- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] btrfs: dev-replace: properly validate device names
by Long Li 10 Apr '24

10 Apr '24

From: David Sterba <dsterba(a)suse.com> stable inclusion from stable-v5.10.167 commit 2886fe308a83968dde252302884a1e63351cf16d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E469 CVE: CVE-2024-26791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9845664b9ee47ce7ee7ea93caf47d39a9d4552c4 upstream. There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links). Link: https://lore.kernel.org/linux-btrfs/000000000000d1a1d1060cc9c5e7@google.com/ Link: https://lore.kernel.org/linux-btrfs/tencent_44CA0665C9836EF9EEC80CB9E7E206D… CC: stable(a)vger.kernel.org # 4.19+ CC: Edward Adam Davis <eadavis(a)qq.com> Reported-and-tested-by: syzbot+33f23b49ac24f986c9e8(a)syzkaller.appspotmail.com Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/dev-replace.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index be6935d19197..9a6055659c1a 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -566,6 +566,23 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; } +static int btrfs_check_replace_dev_names(struct btrfs_ioctl_dev_replace_args *args) +{ + if (args->start.srcdevid == 0) { + if (memchr(args->start.srcdev_name, 0, + sizeof(args->start.srcdev_name)) == NULL) + return -ENAMETOOLONG; + } else { + args->start.srcdev_name[0] = 0; + } + + if (memchr(args->start.tgtdev_name, 0, + sizeof(args->start.tgtdev_name)) == NULL) + return -ENAMETOOLONG; + + return 0; +} + int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, struct btrfs_ioctl_dev_replace_args *args) { @@ -578,10 +595,9 @@ int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, default: return -EINVAL; } - - if ((args->start.srcdevid == 0 && args->start.srcdev_name[0] == '\0') || - args->start.tgtdev_name[0] == '\0') - return -EINVAL; + ret = btrfs_check_replace_dev_names(args); + if (ret < 0) + return ret; ret = btrfs_dev_replace_start(fs_info, args->start.tgtdev_name, args->start.srcdevid, -- 2.31.1

2 1

[PATCH OLK-5.10] dm-crypt: don't modify the data when using authenticated encryption
by Li Lingfeng 10 Apr '24

10 Apr '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LW CVE: CVE-2024-26763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream. It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time. [1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 5d772f322a24..5edcdcee91c2 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2064,6 +2064,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; + if (crypt_integrity_aead(cc)) { + bio_copy_data(clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector += bio_sectors(clone); crypt_inc_pending(io); -- 2.31.1

2 1

[PATCH OLK-5.10] EDAC/thunderx: Fix possible out-of-bounds string access
by Lu Jialin 10 Apr '24

10 Apr '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.209 commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW CVE: CVE-2023-52464 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 0eb5eb97fd74..3b0e1fe27d93 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.34.1

2 1

[PATCH 1/7] Update kernel headers
by Chengchang Tang 10 Apr '24

10 Apr '24

driver inclusion category: feature bugzilla: https://gitee.com/src-openeuler/rdma-core/issues/I9C2AQ ------------------------------------------------------------------ To commit ?? ("RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode"). Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> --- kernel-headers/rdma/hns-abi.h | 73 ++++++++++++++++++++++++++++++++++- 1 file changed, 72 insertions(+), 1 deletion(-) diff --git a/kernel-headers/rdma/hns-abi.h b/kernel-headers/rdma/hns-abi.h index 1d51612..8a8f2e4 100644 --- a/kernel-headers/rdma/hns-abi.h +++ b/kernel-headers/rdma/hns-abi.h @@ -102,7 +102,9 @@ enum hns_roce_qp_cap_flags { HNS_ROCE_QP_CAP_RQ_RECORD_DB = 1 << 0, HNS_ROCE_QP_CAP_SQ_RECORD_DB = 1 << 1, HNS_ROCE_QP_CAP_OWNER_DB = 1 << 2, + HNS_ROCE_QP_CAP_DYNAMIC_CTX_ATTACH = 1 << 4, HNS_ROCE_QP_CAP_DIRECT_WQE = 1 << 5, + HNS_ROCE_QP_CAP_DYNAMIC_CTX_DETACH = 1 << 6, }; struct hns_roce_ib_create_qp_resp { @@ -114,12 +116,15 @@ struct hns_roce_ib_modify_qp_resp { __u8 tc_mode; __u8 priority; __u8 reserved[6]; + __u32 dcan; + __u32 rsv2; }; enum { HNS_ROCE_EXSGE_FLAGS = 1 << 0, HNS_ROCE_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_CQE_INLINE_FLAGS = 1 << 2, + HNS_ROCE_UCTX_CONFIG_DCA = 1 << 3, HNS_ROCE_UCTX_DYN_QP_PGSZ = 1 << 4, }; @@ -127,6 +132,7 @@ enum { HNS_ROCE_RSP_EXSGE_FLAGS = 1 << 0, HNS_ROCE_RSP_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_RSP_CQE_INLINE_FLAGS = 1 << 2, + HNS_ROCE_UCTX_RSP_DCA_FLAGS = HNS_ROCE_UCTX_CONFIG_DCA, HNS_ROCE_UCTX_RSP_DYN_QP_PGSZ = HNS_ROCE_UCTX_DYN_QP_PGSZ, }; @@ -139,12 +145,20 @@ struct hns_roce_ib_alloc_ucontext_resp { __u32 max_inline_data; __u8 congest_type; __u8 reserved0[7]; - __aligned_u64 rsv_for_dca[2]; + __u32 dca_qps; + __u32 dca_mmap_size; + __aligned_u64 dca_mmap_key; __aligned_u64 reset_mmap_key; }; +enum hns_roce_uctx_comp_mask { + HNS_ROCE_ALLOC_UCTX_COMP_DCA_MAX_QPS = 1 << 0, +}; + struct hns_roce_ib_alloc_ucontext { __u32 config; + __u32 comp; /* use hns_roce_uctx_comp_mask */ + __u32 dca_max_qps; __u32 reserved; }; @@ -158,4 +172,61 @@ struct hns_roce_ib_create_ah_resp { __u8 tc_mode; }; +#define UVERBS_ID_NS_MASK 0xF000 +#define UVERBS_ID_NS_SHIFT 12 + +enum hns_ib_objects { + HNS_IB_OBJECT_DCA_MEM = (1U << UVERBS_ID_NS_SHIFT), +}; + +enum hns_ib_dca_mem_methods { + HNS_IB_METHOD_DCA_MEM_REG = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_METHOD_DCA_MEM_DEREG, + HNS_IB_METHOD_DCA_MEM_SHRINK, + HNS_IB_METHOD_DCA_MEM_ATTACH, + HNS_IB_METHOD_DCA_MEM_DETACH, + HNS_IB_METHOD_DCA_MEM_QUERY, +}; + +enum hns_ib_dca_mem_reg_attrs { + HNS_IB_ATTR_DCA_MEM_REG_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_REG_FLAGS, + HNS_IB_ATTR_DCA_MEM_REG_LEN, + HNS_IB_ATTR_DCA_MEM_REG_ADDR, + HNS_IB_ATTR_DCA_MEM_REG_KEY, +}; + +enum hns_ib_dca_mem_dereg_attrs { + HNS_IB_ATTR_DCA_MEM_DEREG_HANDLE = (1U << UVERBS_ID_NS_SHIFT), +}; + +enum hns_ib_dca_mem_shrink_attrs { + HNS_IB_ATTR_DCA_MEM_SHRINK_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_SHRINK_RESERVED_SIZE, + HNS_IB_ATTR_DCA_MEM_SHRINK_OUT_FREE_KEY, + HNS_IB_ATTR_DCA_MEM_SHRINK_OUT_FREE_MEMS, +}; + +enum hns_ib_dca_mem_attach_attrs { + HNS_IB_ATTR_DCA_MEM_ATTACH_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_ATTACH_SQ_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_SGE_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_RQ_OFFSET, + HNS_IB_ATTR_DCA_MEM_ATTACH_OUT_ALLOC_FLAGS, + HNS_IB_ATTR_DCA_MEM_ATTACH_OUT_ALLOC_PAGES, +}; + +enum hns_ib_dca_mem_detach_attrs { + HNS_IB_ATTR_DCA_MEM_DETACH_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_DETACH_SQ_INDEX, +}; + +enum hns_ib_dca_mem_query_attrs { + HNS_IB_ATTR_DCA_MEM_QUERY_HANDLE = (1U << UVERBS_ID_NS_SHIFT), + HNS_IB_ATTR_DCA_MEM_QUERY_PAGE_INDEX, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_KEY, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_OFFSET, + HNS_IB_ATTR_DCA_MEM_QUERY_OUT_PAGE_COUNT, +}; + #endif /* HNS_ABI_USER_H */ -- 2.33.0

