci_dev'
by kernel test robot 30 May '24

30 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: aec283517697385e25d19ae7312a63bad805b4a7 commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [21121/22575] Net: ethernet: Support 3snic 3s9xx network card config: x86_64-randconfig-015-20240530 (https://download.01.org/0day-ci/archive/20240530/202405300401.gTFtRxYB-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240530/202405300401.gTFtRxYB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405300401.gTFtRxYB-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c:234:30: error: no member named 'physfn' in 'struct pci_dev' 234 | pf_pdev = adapter->pcidev->physfn; | ~~~~~~~~~~~~~~~ ^ 1 error generated. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:53:32: error: no member named 'physfn' in 'struct pci_dev' 53 | dev = pdev->is_virtfn ? pdev->physfn : pdev; | ~~~~ ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:84:31: warning: shift count >= width of type [-Wshift-count-overflow] 84 | ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(64)); | ^~~~~~~~~~~~~~~~ include/linux/dma-mapping.h:149:54: note: expanded from macro 'DMA_BIT_MASK' 149 | #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) | ^ ~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:95:42: warning: shift count >= width of type [-Wshift-count-overflow] 95 | ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)); | ^~~~~~~~~~~~~~~~ include/linux/dma-mapping.h:149:54: note: expanded from macro 'DMA_BIT_MASK' 149 | #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) | ^ ~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:5: warning: no previous prototype for function 'sss_attach_uld_driver' [-Wmissing-prototypes] 276 | int sss_attach_uld_driver(struct sss_pci_adapter *adapter, | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 276 | int sss_attach_uld_driver(struct sss_pci_adapter *adapter, | ^ | static drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:319:39: error: no member named 'physfn' in 'struct pci_dev' 319 | dev = (pdev->is_virtfn != 0) ? pdev->physfn : pdev; | ~~~~ ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:548:5: warning: no previous prototype for function 'sss_pci_probe' [-Wmissing-prototypes] 548 | int sss_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ^ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:548:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 548 | int sss_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ^ | static 4 warnings and 2 errors generated. vim +234 drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c 221 222 static unsigned char sss_get_pci_bus_id(struct sss_pci_adapter *adapter) 223 { 224 struct pci_dev *pf_pdev = NULL; 225 unsigned char bus_id = 0; 226 227 if (!pci_is_root_bus(adapter->pcidev->bus)) 228 bus_id = adapter->pcidev->bus->number; 229 230 if (bus_id == 0) 231 return bus_id; 232 233 if (adapter->pcidev->is_virtfn) { > 234 pf_pdev = adapter->pcidev->physfn; 235 bus_id = pf_pdev->bus->number; 236 } 237 238 return bus_id; 239 } 240 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3405/9792] drivers/gpu/drm/phytium/phytium_pci.c:236:9: error: call to undeclared function 'pci_enable_msi'; ISO C99 and later do not support implicit function declarations
by kernel test robot 30 May '24

30 May '24

Hi Li, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c0b6b4438dc70167c4c16f6436499cde257f782a commit: 792b82446538ed840a6e23b89673ce21564702bd [3405/9792] Fix gic support for Phytium S2500 config: arm64-randconfig-004-20240530 (https://download.01.org/0day-ci/archive/20240530/202405300112.F3n9I6tZ-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project bafda89a0944d947fc4b3b5663185e07a397ac30) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240530/202405300112.F3n9I6tZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405300112.F3n9I6tZ-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/gpu/drm/phytium/phytium_pci.c:7: In file included from include/linux/pci.h:2106: In file included from arch/arm64/include/asm/pci.h:7: In file included from include/linux/dma-mapping.h:11: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ drivers/gpu/drm/phytium/phytium_pci.c:23:6: warning: no previous prototype for function 'phytium_pci_vram_hw_init' [-Wmissing-prototypes] 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:23:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 23 | void phytium_pci_vram_hw_init(struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:30:5: warning: no previous prototype for function 'phytium_pci_vram_init' [-Wmissing-prototypes] 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:30:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 30 | int phytium_pci_vram_init(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:68:6: warning: no previous prototype for function 'phytium_pci_vram_fini' [-Wmissing-prototypes] 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:68:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 68 | void phytium_pci_vram_fini(struct pci_dev *pdev, struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:89:5: warning: no previous prototype for function 'phytium_pci_dma_init' [-Wmissing-prototypes] 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:89:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 89 | int phytium_pci_dma_init(struct phytium_display_private *priv) | ^ | static drivers/gpu/drm/phytium/phytium_pci.c:137:6: warning: no previous prototype for function 'phytium_pci_dma_fini' [-Wmissing-prototypes] 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^ drivers/gpu/drm/phytium/phytium_pci.c:137:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 137 | void phytium_pci_dma_fini(struct phytium_display_private *priv) | ^ | static >> drivers/gpu/drm/phytium/phytium_pci.c:236:9: error: call to undeclared function 'pci_enable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 236 | ret = pci_enable_msi(pdev); | ^ >> drivers/gpu/drm/phytium/phytium_pci.c:271:3: error: call to undeclared function 'pci_disable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 271 | pci_disable_msi(pdev); | ^ drivers/gpu/drm/phytium/phytium_pci.c:271:3: note: did you mean 'pci_disable_sriov'? include/linux/pci.h:2437:20: note: 'pci_disable_sriov' declared here 2437 | static inline void pci_disable_sriov(struct pci_dev *dev) { } | ^ drivers/gpu/drm/phytium/phytium_pci.c:291:3: error: call to undeclared function 'pci_disable_msi'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 291 | pci_disable_msi(pdev); | ^ 6 warnings and 3 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] vim +/pci_enable_msi +236 drivers/gpu/drm/phytium/phytium_pci.c b80df10f845813 lishuo 2024-01-31 136 b80df10f845813 lishuo 2024-01-31 @137 void phytium_pci_dma_fini(struct phytium_display_private *priv) b80df10f845813 lishuo 2024-01-31 138 { b80df10f845813 lishuo 2024-01-31 139 if (priv->dma_inited) b80df10f845813 lishuo 2024-01-31 140 dma_release_channel(priv->dma_chan); b80df10f845813 lishuo 2024-01-31 141 priv->dma_inited = 0; b80df10f845813 lishuo 2024-01-31 142 priv->dma_chan = NULL; b80df10f845813 lishuo 2024-01-31 143 } b80df10f845813 lishuo 2024-01-31 144 b80df10f845813 lishuo 2024-01-31 145 static struct phytium_display_private* b80df10f845813 lishuo 2024-01-31 146 phytium_pci_private_init(struct pci_dev *pdev, const struct pci_device_id *ent) b80df10f845813 lishuo 2024-01-31 147 { b80df10f845813 lishuo 2024-01-31 148 struct drm_device *dev = pci_get_drvdata(pdev); b80df10f845813 lishuo 2024-01-31 149 struct phytium_display_private *priv = NULL; b80df10f845813 lishuo 2024-01-31 150 struct phytium_pci_private *pci_priv = NULL; b80df10f845813 lishuo 2024-01-31 151 struct phytium_device_info *phytium_info = (struct phytium_device_info *)ent->driver_data; b80df10f845813 lishuo 2024-01-31 152 int i = 0; b80df10f845813 lishuo 2024-01-31 153 resource_size_t io_addr, io_size; b80df10f845813 lishuo 2024-01-31 154 b80df10f845813 lishuo 2024-01-31 155 pci_priv = devm_kzalloc(&pdev->dev, sizeof(*pci_priv), GFP_KERNEL); b80df10f845813 lishuo 2024-01-31 156 if (!pci_priv) { b80df10f845813 lishuo 2024-01-31 157 DRM_ERROR("no memory to allocate for drm_display_private\n"); b80df10f845813 lishuo 2024-01-31 158 goto failed_malloc_priv; b80df10f845813 lishuo 2024-01-31 159 } b80df10f845813 lishuo 2024-01-31 160 b80df10f845813 lishuo 2024-01-31 161 memset(pci_priv, 0, sizeof(*pci_priv)); b80df10f845813 lishuo 2024-01-31 162 priv = &pci_priv->base; b80df10f845813 lishuo 2024-01-31 163 phytium_display_private_init(priv, dev); b80df10f845813 lishuo 2024-01-31 164 b80df10f845813 lishuo 2024-01-31 165 memcpy(&(priv->info), phytium_info, sizeof(struct phytium_device_info)); b80df10f845813 lishuo 2024-01-31 166 DRM_DEBUG_KMS("priv->info.num_pipes :%d\n", priv->info.num_pipes); b80df10f845813 lishuo 2024-01-31 167 priv->info.pipe_mask = ((pdev->subsystem_device >> PIPE_MASK_SHIFT) & PIPE_MASK_MASK); b80df10f845813 lishuo 2024-01-31 168 priv->info.edp_mask = ((pdev->subsystem_device >> EDP_MASK_SHIFT) & EDP_MASK_MASK); b80df10f845813 lishuo 2024-01-31 169 priv->info.num_pipes = 0; b80df10f845813 lishuo 2024-01-31 170 for_each_pipe_masked(priv, i) b80df10f845813 lishuo 2024-01-31 171 priv->info.num_pipes++; b80df10f845813 lishuo 2024-01-31 172 if (priv->info.num_pipes == 0) { b80df10f845813 lishuo 2024-01-31 173 DRM_ERROR("num_pipes is zero, so exit init\n"); b80df10f845813 lishuo 2024-01-31 174 goto failed_init_numpipe; b80df10f845813 lishuo 2024-01-31 175 } b80df10f845813 lishuo 2024-01-31 176 b80df10f845813 lishuo 2024-01-31 177 io_addr = pci_resource_start(pdev, 0); b80df10f845813 lishuo 2024-01-31 178 io_size = pci_resource_len(pdev, 0); b80df10f845813 lishuo 2024-01-31 179 priv->regs = ioremap(io_addr, io_size); b80df10f845813 lishuo 2024-01-31 180 if (priv->regs == NULL) { b80df10f845813 lishuo 2024-01-31 181 DRM_ERROR("pci bar0 ioremap fail, addr:0x%llx, size:0x%llx\n", io_addr, io_size); b80df10f845813 lishuo 2024-01-31 182 goto failed_ioremap; b80df10f845813 lishuo 2024-01-31 183 } b80df10f845813 lishuo 2024-01-31 184 b80df10f845813 lishuo 2024-01-31 185 priv->irq = pdev->irq; b80df10f845813 lishuo 2024-01-31 186 if (IS_PX210(priv)) { b80df10f845813 lishuo 2024-01-31 187 pci_priv->dc_hw_vram_init = px210_dc_hw_vram_init; b80df10f845813 lishuo 2024-01-31 188 priv->dc_hw_clear_msi_irq = px210_dc_hw_clear_msi_irq; b80df10f845813 lishuo 2024-01-31 189 priv->dc_hw_fb_format_check = px210_dc_hw_fb_format_check; b80df10f845813 lishuo 2024-01-31 190 } else if (IS_PE220X(priv)) { b80df10f845813 lishuo 2024-01-31 191 pci_priv->dc_hw_vram_init = pe220x_dc_hw_vram_init; b80df10f845813 lishuo 2024-01-31 192 priv->dc_hw_clear_msi_irq = NULL; b80df10f845813 lishuo 2024-01-31 193 priv->dc_hw_fb_format_check = pe220x_dc_hw_fb_format_check; b80df10f845813 lishuo 2024-01-31 194 } b80df10f845813 lishuo 2024-01-31 195 b80df10f845813 lishuo 2024-01-31 196 return priv; b80df10f845813 lishuo 2024-01-31 197 b80df10f845813 lishuo 2024-01-31 198 failed_ioremap: b80df10f845813 lishuo 2024-01-31 199 failed_init_numpipe: b80df10f845813 lishuo 2024-01-31 200 devm_kfree(&pdev->dev, pci_priv); b80df10f845813 lishuo 2024-01-31 201 failed_malloc_priv: b80df10f845813 lishuo 2024-01-31 202 return NULL; b80df10f845813 lishuo 2024-01-31 203 } b80df10f845813 lishuo 2024-01-31 204 b80df10f845813 lishuo 2024-01-31 205 static void b80df10f845813 lishuo 2024-01-31 206 phytium_pci_private_fini(struct pci_dev *pdev, struct phytium_display_private *priv) b80df10f845813 lishuo 2024-01-31 207 { b80df10f845813 lishuo 2024-01-31 208 struct phytium_pci_private *pci_priv = to_pci_priv(priv); b80df10f845813 lishuo 2024-01-31 209 b80df10f845813 lishuo 2024-01-31 210 if (priv->regs) b80df10f845813 lishuo 2024-01-31 211 iounmap(priv->regs); b80df10f845813 lishuo 2024-01-31 212 b80df10f845813 lishuo 2024-01-31 213 devm_kfree(&pdev->dev, pci_priv); b80df10f845813 lishuo 2024-01-31 214 } b80df10f845813 lishuo 2024-01-31 215 b80df10f845813 lishuo 2024-01-31 216 static int phytium_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) b80df10f845813 lishuo 2024-01-31 217 { b80df10f845813 lishuo 2024-01-31 218 struct phytium_display_private *priv = NULL; b80df10f845813 lishuo 2024-01-31 219 struct drm_device *dev = NULL; b80df10f845813 lishuo 2024-01-31 220 int ret = 0; b80df10f845813 lishuo 2024-01-31 221 b80df10f845813 lishuo 2024-01-31 222 dev = drm_dev_alloc(&phytium_display_drm_driver, &pdev->dev); b80df10f845813 lishuo 2024-01-31 223 if (IS_ERR(dev)) { b80df10f845813 lishuo 2024-01-31 224 DRM_ERROR("failed to allocate drm_device\n"); b80df10f845813 lishuo 2024-01-31 225 return PTR_ERR(dev); b80df10f845813 lishuo 2024-01-31 226 } b80df10f845813 lishuo 2024-01-31 227 pci_set_drvdata(pdev, dev); b80df10f845813 lishuo 2024-01-31 228 pci_set_master(pdev); b80df10f845813 lishuo 2024-01-31 229 ret = pci_enable_device(pdev); b80df10f845813 lishuo 2024-01-31 230 if (ret) { b80df10f845813 lishuo 2024-01-31 231 DRM_ERROR("pci enable device fail\n"); b80df10f845813 lishuo 2024-01-31 232 goto failed_enable_device; b80df10f845813 lishuo 2024-01-31 233 } b80df10f845813 lishuo 2024-01-31 234 b80df10f845813 lishuo 2024-01-31 235 if (dc_msi_enable) { b80df10f845813 lishuo 2024-01-31 @236 ret = pci_enable_msi(pdev); b80df10f845813 lishuo 2024-01-31 237 if (ret) b80df10f845813 lishuo 2024-01-31 238 DRM_ERROR("pci enable msi fail\n"); b80df10f845813 lishuo 2024-01-31 239 } b80df10f845813 lishuo 2024-01-31 240 b80df10f845813 lishuo 2024-01-31 241 dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); b80df10f845813 lishuo 2024-01-31 242 b80df10f845813 lishuo 2024-01-31 243 priv = phytium_pci_private_init(pdev, ent); b80df10f845813 lishuo 2024-01-31 244 if (priv) b80df10f845813 lishuo 2024-01-31 245 dev->dev_private = priv; b80df10f845813 lishuo 2024-01-31 246 else b80df10f845813 lishuo 2024-01-31 247 goto failed_pci_private_init; b80df10f845813 lishuo 2024-01-31 248 b80df10f845813 lishuo 2024-01-31 249 ret = phytium_pci_vram_init(pdev, priv); b80df10f845813 lishuo 2024-01-31 250 if (ret) { b80df10f845813 lishuo 2024-01-31 251 DRM_ERROR("failed to init pci vram\n"); b80df10f845813 lishuo 2024-01-31 252 goto failed_pci_vram_init; b80df10f845813 lishuo 2024-01-31 253 } b80df10f845813 lishuo 2024-01-31 254 b80df10f845813 lishuo 2024-01-31 255 ret = drm_dev_register(dev, 0); b80df10f845813 lishuo 2024-01-31 256 if (ret) { b80df10f845813 lishuo 2024-01-31 257 DRM_ERROR("failed to register drm dev\n"); b80df10f845813 lishuo 2024-01-31 258 goto failed_register_drm; b80df10f845813 lishuo 2024-01-31 259 } b80df10f845813 lishuo 2024-01-31 260 b80df10f845813 lishuo 2024-01-31 261 phytium_dp_hpd_irq_setup(dev, true); b80df10f845813 lishuo 2024-01-31 262 b80df10f845813 lishuo 2024-01-31 263 return 0; b80df10f845813 lishuo 2024-01-31 264 b80df10f845813 lishuo 2024-01-31 265 failed_register_drm: b80df10f845813 lishuo 2024-01-31 266 phytium_pci_vram_fini(pdev, priv); b80df10f845813 lishuo 2024-01-31 267 failed_pci_vram_init: b80df10f845813 lishuo 2024-01-31 268 phytium_pci_private_fini(pdev, priv); b80df10f845813 lishuo 2024-01-31 269 failed_pci_private_init: b80df10f845813 lishuo 2024-01-31 270 if (pdev->msi_enabled) b80df10f845813 lishuo 2024-01-31 @271 pci_disable_msi(pdev); b80df10f845813 lishuo 2024-01-31 272 pci_disable_device(pdev); b80df10f845813 lishuo 2024-01-31 273 failed_enable_device: b80df10f845813 lishuo 2024-01-31 274 pci_set_drvdata(pdev, NULL); b80df10f845813 lishuo 2024-01-31 275 drm_dev_put(dev); b80df10f845813 lishuo 2024-01-31 276 b80df10f845813 lishuo 2024-01-31 277 return -1; b80df10f845813 lishuo 2024-01-31 278 } b80df10f845813 lishuo 2024-01-31 279 :::::: The code at line 236 was first introduced by commit :::::: b80df10f845813bb4fc2002b5386ecdfa8be5f6c DRM: Phytium display DRM driver :::::: TO: lishuo <lishuo(a)phytium.com.cn> :::::: CC: lishuo <lishuo(a)phytium.com.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 5041/22575] drivers/hid/i2c-hid/.tmp_i2c-hid-core.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 29 May '24

29 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: aec283517697385e25d19ae7312a63bad805b4a7 commit: 211070f39ed4ec7390dca8351c9fee934b8179e7 [5041/22575] HID: i2c-hid: override HID descriptors for certain devices config: x86_64-buildonly-randconfig-005-20240527 (https://download.01.org/0day-ci/archive/20240529/202405292306.oKi0pqkq-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240529/202405292306.oKi0pqkq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405292306.oKi0pqkq-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/hid/i2c-hid/i2c-hid-core.c:21: include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'i2c_hid_driver_exit': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1637:1: note: in expansion of macro 'module_exit' 1637 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/i2c.h:870:9: note: in expansion of macro 'module_driver' 870 | module_driver(__i2c_driver, i2c_add_driver, \ | ^~~~~~~~~~~~~ drivers/hid/i2c-hid/i2c-hid-core.c:1344:1: note: in expansion of macro 'module_i2c_driver' 1344 | module_i2c_driver(i2c_hid_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/i2c.h:30, from drivers/hid/i2c-hid/i2c-hid-core.c:22: drivers/hid/i2c-hid/i2c-hid-core.c:1344:19: note: 'cleanup_module' target declared here 1344 | module_i2c_driver(i2c_hid_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1633:20: note: in definition of macro 'module_driver' 1633 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/hid/i2c-hid/i2c-hid-core.c:1344:1: note: in expansion of macro 'module_i2c_driver' 1344 | module_i2c_driver(i2c_hid_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'i2c_hid_driver_init': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1632:1: note: in expansion of macro 'module_init' 1632 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/i2c.h:870:9: note: in expansion of macro 'module_driver' 870 | module_driver(__i2c_driver, i2c_add_driver, \ | ^~~~~~~~~~~~~ drivers/hid/i2c-hid/i2c-hid-core.c:1344:1: note: in expansion of macro 'module_i2c_driver' 1344 | module_i2c_driver(i2c_hid_driver); | ^~~~~~~~~~~~~~~~~ drivers/hid/i2c-hid/i2c-hid-core.c:1344:19: note: 'init_module' target declared here 1344 | module_i2c_driver(i2c_hid_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1628:19: note: in definition of macro 'module_driver' 1628 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/hid/i2c-hid/i2c-hid-core.c:1344:1: note: in expansion of macro 'module_i2c_driver' 1344 | module_i2c_driver(i2c_hid_driver); | ^~~~~~~~~~~~~~~~~ drivers/hid/i2c-hid/i2c-hid-core.c: In function '__i2c_hid_command': drivers/hid/i2c-hid/i2c-hid-core.c:223:26: warning: array subscript 0 is outside array bounds of 'u8[0]' {aka 'unsigned char[]'} [-Warray-bounds=] 223 | cmd->data[0] = ihid->hdesc_buffer[registerIndex]; | ~~~~~~~~~^~~ drivers/hid/i2c-hid/i2c-hid-core.c:98:12: note: while referencing 'data' 98 | u8 data[0]; | ^~~~ drivers/hid/i2c-hid/i2c-hid-core.c:224:26: warning: array subscript 1 is outside array bounds of 'u8[0]' {aka 'unsigned char[]'} [-Warray-bounds=] 224 | cmd->data[1] = ihid->hdesc_buffer[registerIndex + 1]; | ~~~~~~~~~^~~ drivers/hid/i2c-hid/i2c-hid-core.c:98:12: note: while referencing 'data' 98 | u8 data[0]; | ^~~~ drivers/hid/i2c-hid/i2c-hid-core.c:327: warning: Function parameter or member 'data_len' not described in 'i2c_hid_set_or_send_report' drivers/hid/i2c-hid/i2c-hid-core.c:327: warning: Excess function parameter 'len' description in 'i2c_hid_set_or_send_report' >> drivers/hid/i2c-hid/.tmp_i2c-hid-core.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/11] Memory access profiler(SPE) driven NUMA balancing
by Ze Zuo 29 May '24