1 6

[OLK-6.6 00/12] Support hns roce DCA mode
by Chengchang Tang 10 Apr '24

10 Apr '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Support hns roce DCA mode. Chengchang Tang (12): RDMA/hns: Introduce DCA for RC QP RDMA/hns: Add method for shrinking DCA memory pool RDMA/hns: Configure DCA mode for the userspace QP RDMA/hns: Add method for attaching WQE buffer RDMA/hns: Setup the configuration of WQE addressing to QPC RDMA/hns: Add method to detach WQE buffer RDMA/hns: Add method to query WQE buffer's address RDMA/hns: Add DCA support for kernel space RDMA/hns: Add debugfs support for DCA RDMA/hns: Optimize user DCA perfermance by sharing DCA status RDMA/hns: Fixes concurrent ressetting and post_recv in DCA mode RDMA/hns: Fix DCA's dependence on ib_uverbs drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_dca.c | 1875 ++++++++++++++++++ drivers/infiniband/hw/hns/hns_roce_dca.h | 78 + drivers/infiniband/hw/hns/hns_roce_debugfs.c | 406 ++++ drivers/infiniband/hw/hns/hns_roce_debugfs.h | 19 + drivers/infiniband/hw/hns/hns_roce_device.h | 69 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 304 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 5 + drivers/infiniband/hw/hns/hns_roce_main.c | 196 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 12 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 197 +- include/uapi/rdma/hns-abi.h | 73 +- 12 files changed, 3099 insertions(+), 137 deletions(-) create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.c create mode 100644 drivers/infiniband/hw/hns/hns_roce_dca.h -- 2.30.0

1 12

[PATCH OLK-5.10 0/1] fixup CVE-2024-26751
by Yuntao Liu 10 Apr '24

10 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10] fbdev: savage: Error out if pixclock equals zero
by Cai Xinchen 10 Apr '24

10 Apr '24

From: Fullway Wang <fullwaywang(a)outlook.com> stable inclusion from stable-v5.10.211 commit 512ee6d6041e007ef5bf200c6e388e172a2c5b24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y8 CVE: CVE-2024-26778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang <fullwaywang(a)outlook.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index 0ac750cc5ea1..94ebd8af50cf 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -868,6 +868,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var, DBG("savagefb_check_var"); + if (!var->pixclock) + return -EINVAL; + var->transp.offset = 0; var->transp.length = 0; switch (var->bits_per_pixel) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH openEuler-22.03-LTS-SP1 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH openEuler-22.03-LTS 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH OLK-5.10 0/4] Fix CVE-2023-52441 and integrate the pre-patch
by ZhaoLong Wang 10 Apr '24

10 Apr '24

All patches are from 5.15.y. Namjae Jeon (4): ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect ksmbd: return unsupported error on smb1 mount ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr ksmbd: fix out of bounds in init_smb2_rsp_hdr() fs/ksmbd/connection.c | 7 +-- fs/ksmbd/server.c | 6 +- fs/ksmbd/smb2pdu.c | 3 - fs/ksmbd/smb_common.c | 142 +++++++++++++++++++++++++++++++++++------- fs/ksmbd/smb_common.h | 30 +++------ 5 files changed, 135 insertions(+), 53 deletions(-) -- 2.34.3

2 5

[PATCH OLK-5.10 0/1] fixup CVE-2024-26751
by Yuntao Liu 10 Apr '24

10 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

1 1

[PATCH openEuler-1.0-LTS] btrfs: dev-replace: properly validate device names
by Long Li 10 Apr '24

10 Apr '24

From: David Sterba <dsterba(a)suse.com> stable inclusion from stable-v4.19.273 commit 11d7a2e429c02d51e2dc90713823ea8b8d3d3a84 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E469 CVE: CVE-2024-26791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 9845664b9ee47ce7ee7ea93caf47d39a9d4552c4 upstream. There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links). Link: https://lore.kernel.org/linux-btrfs/000000000000d1a1d1060cc9c5e7@google.com/ Link: https://lore.kernel.org/linux-btrfs/tencent_44CA0665C9836EF9EEC80CB9E7E206D… CC: stable(a)vger.kernel.org # 4.19+ CC: Edward Adam Davis <eadavis(a)qq.com> Reported-and-tested-by: syzbot+33f23b49ac24f986c9e8(a)syzkaller.appspotmail.com Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/dev-replace.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index 1b9c8ffb038f..c50c0251fd90 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -513,6 +513,23 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; } +static int btrfs_check_replace_dev_names(struct btrfs_ioctl_dev_replace_args *args) +{ + if (args->start.srcdevid == 0) { + if (memchr(args->start.srcdev_name, 0, + sizeof(args->start.srcdev_name)) == NULL) + return -ENAMETOOLONG; + } else { + args->start.srcdev_name[0] = 0; + } + + if (memchr(args->start.tgtdev_name, 0, + sizeof(args->start.tgtdev_name)) == NULL) + return -ENAMETOOLONG; + + return 0; +} + int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, struct btrfs_ioctl_dev_replace_args *args) { @@ -525,10 +542,9 @@ int btrfs_dev_replace_by_ioctl(struct btrfs_fs_info *fs_info, default: return -EINVAL; } - - if ((args->start.srcdevid == 0 && args->start.srcdev_name[0] == '\0') || - args->start.tgtdev_name[0] == '\0') - return -EINVAL; + ret = btrfs_check_replace_dev_names(args); + if (ret < 0) + return ret; ret = btrfs_dev_replace_start(fs_info, args->start.tgtdev_name, args->start.srcdevid, -- 2.31.1

2 1

[PATCH OLK-5.10 0/1] fixup CVE-2024-26751
by Yuntao Liu 10 Apr '24

10 Apr '24

fixup CVE-2024-26751 Nikita Shubin (1): ARM: ep93xx: Add terminator to gpiod_lookup_table arch/arm/mach-ep93xx/core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

1 1

[PATCH openEuler-1.0-LTS] fbdev: savage: Error out if pixclock equals zero
by Cai Xinchen 10 Apr '24