29 May '24

Hi, In Arm processors, there is a hardware PMU (Performance Monitoring Unit) facility called Statistical Profiling Extension (SPE) that can gather memory access metrics. In this patchset, SPE is exploited as an access information sampling approach to drive NUMA balancing. This sampling approach is introducedto replace the method based on address space scanning and hint faults with the access information provided by the hardware. With this, it is no longer necessary for NUMA balancing to scan over the address space periodically and rely on task-to-page association built by NUMA hint faults. Instead, the access samples obtained from hardware PMU are fed to NUMA balancing as equivalents to page fault. Except for the replaced sampling approach, the rest of the NUMA balancing policy is retained to do pages and tasks migrations according to the samples. Profiling based on SPE is an valid alternative sampling approach in NUMA balancing for the optimal page and task placement. This can be also extended to other architectures as long as there is a hardware PMU that supports memory access profiling. An abstract layer mem_sampling is introduced to reserve support for other kernel features and different types of hardware PMU. To help evaluate performance of this approach in system, syctl interfaces are added to enable/disable hardware mem sampling. NUMA balancing sampling approach can be also switched back to hint-faults- based approach dynamically. TODOs --- - Currently, SPE for NUMA balance does not support PMD-level page migration, but it will be supported in later version. Ze Zuo (11): drivers/arm/spe: In-kernel SPE driver for page access profiling Add hardware PMU (hw_pmu) abstract layer mm/mem_sampling.c: Add controlling interface for mem_sampling Enable per-process mem_sampling from sched switch path Drive NUMA balancing via mem_sampling access data Add controlling interface for mem_sampling numa_balance tracing, numa balance: add trace events for numa data caused by hw-pmu driver/arm/spe: make mem_sampling and perf reuse arm spe driver tracing, mem-sampling-sample: add trace events for page access spe record ring buffer just for ctx origin flaw config: Enable MEM_SAMPLING for Numa balance by default arch/arm64/configs/openeuler_defconfig | 3 + arch/x86/configs/openeuler_defconfig | 1 + drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/arm/Kconfig | 2 + drivers/arm/spe/Kconfig | 11 + drivers/arm/spe/Makefile | 2 + drivers/arm/spe/spe-decoder/Makefile | 2 + drivers/arm/spe/spe-decoder/arm-spe-decoder.c | 211 +++++ drivers/arm/spe/spe-decoder/arm-spe-decoder.h | 73 ++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.c | 227 +++++ .../arm/spe/spe-decoder/arm-spe-pkt-decoder.h | 153 ++++ drivers/arm/spe/spe.c | 859 ++++++++++++++++++ drivers/arm/spe/spe.h | 125 +++ drivers/perf/Kconfig | 2 +- drivers/perf/arm_pmu_acpi.c | 30 +- drivers/perf/arm_spe_pmu.c | 371 ++------ include/linux/mem_sampling.h | 130 +++ include/linux/migrate.h | 4 + include/linux/perf/arm_pmu.h | 8 + include/linux/sched/numa_balancing.h | 10 +- include/linux/sched/sysctl.h | 22 + include/trace/events/kmem.h | 80 ++ kernel/sched/core.c | 112 +++ kernel/sched/fair.c | 12 + kernel/sched/sched.h | 1 + kernel/sysctl.c | 22 + mm/Kconfig | 23 + mm/Makefile | 1 + mm/mem_sampling.c | 188 ++++ mm/memory.c | 86 ++ mm/mempolicy.c | 74 ++ samples/bpf/spe/Makefile | 25 + samples/bpf/spe/Makefile.arch | 46 + samples/bpf/spe/README.md | 0 samples/bpf/spe/spe-record.bpf.c | 41 + samples/bpf/spe/spe-record.h | 47 + samples/bpf/spe/spe-record.user.c | 116 +++ 38 files changed, 2810 insertions(+), 313 deletions(-) create mode 100644 drivers/arm/Kconfig create mode 100644 drivers/arm/spe/Kconfig create mode 100644 drivers/arm/spe/Makefile create mode 100644 drivers/arm/spe/spe-decoder/Makefile create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-decoder.h create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.c create mode 100644 drivers/arm/spe/spe-decoder/arm-spe-pkt-decoder.h create mode 100644 drivers/arm/spe/spe.c create mode 100644 drivers/arm/spe/spe.h create mode 100644 include/linux/mem_sampling.h create mode 100644 mm/mem_sampling.c create mode 100644 samples/bpf/spe/Makefile create mode 100644 samples/bpf/spe/Makefile.arch create mode 100644 samples/bpf/spe/README.md create mode 100644 samples/bpf/spe/spe-record.bpf.c create mode 100644 samples/bpf/spe/spe-record.h create mode 100644 samples/bpf/spe/spe-record.user.c -- 2.33.0

2 12

[PATCH openEuler-1.0-LTS] comedi: ni_usb6501: fix NULL-deref in command paths
by Cui GaoSheng 29 May '24

29 May '24

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-5.10.79 commit ef143dc0c3defe56730ecd3a9de7b3e1d7e557c1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RD2V CVE: CVE-2021-47476 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 907767da8f3a925b060c740e0b5c92ea7dbec440 upstream. The driver uses endpoint-sized USB transfer buffers but had no sanity checks on the sizes. This can lead to zero-size-pointer dereferences or overflowed transfer buffers in ni6501_port_command() and ni6501_counter_command() if a (malicious) device has smaller max-packet sizes than expected (or when doing descriptor fuzz testing). Add the missing sanity checks to probe(). Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support") Cc: stable(a)vger.kernel.org # 3.18 Cc: Luca Ellero <luca.ellero(a)brickedbrain.com> Reviewed-by: Ian Abbott <abbotti(a)mev.co.uk> Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://lore.kernel.org/r/20211027093529.30896-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Bin Li <huawei.libin(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/staging/comedi/drivers/ni_usb6501.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c index 1bb1cb651349..75e5b57ae0d7 100644 --- a/drivers/staging/comedi/drivers/ni_usb6501.c +++ b/drivers/staging/comedi/drivers/ni_usb6501.c @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00}; +/* Largest supported packets */ +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); + enum commands { READ_PORT, WRITE_PORT, @@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev) if (!devpriv->ep_rx || !devpriv->ep_tx) return -ENODEV; + if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE) + return -ENODEV; + + if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE) + return -ENODEV; + return 0; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 V1] usb: udc: remove warning when queue disabled ep
by Cheng Yu 29 May '24

29 May '24

From: yuan linyu <yuanlinyu(a)hihonor.com> stable inclusion from stable-v5.10.215 commit 3e944ddc17c042945d983e006df7860687a8849a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98P CVE: CVE-2024-35822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2a587a035214fa1b5ef598aea0b81848c5b72e5e upstream. It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mass storage function try to queue request from main thread, but other thread may already disable ep when function disable. As there is no function failure in the driver, in order to avoid effort to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug(). Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Cc: stable(a)vger.kernel.org Signed-off-by: yuan linyu <yuanlinyu(a)hihonor.com> Reviewed-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/20240315020144.2715575-1-yuanlinyu@hihonor.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 3a3b5a03dda7..7330c1999104 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -273,7 +273,9 @@ int usb_ep_queue(struct usb_ep *ep, { int ret = 0; - if (WARN_ON_ONCE(!ep->enabled && ep->address)) { + if (!ep->enabled && ep->address) { + pr_debug("USB gadget: queue request to disabled ep 0x%x (%s)\n", + ep->address, ep->name); ret = -ESHUTDOWN; goto out; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] usb: udc: remove warning when queue disabled ep
by Cheng Yu 29 May '24

29 May '24

From: yuan linyu <yuanlinyu(a)hihonor.com> stable inclusion from stable-v5.10.215 commit 3e944ddc17c042945d983e006df7860687a8849a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98P CVE: CVE-2024-35822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2a587a035214fa1b5ef598aea0b81848c5b72e5e upstream. It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mass storage function try to queue request from main thread, but other thread may already disable ep when function disable. As there is no function failure in the driver, in order to avoid effort to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug(). Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Cc: stable(a)vger.kernel.org Signed-off-by: yuan linyu <yuanlinyu(a)hihonor.com> Reviewed-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/20240315020144.2715575-1-yuanlinyu@hihonor.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 1a79a9955187..4413150b94a1 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -273,7 +273,9 @@ int usb_ep_queue(struct usb_ep *ep, { int ret = 0; - if (WARN_ON_ONCE(!ep->enabled && ep->address)) { + if (!ep->enabled && ep->address) { + pr_debug("USB gadget: queue request to disabled ep 0x%x (%s)\n", + ep->address, ep->name); ret = -ESHUTDOWN; goto out; } -- 2.25.1

2 1

[PATCH OLK-5.10 V1] usb: udc: remove warning when queue disabled ep
by Cheng Yu 29 May '24

29 May '24

From: yuan linyu <yuanlinyu(a)hihonor.com> stable inclusion from stable-v5.10.215 commit 3e944ddc17c042945d983e006df7860687a8849a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98P CVE: CVE-2024-35822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2a587a035214fa1b5ef598aea0b81848c5b72e5e upstream. It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mass storage function try to queue request from main thread, but other thread may already disable ep when function disable. As there is no function failure in the driver, in order to avoid effort to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug(). Suggested-by: Alan Stern <stern(a)rowland.harvard.edu> Cc: stable(a)vger.kernel.org Signed-off-by: yuan linyu <yuanlinyu(a)hihonor.com> Reviewed-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/20240315020144.2715575-1-yuanlinyu@hihonor.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 7b3c0787d5a4..e80aa717c8b5 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -273,7 +273,9 @@ int usb_ep_queue(struct usb_ep *ep, { int ret = 0; - if (WARN_ON_ONCE(!ep->enabled && ep->address)) { + if (!ep->enabled && ep->address) { + pr_debug("USB gadget: queue request to disabled ep 0x%x (%s)\n", + ep->address, ep->name); ret = -ESHUTDOWN; goto out; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS v2] ALSA: hda: Do not unset preset when cleaning up codec
by Ye Bin 29 May '24

29 May '24

From: Cezary Rojewski <cezary.rojewski(a)intel.com> stable inclusion from stable-v5.10.169 commit 7fc4e7191eae9d9325511e03deadfdb2224914f8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R4NC CVE: CVE-2023-52736 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 87978e6ad45a16835cc58234451111091be3c59a ] Several functions that take part in codec's initialization and removal are re-used by ASoC codec drivers implementations. Drivers mimic the behavior of hda_codec_driver_probe/remove() found in sound/pci/hda/hda_bind.c with their component->probe/remove() instead. One of the reasons for that is the expectation of snd_hda_codec_device_new() to receive a valid pointer to an instance of struct snd_card. This expectation can be met only once sound card components probing commences. As ASoC sound card may be unbound without codec device being actually removed from the system, unsetting ->preset in snd_hda_codec_cleanup_for_unbind() interferes with module unload -> load scenario causing null-ptr-deref. Preset is assigned only once, during device/driver matching whereas ASoC codec driver's module reloading may occur several times throughout the lifetime of an audio stack. Suggested-by: Takashi Iwai <tiwai(a)suse.com> Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20230119143235.1159814-1-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: zhaoxiaoqiang11 <zhaoxiaoqiang11(a)jd.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- sound/pci/hda/hda_bind.c | 2 ++ sound/pci/hda/hda_codec.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c index 4efbcc41fdfb..0a83afa5f373 100644 --- a/sound/pci/hda/hda_bind.c +++ b/sound/pci/hda/hda_bind.c @@ -143,6 +143,7 @@ static int hda_codec_driver_probe(struct device *dev) error: snd_hda_codec_cleanup_for_unbind(codec); + codec->preset = NULL; return err; } @@ -159,6 +160,7 @@ static int hda_codec_driver_remove(struct device *dev) if (codec->patch_ops.free) codec->patch_ops.free(codec); snd_hda_codec_cleanup_for_unbind(codec); + codec->preset = NULL; module_put(dev->driver->owner); return 0; } diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 39281106477e..fc4a64a83ff2 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -784,7 +784,6 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec) snd_array_free(&codec->cvt_setups); snd_array_free(&codec->spdif_out); snd_array_free(&codec->verbs); - codec->preset = NULL; codec->follower_dig_outs = NULL; codec->spdif_status_reset = 0; snd_array_free(&codec->mixers); -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: hda: Do not unset preset when cleaning up codec
by Ye Bin 29 May '24

29 May '24

From: Cezary Rojewski <cezary.rojewski(a)intel.com> stable inclusion from stable-v5.10.169 commit 7fc4e7191eae9d9325511e03deadfdb2224914f8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R4NC CVE: CVE-2023-52736 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 87978e6ad45a16835cc58234451111091be3c59a ] Several functions that take part in codec's initialization and removal are re-used by ASoC codec drivers implementations. Drivers mimic the behavior of hda_codec_driver_probe/remove() found in sound/pci/hda/hda_bind.c with their component->probe/remove() instead. One of the reasons for that is the expectation of snd_hda_codec_device_new() to receive a valid pointer to an instance of struct snd_card. This expectation can be met only once sound card components probing commences. As ASoC sound card may be unbound without codec device being actually removed from the system, unsetting ->preset in snd_hda_codec_cleanup_for_unbind() interferes with module unload -> load scenario causing null-ptr-deref. Preset is assigned only once, during device/driver matching whereas ASoC codec driver's module reloading may occur several times throughout the lifetime of an audio stack. Suggested-by: Takashi Iwai <tiwai(a)suse.com> Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20230119143235.1159814-1-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: zhaoxiaoqiang11 <zhaoxiaoqiang11(a)jd.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- sound/pci/hda/hda_bind.c | 2 ++ sound/pci/hda/hda_codec.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c index 4efbcc41fdfb..0a83afa5f373 100644 --- a/sound/pci/hda/hda_bind.c +++ b/sound/pci/hda/hda_bind.c @@ -143,6 +143,7 @@ static int hda_codec_driver_probe(struct device *dev) error: snd_hda_codec_cleanup_for_unbind(codec); + codec->preset = NULL; return err; } @@ -159,6 +160,7 @@ static int hda_codec_driver_remove(struct device *dev) if (codec->patch_ops.free) codec->patch_ops.free(codec); snd_hda_codec_cleanup_for_unbind(codec); + codec->preset = NULL; module_put(dev->driver->owner); return 0; } diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 39281106477e..fc4a64a83ff2 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -784,7 +784,6 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec) snd_array_free(&codec->cvt_setups); snd_array_free(&codec->spdif_out); snd_array_free(&codec->verbs); - codec->preset = NULL; codec->follower_dig_outs = NULL; codec->spdif_status_reset = 0; snd_array_free(&codec->mixers); -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] ALSA: hda: Do not unset preset when cleaning up codec
by Ye Bin 29 May '24

29 May '24

From: Cezary Rojewski <cezary.rojewski(a)intel.com> stable inclusion from stable-v5.10.169 commit 7fc4e7191eae9d9325511e03deadfdb2224914f8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7V9QX CVE: CVE-2023-52736 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------- [ Upstream commit 87978e6ad45a16835cc58234451111091be3c59a ] Several functions that take part in codec's initialization and removal are re-used by ASoC codec drivers implementations. Drivers mimic the behavior of hda_codec_driver_probe/remove() found in sound/pci/hda/hda_bind.c with their component->probe/remove() instead. One of the reasons for that is the expectation of snd_hda_codec_device_new() to receive a valid pointer to an instance of struct snd_card. This expectation can be met only once sound card components probing commences. As ASoC sound card may be unbound without codec device being actually removed from the system, unsetting ->preset in snd_hda_codec_cleanup_for_unbind() interferes with module unload -> load scenario causing null-ptr-deref. Preset is assigned only once, during device/driver matching whereas ASoC codec driver's module reloading may occur several times throughout the lifetime of an audio stack. Suggested-by: Takashi Iwai <tiwai(a)suse.com> Signed-off-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Link: https://lore.kernel.org/r/20230119143235.1159814-1-cezary.rojewski@intel.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: zhaoxiaoqiang11 <zhaoxiaoqiang11(a)jd.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- sound/pci/hda/hda_bind.c | 2 ++ sound/pci/hda/hda_codec.c | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c index 4efbcc41fdfb..0a83afa5f373 100644 --- a/sound/pci/hda/hda_bind.c +++ b/sound/pci/hda/hda_bind.c @@ -143,6 +143,7 @@ static int hda_codec_driver_probe(struct device *dev) error: snd_hda_codec_cleanup_for_unbind(codec); + codec->preset = NULL; return err; } @@ -159,6 +160,7 @@ static int hda_codec_driver_remove(struct device *dev) if (codec->patch_ops.free) codec->patch_ops.free(codec); snd_hda_codec_cleanup_for_unbind(codec); + codec->preset = NULL; module_put(dev->driver->owner); return 0; } diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 39281106477e..fc4a64a83ff2 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -784,7 +784,6 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec) snd_array_free(&codec->cvt_setups); snd_array_free(&codec->spdif_out); snd_array_free(&codec->verbs); - codec->preset = NULL; codec->follower_dig_outs = NULL; codec->spdif_status_reset = 0; snd_array_free(&codec->mixers); -- 2.31.1

2 1

[PATCH OLK-5.10] netfilter: nf_tables: reject new basechain after table flag update
by Zhengchao Shao 29 May '24

29 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v5.10.215 commit 7b6fba6918714afee3e17796113ccab636255c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG4V CVE: CVE-2024-35900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 994209ddf4f430946f6247616b2e33d179243769 upstream. When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new). The following configuration allows for an inconsistent state: add table x add chain x y { type filter hook input priority 0; } add table x { flags dormant; } add chain x w { type filter hook input priority 1; } which triggers the following warning when trying to unregister chain w which is already unregistered. [ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Call Trace: [ 127.322521] <TASK> [ 127.322524] ? __warn+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322537] ? report_bug+0x1b1/0x1e0 [ 127.322545] ? handle_bug+0x3c/0x70 [ 127.322552] ? exc_invalid_op+0x17/0x40 [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20 [ 127.322563] ? kasan_save_free_info+0x3b/0x60 [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables] Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 7c102a4ce930..c3d001991b6a 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2242,6 +2242,9 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, struct nft_stats __percpu *stats = NULL; struct nft_chain_hook hook; + if (table->flags & __NFT_TABLE_F_UPDATE) + return -EINVAL; + if (flags & NFT_CHAIN_BINDING) return -EOPNOTSUPP; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
by Ye Bin 29 May '24

29 May '24

From: Mario Limonciello <mario.limonciello(a)amd.com> stable inclusion from stable-v5.10.202 commit 8af28ae3acb736ada4ce3457662fa446cc913bb4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFET CVE: CVE-2023-52818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held <felix.held(a)amd.com> Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/include/pptable.h | 4 ++-- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/include/pptable.h b/drivers/gpu/drm/amd/include/pptable.h index 0b6a057e0a4c..5aac8d545bdc 100644 --- a/drivers/gpu/drm/amd/include/pptable.h +++ b/drivers/gpu/drm/amd/include/pptable.h @@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER typedef struct _ATOM_PPLIB_STATE { UCHAR ucNonClockStateIndex; - UCHAR ucClockStateIndices[1]; // variable-sized + UCHAR ucClockStateIndices[]; // variable-sized } ATOM_PPLIB_STATE; @@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2 /** * Driver will read the first ucNumDPMLevels in this array */ - UCHAR clockInfoIndex[1]; + UCHAR clockInfoIndex[]; } ATOM_PPLIB_STATE_V2; typedef struct _StateArray{ diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h index 1e870f58dd12..d5a4a08c6d39 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h @@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record { typedef struct _ATOM_Tonga_MCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_MCLK_Dependency_Table; typedef struct _ATOM_Tonga_SCLK_Dependency_Record { @@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record { typedef struct _ATOM_Tonga_SCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_SCLK_Dependency_Table; typedef struct _ATOM_Polaris_SCLK_Dependency_Record { -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
by Ye Bin 29 May '24