10 Apr '24

From: Fullway Wang <fullwaywang(a)outlook.com> stable inclusion from stable-v4.19.308 commit 224453de8505aede1890f007be973925a3edf6a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y8 CVE: CVE-2024-26778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang <fullwaywang(a)outlook.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index c09d7426cd92..d9eafdb89cea 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -869,6 +869,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var, DBG("savagefb_check_var"); + if (!var->pixclock) + return -EINVAL; + var->transp.offset = 0; var->transp.length = 0; switch (var->bits_per_pixel) { -- 2.34.1

2 1

[PATCH] fbdev: savage: Error out if pixclock equals zero
by Cai Xinchen 10 Apr '24

10 Apr '24

From: Fullway Wang <fullwaywang(a)outlook.com> stable inclusion from stable-v4.19.308 commit 224453de8505aede1890f007be973925a3edf6a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2Y8 CVE: CVE-2024-26778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288 ] The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Signed-off-by: Fullway Wang <fullwaywang(a)outlook.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/video/fbdev/savage/savagefb_driver.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c index c09d7426cd92..d9eafdb89cea 100644 --- a/drivers/video/fbdev/savage/savagefb_driver.c +++ b/drivers/video/fbdev/savage/savagefb_driver.c @@ -869,6 +869,9 @@ static int savagefb_check_var(struct fb_var_screeninfo *var, DBG("savagefb_check_var"); + if (!var->pixclock) + return -EINVAL; + var->transp.offset = 0; var->transp.length = 0; switch (var->bits_per_pixel) { -- 2.34.1

1 0

[PATCH OLK-5.10 0/5] cvm feature patches
by hejingxian 10 Apr '24

10 Apr '24

From: Jingxian He <hejingxian(a)huawei.com> Add cvm feature patches: 1. add cvm host feature 2. enable pmu phys irq inject for cvm 3. add bounce buffer feature for cvm guest 4. add lpi support for cvm guest 5. fix kabi for cvm host arch/arm64/configs/defconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/include/asm/cvm_guest.h | 21 + arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 28 +- arch/arm64/include/asm/kvm_tmi.h | 377 +++++++++++ arch/arm64/include/asm/kvm_tmm.h | 73 +++ arch/arm64/kvm/Kconfig | 16 + arch/arm64/kvm/Makefile | 5 + arch/arm64/kvm/arch_timer.c | 104 ++- arch/arm64/kvm/arm.c | 157 ++++- arch/arm64/kvm/cvm.c | 869 +++++++++++++++++++++++++ arch/arm64/kvm/cvm_exit.c | 240 +++++++ arch/arm64/kvm/cvm_guest.c | 91 +++ arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/hisilicon/hisi_virt.c | 7 + arch/arm64/kvm/hyp/vgic-v3-sr.c | 19 + arch/arm64/kvm/mmio.c | 19 + arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 10 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 10 + arch/arm64/kvm/tmi.c | 168 +++++ arch/arm64/kvm/vgic/vgic-v3.c | 18 +- arch/arm64/kvm/vgic/vgic.c | 59 +- arch/arm64/mm/mmu.c | 11 + arch/arm64/mm/pageattr.c | 9 +- drivers/irqchip/irq-gic-v3-its.c | 229 ++++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 23 + include/linux/perf/arm_pmu.h | 3 + include/linux/swiotlb.h | 13 + include/uapi/linux/kvm.h | 27 + kernel/dma/direct.c | 39 ++ kernel/dma/swiotlb.c | 86 ++- virt/kvm/kvm_main.c | 7 +- 37 files changed, 2765 insertions(+), 43 deletions(-) create mode 100644 arch/arm64/include/asm/cvm_guest.h create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/kvm_tmm.h create mode 100644 arch/arm64/kvm/cvm.c create mode 100644 arch/arm64/kvm/cvm_exit.c create mode 100644 arch/arm64/kvm/cvm_guest.c create mode 100644 arch/arm64/kvm/tmi.c -- 2.33.0

2 6

[PATCH openEuler-22.03-LTS-SP2] EDAC/thunderx: Fix possible out-of-bounds string access
by Guo Mengqi 10 Apr '24

10 Apr '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.209 commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 0eb5eb97fd74..3b0e1fe27d93 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] EDAC/thunderx: Fix possible out-of-bounds string access
by Guo Mengqi 10 Apr '24

10 Apr '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.209 commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 0eb5eb97fd74..3b0e1fe27d93 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] EDAC/thunderx: Fix possible out-of-bounds string access
by Guo Mengqi 10 Apr '24

10 Apr '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.209 commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 0eb5eb97fd74..3b0e1fe27d93 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.17.1

2 1

[PATCH V2 OLK-6.6] mm, fs: Add BPF_READAHEAD_OPTIMIZATION option for bpf readhead
by ZhaoLong Wang 10 Apr '24