29 May '24

From: Mario Limonciello <mario.limonciello(a)amd.com> stable inclusion from stable-v5.10.202 commit 8af28ae3acb736ada4ce3457662fa446cc913bb4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFET CVE: CVE-2023-52818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held <felix.held(a)amd.com> Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/include/pptable.h | 4 ++-- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/include/pptable.h b/drivers/gpu/drm/amd/include/pptable.h index 0b6a057e0a4c..5aac8d545bdc 100644 --- a/drivers/gpu/drm/amd/include/pptable.h +++ b/drivers/gpu/drm/amd/include/pptable.h @@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER typedef struct _ATOM_PPLIB_STATE { UCHAR ucNonClockStateIndex; - UCHAR ucClockStateIndices[1]; // variable-sized + UCHAR ucClockStateIndices[]; // variable-sized } ATOM_PPLIB_STATE; @@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2 /** * Driver will read the first ucNumDPMLevels in this array */ - UCHAR clockInfoIndex[1]; + UCHAR clockInfoIndex[]; } ATOM_PPLIB_STATE_V2; typedef struct _StateArray{ diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h index 1e870f58dd12..d5a4a08c6d39 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h @@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record { typedef struct _ATOM_Tonga_MCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_MCLK_Dependency_Table; typedef struct _ATOM_Tonga_SCLK_Dependency_Record { @@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record { typedef struct _ATOM_Tonga_SCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_SCLK_Dependency_Table; typedef struct _ATOM_Polaris_SCLK_Dependency_Record { -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
by Ye Bin 29 May '24

29 May '24

From: Mario Limonciello <mario.limonciello(a)amd.com> stable inclusion from stable-v5.10.202 commit 8af28ae3acb736ada4ce3457662fa446cc913bb4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFET CVE: CVE-2023-52818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held <felix.held(a)amd.com> Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello <mario.limonciello(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/include/pptable.h | 4 ++-- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/amd/include/pptable.h b/drivers/gpu/drm/amd/include/pptable.h index 0b6a057e0a4c..5aac8d545bdc 100644 --- a/drivers/gpu/drm/amd/include/pptable.h +++ b/drivers/gpu/drm/amd/include/pptable.h @@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER typedef struct _ATOM_PPLIB_STATE { UCHAR ucNonClockStateIndex; - UCHAR ucClockStateIndices[1]; // variable-sized + UCHAR ucClockStateIndices[]; // variable-sized } ATOM_PPLIB_STATE; @@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2 /** * Driver will read the first ucNumDPMLevels in this array */ - UCHAR clockInfoIndex[1]; + UCHAR clockInfoIndex[]; } ATOM_PPLIB_STATE_V2; typedef struct _StateArray{ diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h index 1e870f58dd12..d5a4a08c6d39 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h @@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record { typedef struct _ATOM_Tonga_MCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_MCLK_Dependency_Table; typedef struct _ATOM_Tonga_SCLK_Dependency_Record { @@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record { typedef struct _ATOM_Tonga_SCLK_Dependency_Table { UCHAR ucRevId; UCHAR ucNumEntries; /* Number of entries. */ - ATOM_Tonga_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ + ATOM_Tonga_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ } ATOM_Tonga_SCLK_Dependency_Table; typedef struct _ATOM_Polaris_SCLK_Dependency_Record { -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] i40e: Fix freeing of uninitialized misc IRQ vector
by Cui GaoSheng 29 May '24

29 May '24

From: Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com> stable inclusion from stable-5.10.73 commit 97aeed72af4f83ae51534f0a2473ff52f8d66236 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4ON CVE: CVE-2021-47424 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e ] When VSI set up failed in i40e_probe() as part of PF switch set up driver was trying to free misc IRQ vectors in i40e_clear_interrupt_scheme and produced a kernel Oops: Trying to free already-free IRQ 266 WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300 Workqueue: events work_for_cpu_fn RIP: 0010:__free_irq+0x9a/0x300 Call Trace: ? synchronize_irq+0x3a/0xa0 free_irq+0x2e/0x60 i40e_clear_interrupt_scheme+0x53/0x190 [i40e] i40e_probe.part.108+0x134b/0x1a40 [i40e] ? kmem_cache_alloc+0x158/0x1c0 ? acpi_ut_update_ref_count.part.1+0x8e/0x345 ? acpi_ut_update_object_reference+0x15e/0x1e2 ? strstr+0x21/0x70 ? irq_get_irq_data+0xa/0x20 ? mp_check_pin_attr+0x13/0xc0 ? irq_get_irq_data+0xa/0x20 ? mp_map_pin_to_irq+0xd3/0x2f0 ? acpi_register_gsi_ioapic+0x93/0x170 ? pci_conf1_read+0xa4/0x100 ? pci_bus_read_config_word+0x49/0x70 ? do_pci_enable_device+0xcc/0x100 local_pci_probe+0x41/0x90 work_for_cpu_fn+0x16/0x20 process_one_work+0x1a7/0x360 worker_thread+0x1cf/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? kthread_flush_work_fn+0x10/0x10 ret_from_fork+0x1f/0x40 The problem is that at that point misc IRQ vectors were not allocated yet and we get a call trace that driver is trying to free already free IRQ vectors. Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED PF state before calling i40e_free_misc_vector. This state is set only if misc IRQ vectors were properly initialized. Fixes: c17401a1dd21 ("i40e: use separate state bit for miscellaneous IRQ setup") Reported-by: PJ Waskiewicz <pwaskiewicz(a)jumptrading.com> Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com> Signed-off-by: Mateusz Palczewski <mateusz.palczewski(a)intel.com> Tested-by: Dave Switzer <david.switzer(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Acked-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index fc6550979118..84bb3ef9f638 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -4716,7 +4716,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf) { int i; - i40e_free_misc_vector(pf); + if (test_bit(__I40E_MISC_IRQ_REQUESTED, pf->state)) + i40e_free_misc_vector(pf); i40e_put_lump(pf->irq_pile, pf->iwarp_base_vector, I40E_IWARP_IRQ_PILE_ID); -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] cvm:improve security for cvm host feature
by Ju Fu 29 May '24

29 May '24

improve security for cvm host feature: cvm: enable secure memory alloc on multiple numa nodes cvm: add secure memory query method cvm: improve security for cvm host feature Signed-off-by: Ju Fu <fuju1(a)huawei.com> arch/arm64/include/asm/kvm_tmi.h | 97 +++-- arch/arm64/include/asm/kvm_tmm.h | 9 +- arch/arm64/include/uapi/asm/kvm.h | 4 + arch/arm64/kvm/arm.c | 33 +- arch/arm64/kvm/cvm.c | 598 +++++++++++++++--------------- arch/arm64/kvm/reset.c | 6 + arch/arm64/kvm/tmi.c | 41 +- include/uapi/linux/kvm.h | 6 +- 8 files changed, 388 insertions(+), 406 deletions(-) -- 2.25.1.windows.1

2 4

[PATCH OLK-5.10] tty: fix hang on tty device with no_room set
by Yi Yang 29 May '24

29 May '24

From: Hui Li <caelli(a)tencent.com> mainline inclusion from mainline-v6.5-rc1 commit 4903fde8047a28299d1fc79c1a0dcc255e928f12 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9T85S CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is possible to hang pty devices in this case, the reader was blocking at epoll on master side, the writer was sleeping at wait_woken inside n_tty_write on slave side, and the write buffer on tty_port was full, we found that the reader and writer would never be woken again and blocked forever. The problem was caused by a race between reader and kworker: n_tty_read(reader): n_tty_receive_buf_common(kworker): copy_from_read_buf()| |room = N_TTY_BUF_SIZE - (ldata->read_head - tail) |room <= 0 n_tty_kick_worker() | |ldata->no_room = true After writing to slave device, writer wakes up kworker to flush data on tty_port to reader, and the kworker finds that reader has no room to store data so room <= 0 is met. At this moment, reader consumes all the data on reader buffer and calls n_tty_kick_worker to check ldata->no_room which is false and reader quits reading. Then kworker sets ldata->no_room=true and quits too. If write buffer is not full, writer will wake kworker to flush data again after following writes, but if write buffer is full and writer goes to sleep, kworker will never be woken again and tty device is blocked. This problem can be solved with a check for read buffer size inside n_tty_receive_buf_common, if read buffer is empty and ldata->no_room is true, a call to n_tty_kick_worker is necessary to keep flushing data to reader. Cc: <stable(a)vger.kernel.org> Fixes: 42458f41d08f ("n_tty: Ensure reader restarts worker for next reader") Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Hui Li <caelli(a)tencent.com> Message-ID: <1680749090-14106-1-git-send-email-caelli(a)tencent.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/n_tty.c [commit 947d66b68f3c ("n_tty: Rename tail to old_tail in n_tty_read()") was not merge] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_tty.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c index 8e7931d93543..fb39271e08fa 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c @@ -202,8 +202,8 @@ static void n_tty_kick_worker(struct tty_struct *tty) struct n_tty_data *ldata = tty->disc_data; /* Did the input worker stop? Restart it */ - if (unlikely(ldata->no_room)) { - ldata->no_room = 0; + if (unlikely(READ_ONCE(ldata->no_room))) { + WRITE_ONCE(ldata->no_room, 0); WARN_RATELIMIT(tty->port->itty == NULL, "scheduling with invalid itty\n"); @@ -1725,7 +1725,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, if (overflow && room < 0) ldata->read_head--; room = overflow; - ldata->no_room = flow && !room; + WRITE_ONCE(ldata->no_room, flow && !room); } else overflow = 0; @@ -1756,6 +1756,17 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, } else n_tty_check_throttle(tty); + if (unlikely(ldata->no_room)) { + /* + * Barrier here is to ensure to read the latest read_tail in + * chars_in_buffer() and to make sure that read_tail is not loaded + * before ldata->no_room is set. + */ + smp_mb(); + if (!chars_in_buffer(tty)) + n_tty_kick_worker(tty); + } + up_read(&tty->termios_rwsem); return rcvd; @@ -2314,8 +2325,14 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, if (time) timeout = time; } - if (tail != ldata->read_tail) + if (tail != ldata->read_tail) { + /* + * Make sure no_room is not read in n_tty_kick_worker() + * before setting ldata->read_tail in copy_from_read_buf(). + */ + smp_mb(); n_tty_kick_worker(tty); + } up_read(&tty->termios_rwsem); remove_wait_queue(&tty->read_wait, &wait); -- 2.25.1