10 Apr '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7Y9JD CVE: NA --------------------------- This patch introduces a new configuration option called BPF_READAHEAD_OPTIMIZATION, which is designed to optimize the read performance in Spark SQL scenarios using eBPF to implement a programmable kernel. The changes include: - Add CONFIG_BPF_READAHEAD_OPTIMIZATION to mm/Kconfig, which depends on CONFIG_TRACEPOINTS. - Add conditional compilation directives to fs/ext4/file.c, fs/read_write.c, fs/xfs/xfs_file.c, and include/linux/fs.h to include tracepoint-related headers and functions only when BPF_READAHEAD_OPTIMIZATION is enabled. - Miodify page_cache_sync_ra() in mm/readahead.c to disable forced readahead when BPF_READAHEAD_OPTIMIZATION is not enabled. V2: Explicitly set CONFIG_ in openeuler_defconfig. Do not add redundant macros to mm/readahead. Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/configs/openeuler_defconfig | 1 + arch/riscv/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/ext4/file.c | 6 ++++++ fs/read_write.c | 2 +- fs/xfs/xfs_file.c | 7 ++++++- include/linux/fs.h | 9 +++++++++ mm/Kconfig | 9 +++++++++ 9 files changed, 35 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index afd13d9e3840..fe3ad1d678b9 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1191,6 +1191,7 @@ CONFIG_DYNAMIC_POOL=y CONFIG_ETMEM_SCAN=m CONFIG_ETMEM_SWAP=m CONFIG_ETMEM=y +# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set # # Data Access Monitoring diff --git a/arch/powerpc/configs/openeuler_defconfig b/arch/powerpc/configs/openeuler_defconfig index 152b941da1d5..793cca85862c 100644 --- a/arch/powerpc/configs/openeuler_defconfig +++ b/arch/powerpc/configs/openeuler_defconfig @@ -860,6 +860,7 @@ CONFIG_ARCH_HAS_HUGEPD=y CONFIG_USERFAULTFD=y # CONFIG_LRU_GEN is not set CONFIG_LOCK_MM_AND_FIND_VMA=y +# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set # # Data Access Monitoring diff --git a/arch/riscv/configs/openeuler_defconfig b/arch/riscv/configs/openeuler_defconfig index cb132f4576da..06caed7e855a 100644 --- a/arch/riscv/configs/openeuler_defconfig +++ b/arch/riscv/configs/openeuler_defconfig @@ -825,6 +825,7 @@ CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y # CONFIG_PAGE_CACHE_LIMIT is not set +# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set # # Data Access Monitoring diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 360c382f4d9e..da6c5bd3eaa1 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -1179,6 +1179,7 @@ CONFIG_DYNAMIC_POOL=y CONFIG_ETMEM_SCAN=m CONFIG_ETMEM_SWAP=m CONFIG_ETMEM=y +# CONFIG_BPF_READAHEAD_OPTIMIZATION is not set # # Data Access Monitoring diff --git a/fs/ext4/file.c b/fs/ext4/file.c index 324b45b51d1f..14f1441c3391 100644 --- a/fs/ext4/file.c +++ b/fs/ext4/file.c @@ -30,7 +30,9 @@ #include <linux/uio.h> #include <linux/mman.h> #include <linux/backing-dev.h> +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #include <trace/events/fs.h> +#endif #include "ext4.h" #include "ext4_jbd2.h" #include "xattr.h" @@ -145,7 +147,9 @@ static ssize_t ext4_file_read_iter(struct kiocb *iocb, struct iov_iter *to) if (iocb->ki_flags & IOCB_DIRECT) return ext4_dio_read_iter(iocb, to); +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION fs_file_read_do_trace(iocb); +#endif return generic_file_read_iter(iocb, to); } @@ -167,7 +171,9 @@ static ssize_t ext4_file_splice_read(struct file *in, loff_t *ppos, */ static int ext4_release_file(struct inode *inode, struct file *filp) { +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION trace_fs_file_release(inode, filp); +#endif if (ext4_test_inode_state(inode, EXT4_STATE_DA_ALLOC_CLOSE)) { ext4_alloc_da_blocks(inode); diff --git a/fs/read_write.c b/fs/read_write.c index 3d69fb284d10..2ee9a07f7208 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -1721,7 +1721,7 @@ int generic_file_rw_checks(struct file *file_in, struct file *file_out) return 0; } -#ifdef CONFIG_TRACEPOINTS +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION static void fs_file_read_ctx_init(struct fs_file_read_ctx *ctx, struct file *filp, loff_t pos) { diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index ecf10d3aec17..7a4bd39bc694 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -31,7 +31,9 @@ #include <linux/mman.h> #include <linux/fadvise.h> #include <linux/mount.h> +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #include <trace/events/fs.h> +#endif static const struct vm_operations_struct xfs_file_vm_ops; @@ -308,8 +310,9 @@ xfs_file_buffered_read( ssize_t ret; trace_xfs_file_buffered_read(iocb, to); +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION fs_file_read_do_trace(iocb); - +#endif ret = xfs_ilock_iocb(iocb, XFS_IOLOCK_SHARED); if (ret) return ret; @@ -1266,7 +1269,9 @@ xfs_file_release( struct inode *inode, struct file *filp) { +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION trace_fs_file_release(inode, filp); +#endif return xfs_release(XFS_I(inode)); } diff --git a/include/linux/fs.h b/include/linux/fs.h index d74314a8fa94..5e09be647907 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -43,7 +43,9 @@ #include <linux/cred.h> #include <linux/mnt_idmapping.h> #include <linux/slab.h> +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #include <linux/tracepoint-defs.h> +#endif #include <linux/kabi.h> #include <asm/byteorder.h> @@ -190,11 +192,16 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset, /* File supports async nowait buffered writes */ #define FMODE_BUF_WASYNC ((__force fmode_t)0x80000000) +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION /* File mode control flag, expect random access pattern */ #define FMODE_CTL_RANDOM ((__force fmode_t)0x1000) /* File mode control flag, will try to read head of the file into pagecache */ #define FMODE_CTL_WILLNEED ((__force fmode_t)0x400000) +#else +#define FMODE_CTL_RANDOM 0 +#define FMODE_CTL_WILLNEED 0 +#endif /* * Attribute flags. These should be or-ed together to figure out what @@ -3524,6 +3531,7 @@ struct fs_file_read_ctx { long long index; }; +#ifdef CONFIG_BPF_READAHEAD_OPTIMIZATION #ifdef CONFIG_TRACEPOINTS DECLARE_TRACEPOINT(fs_file_read); extern void fs_file_read_update_args_by_trace(struct kiocb *iocb); @@ -3536,4 +3544,5 @@ static inline void fs_file_read_do_trace(struct kiocb *iocb) if (tracepoint_enabled(fs_file_read)) fs_file_read_update_args_by_trace(iocb); } +#endif #endif /* _LINUX_FS_H */ diff --git a/mm/Kconfig b/mm/Kconfig index cdbb1ceaa554..0c22baa52542 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1424,6 +1424,15 @@ config ETMEM high-performance storage media to release memory space and reduce memory costs. +config BPF_READAHEAD_OPTIMIZATION + bool "Enable bpf readahead optimization" + select TRACEPOINTS + default n + help + EBPF is used to implement a programmable kernel. The readahead behavior + of the kernel is adjusted based on the application read mode to optimize + the read performance in the Spark SQL scenario, + source "mm/damon/Kconfig" endmenu -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] RDMA/qedr: Fix qedr_create_user_qp error flow
by Ziyang Xuan 10 Apr '24

10 Apr '24

From: Kamal Heib <kheib(a)redhat.com> mainline inclusion from mainline-v6.8-rc6 commit 5ba4e6d5863c53e937f49932dee0ecb004c65928 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2M7 CVE: CVE-2024-26743 -------------------------------- Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail. -----------[ cut here ]----------- WARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] Modules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3 ghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt] CPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022 RIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] Code: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 <0f> 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff RSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286 RAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016 RDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 R10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80 R13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? ib_uverbs_close+0x1f/0xb0 [ib_uverbs] ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ? __warn+0x81/0x110 ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ? report_bug+0x10a/0x140 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ib_uverbs_close+0x1f/0xb0 [ib_uverbs] __fput+0x94/0x250 task_work_run+0x5c/0x90 do_exit+0x270/0x4a0 do_group_exit+0x2d/0x90 get_signal+0x87c/0x8c0 arch_do_signal_or_restart+0x25/0x100 ? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs] exit_to_user_mode_loop+0x9c/0x130 exit_to_user_mode_prepare+0xb6/0x100 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x22/0x40 ? do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x22/0x40 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 ? common_interrupt+0x43/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x1470abe3ec6b Code: Unable to access opcode bytes at RIP 0x1470abe3ec41. RSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b RDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004 RBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00 R10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358 R13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470 </TASK> --[ end trace 888a9b92e04c5c97 ]-- Fixes: df15856132bc ("RDMA/qedr: restructure functions that create/destroy QPs") Signed-off-by: Kamal Heib <kheib(a)redhat.com> Link: https://lore.kernel.org/r/20240208223628.2040841-1-kheib@redhat.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/qedr/verbs.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/hw/qedr/verbs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c index 9167a1c40bcf..830d94e33134 100644 --- a/drivers/infiniband/hw/qedr/verbs.c +++ b/drivers/infiniband/hw/qedr/verbs.c @@ -1744,8 +1744,17 @@ static int qedr_create_user_qp(struct qedr_dev *dev, /* RQ - read access only (0), dma sync not required (0) */ rc = qedr_init_user_queue(ib_ctx, dev, &qp->urq, ureq.rq_addr, ureq.rq_len, 0, 0, alloc_and_init); - if (rc) + if (rc) { + ib_umem_release(qp->usq.umem); + qp->usq.umem = NULL; + if (rdma_protocol_roce(&dev->ibdev, 1)) { + qedr_free_pbl(dev, &qp->usq.pbl_info, + qp->usq.pbl_tbl); + } else { + kfree(qp->usq.pbl_tbl); + } return rc; + } } memset(&in_params, 0, sizeof(in_params)); -- 2.25.1

2 1

[PATCH OLK-5.10] RDMA/qedr: Fix qedr_create_user_qp error flow
by Ziyang Xuan 10 Apr '24

10 Apr '24

From: Kamal Heib <kheib(a)redhat.com> stable inclusion from stable-v5.10.211 commit 5639414a52a29336ffa1ede80a67c6d927acbc5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2M7 CVE: CVE-2024-26743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ba4e6d5863c53e937f49932dee0ecb004c65928 ] Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail. -----------[ cut here ]----------- WARNING: CPU: 0 PID: 143192 at drivers/infiniband/core/rdma_core.c:874 uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] Modules linked in: tls target_core_user uio target_core_pscsi target_core_file target_core_iblock ib_srpt ib_srp scsi_transport_srp nfsd nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs 8021q garp mrp stp llc ext4 mbcache jbd2 opa_vnic ib_umad ib_ipoib sunrpc rdma_ucm ib_isert iscsi_target_mod target_core_mod ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm hfi1 intel_rapl_msr intel_rapl_common mgag200 qedr sb_edac drm_shmem_helper rdmavt x86_pkg_temp_thermal drm_kms_helper intel_powerclamp ib_uverbs coretemp i2c_algo_bit kvm_intel dell_wmi_descriptor ipmi_ssif sparse_keymap kvm ib_core rfkill syscopyarea sysfillrect video sysimgblt irqbypass ipmi_si ipmi_devintf fb_sys_fops rapl iTCO_wdt mxm_wmi iTCO_vendor_support intel_cstate pcspkr dcdbas intel_uncore ipmi_msghandler lpc_ich acpi_power_meter mei_me mei fuse drm xfs libcrc32c qede sd_mod ahci libahci t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel qed libata tg3 ghash_clmulni_intel megaraid_sas crc8 wmi [last unloaded: ib_srpt] CPU: 0 PID: 143192 Comm: fi_rdm_tagged_p Kdump: loaded Not tainted 5.14.0-408.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R430/03XKDV, BIOS 2.14.0 01/25/2022 RIP: 0010:uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] Code: 5d 41 5c 41 5d 41 5e e9 0f 26 1b dd 48 89 df e8 67 6a ff ff 49 8b 86 10 01 00 00 48 85 c0 74 9c 4c 89 e7 e8 83 c0 cb dd eb 92 <0f> 0b eb be 0f 0b be 04 00 00 00 48 89 df e8 8e f5 ff ff e9 6d ff RSP: 0018:ffffb7c6cadfbc60 EFLAGS: 00010286 RAX: ffff8f0889ee3f60 RBX: ffff8f088c1a5200 RCX: 00000000802a0016 RDX: 00000000802a0017 RSI: 0000000000000001 RDI: ffff8f0880042600 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000 R10: ffff8f11fffd5000 R11: 0000000000039000 R12: ffff8f0d5b36cd80 R13: ffff8f088c1a5250 R14: ffff8f1206d91000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8f11d7c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000147069200e20 CR3: 00000001c7210002 CR4: 00000000001706f0 Call Trace: <TASK> ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? ib_uverbs_close+0x1f/0xb0 [ib_uverbs] ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ? __warn+0x81/0x110 ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ? report_bug+0x10a/0x140 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? uverbs_destroy_ufile_hw+0xcf/0xf0 [ib_uverbs] ib_uverbs_close+0x1f/0xb0 [ib_uverbs] __fput+0x94/0x250 task_work_run+0x5c/0x90 do_exit+0x270/0x4a0 do_group_exit+0x2d/0x90 get_signal+0x87c/0x8c0 arch_do_signal_or_restart+0x25/0x100 ? ib_uverbs_ioctl+0xc2/0x110 [ib_uverbs] exit_to_user_mode_loop+0x9c/0x130 exit_to_user_mode_prepare+0xb6/0x100 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x22/0x40 ? do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x22/0x40 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 ? common_interrupt+0x43/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x1470abe3ec6b Code: Unable to access opcode bytes at RIP 0x1470abe3ec41. RSP: 002b:00007fff13ce9108 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffffc RBX: 00007fff13ce9218 RCX: 00001470abe3ec6b RDX: 00007fff13ce9200 RSI: 00000000c0181b01 RDI: 0000000000000004 RBP: 00007fff13ce91e0 R08: 0000558d9655da10 R09: 0000558d9655dd00 R10: 00007fff13ce95c0 R11: 0000000000000246 R12: 00007fff13ce9358 R13: 0000000000000013 R14: 0000558d9655db50 R15: 00007fff13ce9470 </TASK> --[ end trace 888a9b92e04c5c97 ]-- Fixes: df15856132bc ("RDMA/qedr: restructure functions that create/destroy QPs") Signed-off-by: Kamal Heib <kheib(a)redhat.com> Link: https://lore.kernel.org/r/20240208223628.2040841-1-kheib@redhat.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/hw/qedr/verbs.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c index 3543b9af10b7..d382ac21159c 100644 --- a/drivers/infiniband/hw/qedr/verbs.c +++ b/drivers/infiniband/hw/qedr/verbs.c @@ -1865,8 +1865,17 @@ static int qedr_create_user_qp(struct qedr_dev *dev, /* RQ - read access only (0) */ rc = qedr_init_user_queue(udata, dev, &qp->urq, ureq.rq_addr, ureq.rq_len, true, 0, alloc_and_init); - if (rc) + if (rc) { + ib_umem_release(qp->usq.umem); + qp->usq.umem = NULL; + if (rdma_protocol_roce(&dev->ibdev, 1)) { + qedr_free_pbl(dev, &qp->usq.pbl_info, + qp->usq.pbl_tbl); + } else { + kfree(qp->usq.pbl_tbl); + } return rc; + } } memset(&in_params, 0, sizeof(in_params)); -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP2 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 58daf587f2ce5a8a98d67136d6abfb947bda4cf9
by kernel test robot 10 Apr '24

10 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 58daf587f2ce5a8a98d67136d6abfb947bda4cf9 !5807 nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Unverified Warning (likely false positive, please contact us if interested): drivers/net/ethernet/intel/ice/ice_osdep.h:28:51: warning: array subscript 0 is outside array bounds of 'struct ice_hw[14593943096289202]' [-Warray-bounds=] drivers/video/fbdev/omap2/omapfb/dss/hdmi4_core.o: warning: objtool: missing symbol for section .text include/linux/uaccess.h:112:17: warning: 'iocommand' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'tmp_str' may be used uninitialized [-Wmaybe-uninitialized] Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-defconfig | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- arm64-randconfig-001-20240410 | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized | `-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized `-- arm64-randconfig-003-20240410 |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized |-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized |-- drivers-net-ethernet-intel-ice-ice_osdep.h:warning:array-subscript-is-outside-array-bounds-of-struct-ice_hw |-- include-linux-uaccess.h:warning:iocommand-may-be-used-uninitialized `-- include-linux-uaccess.h:warning:tmp_str-may-be-used-uninitialized clang_recent_errors `-- x86_64-buildonly-randconfig-002-20240410 `-- drivers-video-fbdev-omap2-omapfb-dss-hdmi4_core.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 740m configs tested: 20 configs skipped: 148 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240410 gcc arm64 randconfig-002-20240410 gcc arm64 randconfig-003-20240410 gcc arm64 randconfig-004-20240410 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240410 gcc x86_64 buildonly-randconfig-002-20240410 clang x86_64 buildonly-randconfig-003-20240410 clang x86_64 buildonly-randconfig-004-20240410 gcc x86_64 buildonly-randconfig-005-20240410 clang x86_64 buildonly-randconfig-006-20240410 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240410 clang x86_64 randconfig-002-20240410 gcc x86_64 randconfig-005-20240410 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
by chenxiang 10 Apr '24