2 1

[PATCH OLK-5.10 0/3] improve security for cvm host feature
by Ju Fu 29 May '24

29 May '24

improve security for cvm host feature: cvm: enable secure memory alloc on multiple numa nodes cvm: add secure memory query method cvm: improve security for cvm host feature arch/arm64/include/asm/kvm_pgtable.h | 3 + arch/arm64/include/asm/kvm_tmi.h | 92 +++-- arch/arm64/include/asm/kvm_tmm.h | 9 +- arch/arm64/include/uapi/asm/kvm.h | 4 + arch/arm64/kvm/arm.c | 68 +++- arch/arm64/kvm/cvm.c | 563 ++++++++++++--------------- arch/arm64/kvm/reset.c | 6 + arch/arm64/kvm/tmi.c | 41 +- include/uapi/linux/kvm.h | 6 +- 9 files changed, 386 insertions(+), 406 deletions(-) -- 2.25.1.windows.1

2 4

[PATCH openEuler-22.03-LTS-SP1 v5] can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
by Yipeng Zou 29 May '24

29 May '24

From: Marc Kleine-Budde <mkl(a)pengutronix.de> mainline inclusion from mainline-v6.7-rc1 commit 6411959c10fe917288cbb1038886999148560057 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REA2 CVE: CVE-2023-52878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- If the "struct can_priv::echoo_skb" is accessed out of bounds, this would cause a kernel crash. Instead, issue a meaningful warning message and return with an error. Fixes: a6e4bc530403 ("can: make the number of echo skb's configurable") Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-5-91b5c1fd9… Reviewed-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Conflicts: drivers/net/can/dev/skb.c drivers/net/can/dev/dev.c [Since 18f2dbfd2232 ("can: dev: move skb related into seperate file") can_put_echo_skb has been moved to skb.c without any functional change. So we can fix this cve directly in dev.c.] Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/net/can/dev/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c index 2b38a99884f2..9e0a63374744 100644 --- a/drivers/net/can/dev/dev.c +++ b/drivers/net/can/dev/dev.c @@ -462,7 +462,11 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, { struct can_priv *priv = netdev_priv(dev); - BUG_ON(idx >= priv->echo_skb_max); + if (idx >= priv->echo_skb_max) { + netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", + __func__, idx, priv->echo_skb_max); + return -EINVAL; + } /* check flag whether this packet has to be looped back */ if (!(dev->flags & IFF_ECHO) || skb->pkt_type != PACKET_LOOPBACK || -- 2.34.1

2 1

[PATCH OLK-5.10 v5] can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
by Yipeng Zou 29 May '24

29 May '24

From: Marc Kleine-Budde <mkl(a)pengutronix.de> mainline inclusion from mainline-v6.7-rc1 commit 6411959c10fe917288cbb1038886999148560057 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REA2 CVE: CVE-2023-52878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- If the "struct can_priv::echoo_skb" is accessed out of bounds, this would cause a kernel crash. Instead, issue a meaningful warning message and return with an error. Fixes: a6e4bc530403 ("can: make the number of echo skb's configurable") Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-5-91b5c1fd9… Reviewed-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Conflicts: drivers/net/can/dev/skb.c drivers/net/can/dev/dev.c [Since 18f2dbfd2232 ("can: dev: move skb related into seperate file") can_put_echo_skb has been moved to skb.c without any functional change. So we can fix this cve directly in dev.c.] Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/net/can/dev/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c index b5e79d63d59b..535bf277ba90 100644 --- a/drivers/net/can/dev/dev.c +++ b/drivers/net/can/dev/dev.c @@ -462,7 +462,11 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, { struct can_priv *priv = netdev_priv(dev); - BUG_ON(idx >= priv->echo_skb_max); + if (idx >= priv->echo_skb_max) { + netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", + __func__, idx, priv->echo_skb_max); + return -EINVAL; + } /* check flag whether this packet has to be looped back */ if (!(dev->flags & IFF_ECHO) || skb->pkt_type != PACKET_LOOPBACK || -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v5] can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
by Yipeng Zou 29 May '24

29 May '24

From: Marc Kleine-Budde <mkl(a)pengutronix.de> mainline inclusion from mainline-v6.7-rc1 commit 6411959c10fe917288cbb1038886999148560057 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REA2 CVE: CVE-2023-52878 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- If the "struct can_priv::echoo_skb" is accessed out of bounds, this would cause a kernel crash. Instead, issue a meaningful warning message and return with an error. Fixes: a6e4bc530403 ("can: make the number of echo skb's configurable") Link: https://lore.kernel.org/all/20231005-can-dev-fix-can-restart-v2-5-91b5c1fd9… Reviewed-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Conflicts: drivers/net/can/dev/skb.c drivers/net/can/dev/dev.c [Since 18f2dbfd2232 ("can: dev: move skb related into seperate file") can_put_echo_skb has been moved to skb.c without any functional change. So we can fix this cve directly in dev.c.] Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/net/can/dev/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/dev/dev.c b/drivers/net/can/dev/dev.c index 40e2e1bbb8a6..5667f1ebd8e7 100644 --- a/drivers/net/can/dev/dev.c +++ b/drivers/net/can/dev/dev.c @@ -447,7 +447,11 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev, { struct can_priv *priv = netdev_priv(dev); - BUG_ON(idx >= priv->echo_skb_max); + if (idx >= priv->echo_skb_max) { + netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n", + __func__, idx, priv->echo_skb_max); + return; + } /* check flag whether this packet has to be looped back */ if (!(dev->flags & IFF_ECHO) || skb->pkt_type != PACKET_LOOPBACK || -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] powerpc/mm: Fix lockup on kernel exec fault
by Liu Shixin 29 May '24

29 May '24

From: Christophe Leroy <christophe.leroy(a)csgroup.eu> stable inclusion from stable-v5.4.133 commit a82471a14aad90f79d1608d2bcbb019f0ffb53f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4CI CVE: CVE-2021-47350 -------------------------------- commit cd5d5e602f502895e47e18cd46804d6d7014e65c upstream. The powerpc kernel is not prepared to handle exec faults from kernel. Especially, the function is_exec_fault() will return 'false' when an exec fault is taken by kernel, because the check is based on reading current->thread.regs->trap which contains the trap from user. For instance, when provoking a LKDTM EXEC_USERSPACE test, current->thread.regs->trap is set to SYSCALL trap (0xc00), and the fault taken by the kernel is not seen as an exec fault by set_access_flags_filter(). Commit d7df2443cd5f ("powerpc/mm: Fix spurious segfaults on radix with autonuma") made it clear and handled it properly. But later on commit d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") removed that handling, introducing test based on error_code. And here is the problem, because on the 603 all upper bits of SRR1 get cleared when the TLB instruction miss handler bails out to ISI. Until commit cbd7e6ca0210 ("powerpc/fault: Avoid heavy search_exception_tables() verification"), an exec fault from kernel at a userspace address was indirectly caught by the lack of entry for that address in the exception tables. But after that commit the kernel mainly relies on KUAP or on core mm handling to catch wrong user accesses. Here the access is not wrong, so mm handles it. It is a minor fault because PAGE_EXEC is not set, set_access_flags_filter() should set PAGE_EXEC and voila. But as is_exec_fault() returns false as explained in the beginning, set_access_flags_filter() bails out without setting PAGE_EXEC flag, which leads to a forever minor exec fault. As the kernel is not prepared to handle such exec faults, the thing to do is to fire in bad_kernel_fault() for any exec fault taken by the kernel, as it was prior to commit d3ca587404b3. Fixes: d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") Cc: stable(a)vger.kernel.org # v4.14+ Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> Acked-by: Nicholas Piggin <npiggin(a)gmail.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Link: https://lore.kernel.org/r/024bb05105050f704743a0083fe3548702be5706.16251382… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/powerpc/mm/fault.c [ Context conflicts due to lack of commit de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection"). ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- arch/powerpc/mm/fault.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c index 5b04d029f824..41f1de87edb6 100644 --- a/arch/powerpc/mm/fault.c +++ b/arch/powerpc/mm/fault.c @@ -221,9 +221,7 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr, static bool bad_kernel_fault(bool is_exec, unsigned long error_code, unsigned long address) { - /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */ - if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT | - DSISR_PROTFAULT))) { + if (is_exec) { printk_ratelimited(KERN_CRIT "kernel tried to execute" " exec-protected page (%lx) -" "exploit attempt? (uid: %d)\n", -- 2.25.1

2 1

[PATCH OLK-5.10] IMA: Introduce a config for fix on IMA with Overlayfs issue
by Xiang Yang 29 May '24

29 May '24

From: GUO Zihua <guozihua(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9T6ZD CVE: NA -------------------------------- IMA detect the backing inode changes through i_version of the backing inode would introduce a performance degrade, so introduce a config to allow users to turn the i_version detection on and off. Signed-off-by: GUO Zihua <guozihua(a)huawei.com> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- security/integrity/ima/Kconfig | 8 ++++++++ security/integrity/ima/ima_main.c | 6 ++++++ 2 files changed, 14 insertions(+) diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 213dc7079f84..9e254c5cb117 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -368,3 +368,11 @@ config IMA_PARSER_BINARY_PATH default "/usr/bin/upload_digest_lists" help This option defines the path of the parser binary. + +config IMA_FIX_OVERLAYFS_DETECTION + bool + default y + help + This option enables the fix for overlayfs backing inode change + detection. With this config enabled, IMA would be detecting + backing inode changes through i_version of the backing inode. diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 389d6e957357..0a202a4f07c1 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -267,7 +267,11 @@ static int process_measurement(struct file *file, const struct cred *cred, u32 secid, char *buf, loff_t size, int mask, enum ima_hooks func) { +#ifdef IMA_FIX_OVERLAYFS_DETECTION struct inode *backing_inode, *inode = file_inode(file); +#else + struct inode *inode = file_inode(file); +#endif struct integrity_iint_cache *iint = NULL; struct ima_template_desc *template_desc = NULL; char *pathbuf = NULL; @@ -344,6 +348,7 @@ static int process_measurement(struct file *file, const struct cred *cred, iint->measured_pcrs = 0; } +#ifdef IMA_FIX_OVERLAYFS_DETECTION /* Detect and re-evaluate changes made to the backing file. */ backing_inode = d_real_inode(file_dentry(file)); if (backing_inode != inode && @@ -356,6 +361,7 @@ static int process_measurement(struct file *file, const struct cred *cred, iint->measured_pcrs = 0; } } +#endif /* Determine if already appraised/measured based on bitmask * (IMA_MEASURE, IMA_MEASURED, IMA_XXXX_APPRAISE, IMA_XXXX_APPRAISED, -- 2.34.1

2 1

[PATCH OLK-5.10] sysv: don't call sb_bread() with pointers_lock held
by Yifan Qiao 29 May '24