10 Apr '24

From: Xiang Chen <chenxiang66(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9EWDF CVE: NA -------------------------------------------------------------------------- When enabled GICv4.1 in hip09, there are some invalid vPE configurations in configuration table for some situations, which will cause some vSGI interrupts lost. To fix the issue, need to send vinvall command after vmovp. Signed-off-by: Nianyao Tang <tangnianyao(a)huawei.com> Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: CaiJian <caijian11(a)h-partners.com> --- Documentation/arch/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 10 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + drivers/irqchip/irq-gic-v3-its.c | 36 ++++++++++++++++----- 4 files changed, 41 insertions(+), 8 deletions(-) diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst index dc32dd03c85f..11645181d7f2 100644 --- a/Documentation/arch/arm64/silicon-errata.rst +++ b/Documentation/arch/arm64/silicon-errata.rst @@ -209,6 +209,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | LINXICORE9100 | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ +| Hisilicon | Hip09 | #162100801 | HISILICON_ERRATUM_162100801 | ++----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | SMMUv3 | #162100602 | HISILICON_ERRATUM_162100602 | +----------------+-----------------+-----------------+-----------------------------+ | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 8def51744a10..890461d3f5e5 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1203,6 +1203,16 @@ config HISILICON_ERRATUM_1980005 If unsure, say N. +config HISILICON_ERRATUM_162100801 + bool "Hip09 162100801 erratum support" + default y + help + When enabled GICv4.1 in hip09, there are some invalid vPE config + in configuration tables for some situation, which will cause vSGI + interrupts lost. So fix it by sending vinvall commands after vmovp. + + If unsure, say Y. + config HISILICON_ERRATUM_162100602 bool "Hisilicon erratum 162100602" depends on ARM_SMMU_V3 && ARCH_HISI diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index afd13d9e3840..3392957edb6d 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -432,6 +432,7 @@ CONFIG_HISILICON_ERRATUM_161600802=y CONFIG_HISILICON_ERRATUM_162100125=y CONFIG_HISILICON_ERRATUM_162102203=y # CONFIG_HISILICON_ERRATUM_1980005 is not set +CONFIG_HISILICON_ERRATUM_162100801=y CONFIG_HISILICON_ERRATUM_162100602=y CONFIG_QCOM_FALKOR_ERRATUM_1003=y CONFIG_QCOM_FALKOR_ERRATUM_1009=y diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index c66676a21ad0..5bd82a4e8777 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -145,6 +145,7 @@ static int probe_devid_pool_one(void) #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) #define ITS_FLAGS_FORCE_NON_SHAREABLE (1ULL << 3) +#define ITS_FLAGS_WORKAROUND_HISILICON_162100801 (1ULL << 4) #define RD_LOCAL_LPI_ENABLED BIT(0) #define RD_LOCAL_PENDTABLE_PREALLOCATED BIT(1) @@ -1526,6 +1527,14 @@ static void its_send_vmapp(struct its_node *its, its_send_single_vcommand(its, its_build_vmapp_cmd, &desc); } +static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) +{ + struct its_cmd_desc desc; + + desc.its_vinvall_cmd.vpe = vpe; + its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); +} + static void its_send_vmovp(struct its_vpe *vpe) { struct its_cmd_desc desc = {}; @@ -1565,19 +1574,14 @@ static void its_send_vmovp(struct its_vpe *vpe) desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); } raw_spin_unlock_irqrestore(&vmovp_lock, flags); } -static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) -{ - struct its_cmd_desc desc; - - desc.its_vinvall_cmd.vpe = vpe; - its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); -} - static void its_send_vinv(struct its_device *dev, u32 event_id) { struct its_cmd_desc desc; @@ -5089,6 +5093,14 @@ static bool its_set_non_coherent(void *data) return true; } +static bool __maybe_unused its_enable_quirk_hip09_162100801(void *data) +{ + struct its_node *its = data; + + its->flags |= ITS_FLAGS_WORKAROUND_HISILICON_162100801; + return true; +} + static const struct gic_quirk its_quirks[] = { #ifdef CONFIG_CAVIUM_ERRATUM_22375 { @@ -5135,6 +5147,14 @@ static const struct gic_quirk its_quirks[] = { .init = its_enable_quirk_hip07_161600802, }, #endif +#ifdef CONFIG_HISILICON_ERRATUM_162100801 + { + .desc = "ITS: Hip09 erratum 162100801", + .iidr = 0x00051736, + .mask = 0xffffffff, + .init = its_enable_quirk_hip09_162100801, + }, +#endif #ifdef CONFIG_ROCKCHIP_ERRATUM_3588001 { .desc = "ITS: Rockchip erratum RK3588001", -- 2.30.0

2 1

[PATCH OLK-5.10] RDMA/srpt: Support specifying the srpt_service_guid parameter
by Ziyang Xuan 10 Apr '24

10 Apr '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.211 commit 5a5c039dac1b1b7ba3e91c791f4421052bf79b82 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E3EE CVE: CVE-2024-26744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fdfa083549de5d50ebf7f6811f33757781e838c0 ] Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module triggers the following kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000000 Call Trace: <TASK> parse_one+0x18c/0x1d0 parse_args+0xe1/0x230 load_module+0x8de/0xa60 init_module_from_file+0x8b/0xd0 idempotent_init_module+0x181/0x240 __x64_sys_finit_module+0x5a/0xb0 do_syscall_64+0x5f/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Cc: LiHonggang <honggangli(a)163.com> Reported-by: LiHonggang <honggangli(a)163.com> Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20240205004207.17031-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index 983f59c87b79..80e99e9e9717 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -79,12 +79,16 @@ module_param(srpt_srq_size, int, 0444); MODULE_PARM_DESC(srpt_srq_size, "Shared receive queue (SRQ) size."); +static int srpt_set_u64_x(const char *buffer, const struct kernel_param *kp) +{ + return kstrtou64(buffer, 16, (u64 *)kp->arg); +} static int srpt_get_u64_x(char *buffer, const struct kernel_param *kp) { return sprintf(buffer, "0x%016llx\n", *(u64 *)kp->arg); } -module_param_call(srpt_service_guid, NULL, srpt_get_u64_x, &srpt_service_guid, - 0444); +module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x, + &srpt_service_guid, 0444); MODULE_PARM_DESC(srpt_service_guid, "Using this value for ioc_guid, id_ext, and cm_listen_id instead of using the node_guid of the first HCA."); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/srpt: Support specifying the srpt_service_guid parameter
by Ziyang Xuan 10 Apr '24

10 Apr '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v4.19.308 commit 84f1dac960cfa210a3b7a7522e6c2320ae91932b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E3EE CVE: CVE-2024-26744 -------------------------------- [ Upstream commit fdfa083549de5d50ebf7f6811f33757781e838c0 ] Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module triggers the following kernel crash: BUG: kernel NULL pointer dereference, address: 0000000000000000 Call Trace: <TASK> parse_one+0x18c/0x1d0 parse_args+0xe1/0x230 load_module+0x8de/0xa60 init_module_from_file+0x8b/0xd0 idempotent_init_module+0x181/0x240 __x64_sys_finit_module+0x5a/0xb0 do_syscall_64+0x5f/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Cc: LiHonggang <honggangli(a)163.com> Reported-by: LiHonggang <honggangli(a)163.com> Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20240205004207.17031-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index ea4afdeb06a4..7550c9777ed1 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -82,12 +82,16 @@ module_param(srpt_srq_size, int, 0444); MODULE_PARM_DESC(srpt_srq_size, "Shared receive queue (SRQ) size."); +static int srpt_set_u64_x(const char *buffer, const struct kernel_param *kp) +{ + return kstrtou64(buffer, 16, (u64 *)kp->arg); +} static int srpt_get_u64_x(char *buffer, const struct kernel_param *kp) { return sprintf(buffer, "0x%016llx", *(u64 *)kp->arg); } -module_param_call(srpt_service_guid, NULL, srpt_get_u64_x, &srpt_service_guid, - 0444); +module_param_call(srpt_service_guid, srpt_set_u64_x, srpt_get_u64_x, + &srpt_service_guid, 0444); MODULE_PARM_DESC(srpt_service_guid, "Using this value for ioc_guid, id_ext, and cm_listen_id" " instead of using the node_guid of the first HCA."); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6 00/14] Some fixes and cleanups for SAS
by Yihang Li 10 Apr '24

10 Apr '24

From: Bing Xia <xiabing12(a)h-partners.com> This series contains some fixes and cleanups including: - Add slave_destroy interface for v3 hw; - Remove hisi_hba->timer for v3 hw; - Handle the NCQ error returned by D2H frame; - Fix disk not being scanned in after being removed; - Add a helper sas_get_sas_addr_and_dev_type(); - Directly call register snapshot instead of using workqueue; - Allocate DFX memory during dump trigger; - Fix a deadlock issue related to automatic debugfs; - Check whether debugfs is enabled before removing or releasing it; - Check usage count only when the runtime PM status is RPM_SUSPENDING - Remove redundant checks for automatic debugfs dump; - Allocation SMP request is aligned to ARCH_DMA_MINALIGN; - Modify the deadline for ata_wait_after_reset(); - Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure" Qi Liu (1): scsi: hisi_sas: Add slave_destroy interface for v3 hw Xiang Chen (1): scsi: hisi_sas: Remove hisi_hba->timer for v3 hw Xingui Yang (3): scsi: hisi_sas: Handle the NCQ error returned by D2H frame scsi: libsas: Fix disk not being scanned in after being removed scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() Yihang Li (8): scsi: hisi_sas: Directly call register snapshot instead of using workqueue scsi: hisi_sas: Allocate DFX memory during dump trigger scsi: hisi_sas: Fix a deadlock issue related to automatic dump scsi: hisi_sas: Check whether debugfs is enabled before removing or releasing it scsi: hisi_sas: Check usage count only when the runtime PM status is RPM_SUSPENDING scsi: hisi_sas: Remove redundant checks for automatic debugfs dump scsi: libsas: Allocation SMP request is aligned to ARCH_DMA_MINALIGN scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() xiabing (1): Revert "scsi: hisi_sas: Disable SATA disk phy for severe I_T nexus reset failure" drivers/scsi/hisi_sas/hisi_sas.h | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 60 +++++------ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 138 +++++++++++++------------ drivers/scsi/libsas/sas_expander.c | 53 ++++++---- 4 files changed, 140 insertions(+), 114 deletions(-) -- 2.30.0

2 15

[PATCH OLK-5.10] ext4: fix double-free of blocks due to wrong extents moved_len
by Long Li 10 Apr '24

10 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> stable inclusion from stable-v5.10.167 commit d033a555d9a1cf53dbf3301af7199cc4a4c8f537 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2F9 CVE: CVE-2024-26704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 55583e899a5357308274601364741a83e78d6ac4 upstream. In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and donor_inode preallocations when moved_len is not zero. When the loop fails to exit after successfully moving some extents, moved_len is not updated and remains at 0, so it does not discard the preallocations. If the moved extents overlap with the preallocated extents, the overlapped extents are freed twice in ext4_mb_release_inode_pa() and ext4_process_freed_data() (as described in commit 94d7c16cbbbd ("ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT")), and bb_free is incremented twice. Hence when trim is executed, a zero-division bug is triggered in mb_update_avg_fragment_size() because bb_free is not zero and bb_fragments is zero. Therefore, update move_len after each extent move to avoid the issue. Reported-by: Wei Chen <harperchen1110(a)gmail.com> Reported-by: xingwei lee <xrivendell7(a)gmail.com> Closes: https://lore.kernel.org/r/CAO4mrferzqBUnCag8R3m2zf897ts9UEuhjFQGPtODT92rYyR… Fixes: fcf6b1b729bc ("ext4: refactor ext4_move_extents code base") CC: <stable(a)vger.kernel.org> # 3.18 Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ext4/move_extent.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index 64a579734f93..f8dd5d972c33 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -615,6 +615,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, goto out; o_end = o_start + len; + *moved_len = 0; while (o_start < o_end) { struct ext4_extent *ex; ext4_lblk_t cur_blk, next_blk; @@ -670,7 +671,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, */ ext4_double_up_write_data_sem(orig_inode, donor_inode); /* Swap original branches with new branches */ - move_extent_per_page(o_filp, donor_inode, + *moved_len += move_extent_per_page(o_filp, donor_inode, orig_page_index, donor_page_index, offset_in_page, cur_len, unwritten, &ret); @@ -680,9 +681,6 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, o_start += cur_len; d_start += cur_len; } - *moved_len = o_start - orig_blk; - if (*moved_len > len) - *moved_len = len; out: if (*moved_len) { -- 2.31.1

2 1

[PATCH OLK-5.10 0/1] CVE-2021-46926
by Liu Mingrui 10 Apr '24

10 Apr '24

CVE-2021-46926 Libin Yang (1): ALSA: hda: intel-sdw-acpi: harden detection of controller drivers/soundwire/intel_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) -- 2.25.1

2 2

[PATCH 0LK-5.10] EDAC/thunderx: Fix possible out-of-bounds string access
by Guo Mengqi 10 Apr '24

10 Apr '24

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v5.10.209 commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ] Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat(): drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); ... Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer. Change it to strlcat(). [ bp: Trim compiler output, fixup commit message. ] Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c index 0eb5eb97fd74..3b0e1fe27d93 100644 --- a/drivers/edac/thunderx_edac.c +++ b/drivers/edac/thunderx_edac.c @@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_errors, ctx->reg_com_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); for (lane = 0; lane < OCX_RX_LANES; lane++) if (ctx->reg_com_int & BIT(lane)) { @@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); decode_register(other, OCX_OTHER_SIZE, ocx_lane_errors, ctx->reg_lane_int[lane]); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); } if (ctx->reg_com_int & OCX_COM_INT_CE) @@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id) decode_register(other, OCX_OTHER_SIZE, ocx_com_link_errors, ctx->reg_com_link_int); - strncat(msg, other, OCX_MESSAGE_SIZE); + strlcat(msg, other, OCX_MESSAGE_SIZE); if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE) edac_device_handle_ue(ocx->edac_dev, 0, 0, msg); @@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id) decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int); - strncat(msg, other, L2C_MESSAGE_SIZE); + strlcat(msg, other, L2C_MESSAGE_SIZE); if (ctx->reg_int & mask_ue) edac_device_handle_ue(l2c->edac_dev, 0, 0, msg); -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS] ext4: fix double-free of blocks due to wrong extents moved_len
by Long Li 10 Apr '24