29 May '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.27 commit 89e8524135a3902e7563a5a59b7b5ec1bf4904ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIO CVE: CVE-2023-52699 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- syzbot is reporting sleep in atomic context in SysV filesystem [1], for sb_bread() is called with rw_spinlock held. A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by "Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12. Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the former bug by moving pointers_lock lock to the callers, but instead introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made this problem easier to hit). Al Viro suggested that why not to do like get_branch()/get_block()/ find_shared() in Minix filesystem does. And doing like that is almost a revert of "[PATCH] err1-40: sysvfs locking fix" except that get_branch() from with find_shared() is called without write_lock(&pointers_lock). Reported-by: syzbot <syzbot+69b40dc5fd40f32c199f(a)syzkaller.appspotmail.com> Link: https://syzkaller.appspot.com/bug?extid=69b40dc5fd40f32c199f Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/0d195f93-a22a-49a2-0020-103534d6f7f6@I-love.SAKUR… Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/sysv/itree.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c index e3d1673b8ec9..ef9bcfeec21a 100644 --- a/fs/sysv/itree.c +++ b/fs/sysv/itree.c @@ -82,9 +82,6 @@ static inline sysv_zone_t *block_end(struct buffer_head *bh) return (sysv_zone_t*)((char*)bh->b_data + bh->b_size); } -/* - * Requires read_lock(&pointers_lock) or write_lock(&pointers_lock) - */ static Indirect *get_branch(struct inode *inode, int depth, int offsets[], @@ -104,15 +101,18 @@ static Indirect *get_branch(struct inode *inode, bh = sb_bread(sb, block); if (!bh) goto failure; + read_lock(&pointers_lock); if (!verify_chain(chain, p)) goto changed; add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets); + read_unlock(&pointers_lock); if (!p->key) goto no_block; } return NULL; changed: + read_unlock(&pointers_lock); brelse(bh); *err = -EAGAIN; goto no_block; @@ -218,9 +218,7 @@ static int get_block(struct inode *inode, sector_t iblock, struct buffer_head *b goto out; reread: - read_lock(&pointers_lock); partial = get_branch(inode, depth, offsets, chain, &err); - read_unlock(&pointers_lock); /* Simplest case - block found, no allocation needed */ if (!partial) { @@ -290,9 +288,9 @@ static Indirect *find_shared(struct inode *inode, *top = 0; for (k = depth; k > 1 && !offsets[k-1]; k--) ; + partial = get_branch(inode, k, offsets, chain, &err); write_lock(&pointers_lock); - partial = get_branch(inode, k, offsets, chain, &err); if (!partial) partial = chain + k-1; /* -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP2 v2 0/2] CVE-2024-35956
by iceleaf 29 May '24

29 May '24

Boris Burkov (1): btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Omar Sandoval (1): btrfs: fix anon_dev leak in create_subvol() fs/btrfs/ctree.h | 2 -- fs/btrfs/inode.c | 13 ++++++- fs/btrfs/ioctl.c | 81 +++++++++++++++++++++++++++----------------- fs/btrfs/root-tree.c | 10 ------ 4 files changed, 61 insertions(+), 45 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] sysv: don't call sb_bread() with pointers_lock held
by Yifan Qiao 29 May '24

29 May '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.27 commit 89e8524135a3902e7563a5a59b7b5ec1bf4904ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIO CVE: CVE-2023-52699 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- syzbot is reporting sleep in atomic context in SysV filesystem [1], for sb_bread() is called with rw_spinlock held. A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by "Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12. Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the former bug by moving pointers_lock lock to the callers, but instead introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made this problem easier to hit). Al Viro suggested that why not to do like get_branch()/get_block()/ find_shared() in Minix filesystem does. And doing like that is almost a revert of "[PATCH] err1-40: sysvfs locking fix" except that get_branch() from with find_shared() is called without write_lock(&pointers_lock). Reported-by: syzbot <syzbot+69b40dc5fd40f32c199f(a)syzkaller.appspotmail.com> Link: https://syzkaller.appspot.com/bug?extid=69b40dc5fd40f32c199f Suggested-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Link: https://lore.kernel.org/r/0d195f93-a22a-49a2-0020-103534d6f7f6@I-love.SAKUR… Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/sysv/itree.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c index bcb67b0cabe7..1714ff9a9b0e 100644 --- a/fs/sysv/itree.c +++ b/fs/sysv/itree.c @@ -82,9 +82,6 @@ static inline sysv_zone_t *block_end(struct buffer_head *bh) return (sysv_zone_t*)((char*)bh->b_data + bh->b_size); } -/* - * Requires read_lock(&pointers_lock) or write_lock(&pointers_lock) - */ static Indirect *get_branch(struct inode *inode, int depth, int offsets[], @@ -104,15 +101,18 @@ static Indirect *get_branch(struct inode *inode, bh = sb_bread(sb, block); if (!bh) goto failure; + read_lock(&pointers_lock); if (!verify_chain(chain, p)) goto changed; add_chain(++p, bh, (sysv_zone_t*)bh->b_data + *++offsets); + read_unlock(&pointers_lock); if (!p->key) goto no_block; } return NULL; changed: + read_unlock(&pointers_lock); brelse(bh); *err = -EAGAIN; goto no_block; @@ -214,9 +214,7 @@ static int get_block(struct inode *inode, sector_t iblock, struct buffer_head *b goto out; reread: - read_lock(&pointers_lock); partial = get_branch(inode, depth, offsets, chain, &err); - read_unlock(&pointers_lock); /* Simplest case - block found, no allocation needed */ if (!partial) { @@ -286,9 +284,9 @@ static Indirect *find_shared(struct inode *inode, *top = 0; for (k = depth; k > 1 && !offsets[k-1]; k--) ; + partial = get_branch(inode, k, offsets, chain, &err); write_lock(&pointers_lock); - partial = get_branch(inode, k, offsets, chain, &err); if (!partial) partial = chain + k-1; /* -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 v2 0/2] CVE-2024-35956
by iceleaf 29 May '24

29 May '24

Boris Burkov (1): btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Omar Sandoval (1): btrfs: fix anon_dev leak in create_subvol() fs/btrfs/ctree.h | 2 -- fs/btrfs/inode.c | 13 ++++++- fs/btrfs/ioctl.c | 81 +++++++++++++++++++++++++++----------------- fs/btrfs/root-tree.c | 10 ------ 4 files changed, 61 insertions(+), 45 deletions(-) -- 2.31.1

2 3

[PATCH OLK-5.10] Control KABI reservation codes with config
by Xiang Yang 29 May '24

29 May '24

From: GUO Zihua <guozihua(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9T6ZD CVE: NA -------------------------------- Control KABI reservation codes with CONFIG_KABI_RESERVE. Minimizing risk. Signed-off-by: GUO Zihua <guozihua(a)huawei.com> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- include/linux/proc_ns.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h index 81e99aa97cd7..737c98ebb7b3 100644 --- a/include/linux/proc_ns.h +++ b/include/linux/proc_ns.h @@ -16,7 +16,11 @@ struct inode; struct proc_ns_operations { const char *name; const char *real_ns_name; +#ifdef CONFIG_KABI_RESERVE u64 type; +#else + int type; +#endif struct ns_common *(*get)(struct task_struct *task); void (*put)(struct ns_common *ns); int (*install)(struct nsset *nsset, struct ns_common *ns); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS v2 0/2] CVE-2024-35956
by iceleaf 29 May '24

29 May '24

Boris Burkov (1): btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Omar Sandoval (1): btrfs: fix anon_dev leak in create_subvol() fs/btrfs/ctree.h | 2 -- fs/btrfs/inode.c | 13 ++++++- fs/btrfs/ioctl.c | 81 +++++++++++++++++++++++++++----------------- fs/btrfs/root-tree.c | 10 ------ 4 files changed, 61 insertions(+), 45 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] gfs2: ignore negated quota changes
by Yifan Qiao 29 May '24

29 May '24

From: Bob Peterson <rpeterso(a)redhat.com> stable inclusion from stable-v5.10.202 commit 2a054b87a1b799b391e578597a42ee6e57a987ae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4LN CVE: CVE-2023-52759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c6a08125f2249531ec01783a5f4317d7342add5 ] When lots of quota changes are made, there may be cases in which an inode's quota information is increased and then decreased, such as when blocks are added to a file, then deleted from it. If the timing is right, function do_qc can add pending quota changes to a transaction, then later, another call to do_qc can negate those changes, resulting in a net gain of 0. The quota_change information is recorded in the qc buffer (and qd element of the inode as well). The buffer is added to the transaction by the first call to do_qc, but a subsequent call changes the value from non-zero back to zero. At that point it's too late to remove the buffer_head from the transaction. Later, when the quota sync code is called, the zero-change qd element is discovered and flagged as an assert warning. If the fs is mounted with errors=panic, the kernel will panic. This is usually seen when files are truncated and the quota changes are negated by punch_hole/truncate which uses gfs2_quota_hold and gfs2_quota_unhold rather than block allocations that use gfs2_quota_lock and gfs2_quota_unlock which automatically do quota sync. This patch solves the problem by adding a check to qd_check_sync such that net-zero quota changes already added to the transaction are no longer deemed necessary to be synced, and skipped. In this case references are taken for the qd and the slot from do_qc so those need to be put. The normal sequence of events for a normal non-zero quota change is as follows: gfs2_quota_change do_qc qd_hold slot_hold Later, when the changes are to be synced: gfs2_quota_sync qd_fish qd_check_sync gets qd ref via lockref_get_not_dead do_sync do_qc(QC_SYNC) qd_put lockref_put_or_lock qd_unlock qd_put lockref_put_or_lock In the net-zero change case, we add a check to qd_check_sync so it puts the qd and slot references acquired in gfs2_quota_change and skip the unneeded sync. Signed-off-by: Bob Peterson <rpeterso(a)redhat.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/gfs2/quota.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index 0efae7a0ee80..3f7dd85af851 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -434,6 +434,17 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd, (sync_gen && (qd->qd_sync_gen >= *sync_gen))) return 0; + /* + * If qd_change is 0 it means a pending quota change was negated. + * We should not sync it, but we still have a qd reference and slot + * reference taken by gfs2_quota_change -> do_qc that need to be put. + */ + if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) { + slot_put(qd); + qd_put(qd); + return 0; + } + if (!lockref_get_not_dead(&qd->qd_lockref)) return 0; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] gfs2: ignore negated quota changes
by Yifan Qiao 29 May '24

29 May '24

From: Bob Peterson <rpeterso(a)redhat.com> stable inclusion from stable-v5.10.202 commit 2a054b87a1b799b391e578597a42ee6e57a987ae category: bugfix bugzilla: 189268 CVE: CVE-2023-52759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c6a08125f2249531ec01783a5f4317d7342add5 ] When lots of quota changes are made, there may be cases in which an inode's quota information is increased and then decreased, such as when blocks are added to a file, then deleted from it. If the timing is right, function do_qc can add pending quota changes to a transaction, then later, another call to do_qc can negate those changes, resulting in a net gain of 0. The quota_change information is recorded in the qc buffer (and qd element of the inode as well). The buffer is added to the transaction by the first call to do_qc, but a subsequent call changes the value from non-zero back to zero. At that point it's too late to remove the buffer_head from the transaction. Later, when the quota sync code is called, the zero-change qd element is discovered and flagged as an assert warning. If the fs is mounted with errors=panic, the kernel will panic. This is usually seen when files are truncated and the quota changes are negated by punch_hole/truncate which uses gfs2_quota_hold and gfs2_quota_unhold rather than block allocations that use gfs2_quota_lock and gfs2_quota_unlock which automatically do quota sync. This patch solves the problem by adding a check to qd_check_sync such that net-zero quota changes already added to the transaction are no longer deemed necessary to be synced, and skipped. In this case references are taken for the qd and the slot from do_qc so those need to be put. The normal sequence of events for a normal non-zero quota change is as follows: gfs2_quota_change do_qc qd_hold slot_hold Later, when the changes are to be synced: gfs2_quota_sync qd_fish qd_check_sync gets qd ref via lockref_get_not_dead do_sync do_qc(QC_SYNC) qd_put lockref_put_or_lock qd_unlock qd_put lockref_put_or_lock In the net-zero change case, we add a check to qd_check_sync so it puts the qd and slot references acquired in gfs2_quota_change and skip the unneeded sync. Signed-off-by: Bob Peterson <rpeterso(a)redhat.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/gfs2/quota.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c index 0efae7a0ee80..3f7dd85af851 100644 --- a/fs/gfs2/quota.c +++ b/fs/gfs2/quota.c @@ -434,6 +434,17 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd, (sync_gen && (qd->qd_sync_gen >= *sync_gen))) return 0; + /* + * If qd_change is 0 it means a pending quota change was negated. + * We should not sync it, but we still have a qd reference and slot + * reference taken by gfs2_quota_change -> do_qc that need to be put. + */ + if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) { + slot_put(qd); + qd_put(qd); + return 0; + } + if (!lockref_get_not_dead(&qd->qd_lockref)) return 0; -- 2.39.2

2 1

[PATCH OLK-5.10 0/9] A set of bugfixes for openeuler 22.03 SP4
by Chengchang Tang 29 May '24

29 May '24

From: Guofeng Yue <yueguofeng(a)h-partners.com> A set of bugfixes for openeuler 22.03 SP4 Chengchang Tang (4): RDMA/hns: Fix cpu stuck by printings during reset RDMA/hns: Fix missing default values of scc parameters RDMA/hns: directly read the scc parameters in the driver instead of the firmware RDMA/hns: Fix deadlock when using DCA debugfs. Junxian Huang (2): RDMA/hns: Fix missing validation check of DCA mem size RDMA/hns: Set NULL after mtr_node is freed wenglianfa (3): RDMA/hns: Fix CPU stuck due to read polling during reset RDMA/hns: Fix fmt output error RDMA/hns: Fix missing list_del in hns_roce_hem drivers/infiniband/hw/hns/hns_roce_cq.c | 7 ++- drivers/infiniband/hw/hns/hns_roce_dca.c | 5 ++ drivers/infiniband/hw/hns/hns_roce_debugfs.c | 12 ++-- drivers/infiniband/hw/hns/hns_roce_hem.c | 6 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 66 ++++++++++---------- drivers/infiniband/hw/hns/hns_roce_mr.c | 4 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 3 + drivers/infiniband/hw/hns/hns_roce_srq.c | 9 ++- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 33 +++++----- 9 files changed, 86 insertions(+), 59 deletions(-) -- 2.33.0

2 10

[PATCH OLK-5.10] md/dm-raid: don't call md_reap_sync_thread() directly
by Li Nan 29 May '24

29 May '24

mainline inclusion from mainline-v6.9-rc1 commit cd32b27a66db8776d8b8e82ec7d7dde97a8693b0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q98W CVE: CVE-2024-35808 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently md_reap_sync_thread() is called from raid_message() directly without holding 'reconfig_mutex', this is definitely unsafe because md_reap_sync_thread() can change many fields that is protected by 'reconfig_mutex'. However, hold 'reconfig_mutex' here is still problematic because this will cause deadlock, for example, commit 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). Fix this problem by using stop_sync_thread() to unregister sync_thread, like md/raid did. Fixes: be83651f0050 ("DM RAID: Add message/status support for changing sync action") Cc: stable(a)vger.kernel.org # v6.7+ Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Xiao Ni <xni(a)redhat.com> Acked-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20240305072306.2562024-7-yukuai1@huaweicloud.com Conflicts: drivers/md/dm-raid.c drivers/md/md.c drivers/md/md.h [ mainline uses new helper exported by commit 7a2347e284d7 ("md: export helpers to stop sync_thread"), just use exist helper and export them here. stop_sync_thread() is changed many times, but doesn't affect the logic of this patch. ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.h | 2 ++ drivers/md/dm-raid.c | 14 +++++--------- drivers/md/md.c | 6 ++++-- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/md/md.h b/drivers/md/md.h index df78553b4e5a..6eba883eddd6 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -773,6 +773,8 @@ extern void md_rdev_clear(struct md_rdev *rdev); extern void md_handle_request(struct mddev *mddev, struct bio *bio); extern void mddev_suspend(struct mddev *mddev); extern void mddev_resume(struct mddev *mddev); +extern void idle_sync_thread(struct mddev *mddev); +extern void frozen_sync_thread(struct mddev *mddev); extern struct bio *bio_alloc_mddev(gfp_t gfp_mask, int nr_iovecs, struct mddev *mddev); diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index fcdaba156211..3e3d4ed0c087 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3684,16 +3684,12 @@ static int raid_message(struct dm_target *ti, unsigned int argc, char **argv, return -EINVAL; if (!strcasecmp(argv[0], "frozen")) - set_bit(MD_RECOVERY_FROZEN, &mddev->recovery); - else - clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + frozen_sync_thread(mddev); + else if (!strcasecmp(argv[0], "idle")) + idle_sync_thread(mddev); - if (!strcasecmp(argv[0], "idle") || !strcasecmp(argv[0], "frozen")) { - if (mddev->sync_thread) { - set_bit(MD_RECOVERY_INTR, &mddev->recovery); - md_reap_sync_thread(mddev); - } - } else if (decipher_sync_action(mddev, mddev->recovery) != st_idle) + clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + if (decipher_sync_action(mddev, mddev->recovery) != st_idle) return -EBUSY; else if (!strcasecmp(argv[0], "resync")) ; /* MD_RECOVERY_NEEDED set below */ diff --git a/drivers/md/md.c b/drivers/md/md.c index a7faf6153085..6df154ab9802 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -4890,7 +4890,7 @@ static void stop_sync_thread(struct mddev *mddev) mddev_unlock(mddev); } -static void idle_sync_thread(struct mddev *mddev) +void idle_sync_thread(struct mddev *mddev) { int sync_seq = atomic_read(&mddev->sync_seq); @@ -4906,8 +4906,9 @@ static void idle_sync_thread(struct mddev *mddev) mutex_unlock(&mddev->sync_mutex); } +EXPORT_SYMBOL_GPL(idle_sync_thread); -static void frozen_sync_thread(struct mddev *mddev) +void frozen_sync_thread(struct mddev *mddev) { if (mutex_lock_interruptible(&mddev->sync_mutex)) return; @@ -4920,6 +4921,7 @@ static void frozen_sync_thread(struct mddev *mddev) mutex_unlock(&mddev->sync_mutex); } +EXPORT_SYMBOL_GPL(frozen_sync_thread); static ssize_t action_store(struct mddev *mddev, const char *page, size_t len) -- 2.39.2

2 1

[PATCH v2 OLK-5.10] dmaengine: idxd: Fix oops during rmmod on single-CPU platforms
by Wang Hai 29 May '24

29 May '24

From: Fenghua Yu <fenghua.yu(a)intel.com> mainline inclusion from mainline-v6.9-rc6 commit f221033f5c24659dc6ad7e5cf18fb1b075f4a8be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRHH CVE: CVE-2024-35989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- During the removal of the idxd driver, registered offline callback is invoked as part of the clean up process. However, on systems with only one CPU online, no valid target is available to migrate the perf context, resulting in a kernel oops: BUG: unable to handle page fault for address: 000000000002a2b8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 1470e1067 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57 Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023 RIP: 0010:mutex_lock+0x2e/0x50 ... Call Trace: <TASK> __die+0x24/0x70 page_fault_oops+0x82/0x160 do_user_addr_fault+0x65/0x6b0 __pfx___rdmsr_safe_on_cpu+0x10/0x10 exc_page_fault+0x7d/0x170 asm_exc_page_fault+0x26/0x30 mutex_lock+0x2e/0x50 mutex_lock+0x1e/0x50 perf_pmu_migrate_context+0x87/0x1f0 perf_event_cpu_offline+0x76/0x90 [idxd] cpuhp_invoke_callback+0xa2/0x4f0 __pfx_perf_event_cpu_offline+0x10/0x10 [idxd] cpuhp_thread_fun+0x98/0x150 smpboot_thread_fn+0x27/0x260 smpboot_thread_fn+0x1af/0x260 __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x103/0x140 __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 <TASK> Fix the issue by preventing the migration of the perf context to an invalid target. Fixes: 81dd4d4d6178 ("dmaengine: idxd: Add IDXD performance monitor support") Reported-by: Terrence Xu <terrence.xu(a)intel.com> Tested-by: Terrence Xu <terrence.xu(a)intel.com> Signed-off-by: Fenghua Yu <fenghua.yu(a)intel.com> Link: https://lore.kernel.org/r/20240313214031.1658045-1-fenghua.yu@intel.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- v1->v2: del Backport drivers/dma/idxd/perfmon.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/dma/idxd/perfmon.c b/drivers/dma/idxd/perfmon.c index d73004f47cf4..612ef13b7160 100644 --- a/drivers/dma/idxd/perfmon.c +++ b/drivers/dma/idxd/perfmon.c @@ -529,14 +529,11 @@ static int perf_event_cpu_offline(unsigned int cpu, struct hlist_node *node) return 0; target = cpumask_any_but(cpu_online_mask, cpu); - /* migrate events if there is a valid target */ - if (target < nr_cpu_ids) + if (target < nr_cpu_ids) { cpumask_set_cpu(target, &perfmon_dsa_cpu_mask); - else - target = -1; - - perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target); + perf_pmu_migrate_context(&idxd_pmu->pmu, cpu, target); + } return 0; } -- 2.17.1

2 1