10 Apr '24

From: Baokun Li <libaokun1(a)huawei.com> stable inclusion from stable-v4.19.273 commit b4fbb89d722cbb16beaaea234b7230faaaf68c71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2F9 CVE: CVE-2024-26704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 55583e899a5357308274601364741a83e78d6ac4 upstream. In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and donor_inode preallocations when moved_len is not zero. When the loop fails to exit after successfully moving some extents, moved_len is not updated and remains at 0, so it does not discard the preallocations. If the moved extents overlap with the preallocated extents, the overlapped extents are freed twice in ext4_mb_release_inode_pa() and ext4_process_freed_data() (as described in commit 94d7c16cbbbd ("ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT")), and bb_free is incremented twice. Hence when trim is executed, a zero-division bug is triggered in mb_update_avg_fragment_size() because bb_free is not zero and bb_fragments is zero. Therefore, update move_len after each extent move to avoid the issue. Reported-by: Wei Chen <harperchen1110(a)gmail.com> Reported-by: xingwei lee <xrivendell7(a)gmail.com> Closes: https://lore.kernel.org/r/CAO4mrferzqBUnCag8R3m2zf897ts9UEuhjFQGPtODT92rYyR… Fixes: fcf6b1b729bc ("ext4: refactor ext4_move_extents code base") CC: <stable(a)vger.kernel.org> # 3.18 Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20240104142040.2835097-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ext4/move_extent.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index 97512df281e3..4616d41216f3 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -618,6 +618,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, goto out; o_end = o_start + len; + *moved_len = 0; while (o_start < o_end) { struct ext4_extent *ex; ext4_lblk_t cur_blk, next_blk; @@ -673,7 +674,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, */ ext4_double_up_write_data_sem(orig_inode, donor_inode); /* Swap original branches with new branches */ - move_extent_per_page(o_filp, donor_inode, + *moved_len += move_extent_per_page(o_filp, donor_inode, orig_page_index, donor_page_index, offset_in_page, cur_len, unwritten, &ret); @@ -683,9 +684,6 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, o_start += cur_len; d_start += cur_len; } - *moved_len = o_start - orig_blk; - if (*moved_len > len) - *moved_len = len; out: if (*moved_len) { -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2024-26669
by Zhengchao Shao 10 Apr '24

10 Apr '24

fix CVE-2024-26669. Ido Schimmel (1): net/sched: flower: Fix chain template offload Zhengchao Shao (1): net/sched: flower: Fix kabi change net/sched/cls_api.c | 20 ++++++++++++++++++++ net/sched/cls_flower.c | 23 +++++++++++++++++++++++ 2 files changed, 43 insertions(+) -- 2.34.1

2 3

[openeuler:OLK-6.6 3341/7334] include/linux/pgplib.h:36:30: error: field 'version' has incomplete type
by kernel test robot 10 Apr '24

10 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 830c644d6e307456c2e77e6ce8bd6f1cf1ddc351 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [3341/7334] KEYS: Provide a function to load keys from a PGP keyring blob config: loongarch-randconfig-r123-20240410 (https://download.01.org/0day-ci/archive/20240410/202404100812.aMXYkpUQ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240410/202404100812.aMXYkpUQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404100812.aMXYkpUQ-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from crypto/asymmetric_keys/pgp_preload.c:19: >> include/linux/pgplib.h:26:36: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 26 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> include/linux/pgplib.h:36:30: warning: 'version' is narrower than values of its type 36 | enum pgp_key_version version : 8; | ^~~~~~~ >> include/linux/pgplib.h:36:30: error: field 'version' has incomplete type >> include/linux/pgplib.h:37:30: warning: 'pubkey_algo' is narrower than values of its type 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^~~~~~~~~~~ >> include/linux/pgplib.h:37:30: error: field 'pubkey_algo' has incomplete type >> crypto/asymmetric_keys/pgp_preload.c:63:38: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 63 | enum pgp_packet_tag type, u8 headerlen, | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:63:53: error: parameter 2 ('type') has incomplete type 63 | enum pgp_packet_tag type, u8 headerlen, | ~~~~~~~~~~~~~~~~~~~~^~~~ >> crypto/asymmetric_keys/pgp_preload.c:62:19: error: function declaration isn't a prototype [-Werror=strict-prototypes] 62 | static int __init found_pgp_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c: In function 'preload_pgp_keys': >> crypto/asymmetric_keys/pgp_preload.c:107:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:107:43: note: each undeclared identifier is reported only once for each function it appears in >> crypto/asymmetric_keys/pgp_preload.c:108:32: error: assignment to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' {aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, long unsigned int)'} from incompatible pointer type 'int (*)()' [-Werror=incompatible-pointer-types] 108 | ctx.pgp.process_packet = found_pgp_key; | ^ cc1: some warnings being treated as errors -- In file included from crypto/asymmetric_keys/pgp_public_key.c:20: >> include/linux/pgplib.h:26:36: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 26 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> include/linux/pgplib.h:36:30: warning: 'version' is narrower than values of its type 36 | enum pgp_key_version version : 8; | ^~~~~~~ >> include/linux/pgplib.h:36:30: error: field 'version' has incomplete type >> include/linux/pgplib.h:37:30: warning: 'pubkey_algo' is narrower than values of its type 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^~~~~~~~~~~ >> include/linux/pgplib.h:37:30: error: field 'pubkey_algo' has incomplete type crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_calc_pkey_keyid': >> crypto/asymmetric_keys/pgp_public_key.c:63:9: error: implicit declaration of function 'kenter' [-Werror=implicit-function-declaration] 63 | kenter(""); | ^~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:65:29: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:65:29: note: each undeclared identifier is reported only once for each function it appears in >> crypto/asymmetric_keys/pgp_public_key.c:67:23: error: implicit declaration of function 'mpi_key_length' [-Werror=implicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:115:9: error: implicit declaration of function 'kleave' [-Werror=implicit-function-declaration] 115 | kleave(" = %d", ret); | ^~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_generate_fingerprint': crypto/asymmetric_keys/pgp_public_key.c:134:49: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: At top level: >> crypto/asymmetric_keys/pgp_public_key.c:199:40: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 199 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:199:55: error: parameter 2 ('type') has incomplete type 199 | enum pgp_packet_tag type, | ~~~~~~~~~~~~~~~~~~~~^~~~ >> crypto/asymmetric_keys/pgp_public_key.c:198:12: error: function declaration isn't a prototype [-Werror=strict-prototypes] 198 | static int pgp_process_public_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_process_public_key': >> crypto/asymmetric_keys/pgp_public_key.c:213:21: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 213 | if (type == PGP_PKT_USER_ID) { | ^~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:234:32: error: 'PGP_PUBKEY__LAST' undeclared (first use in this function) 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^~~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:236:16: error: 'pgp_to_public_key_algo' undeclared (first use in this function); did you mean 'pgp_pubkey_algo'? 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^~~~~~~~~~~~~~~~~~~~~~ | pgp_pubkey_algo crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_key_parse': >> crypto/asymmetric_keys/pgp_public_key.c:313:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:314:43: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 314 | (1 << PGP_PKT_USER_ID); | ^~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:315:32: error: assignment to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' {aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, long unsigned int)'} from incompatible pointer type 'int (*)()' [-Werror=incompatible-pointer-types] 315 | ctx.pgp.process_packet = pgp_process_public_key; | ^ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/version +36 include/linux/pgplib.h b78af6579e15dcd David Howells 2023-09-12 19 b78af6579e15dcd David Howells 2023-09-12 20 /* b78af6579e15dcd David Howells 2023-09-12 21 * PGP library packet parser b78af6579e15dcd David Howells 2023-09-12 22 */ b78af6579e15dcd David Howells 2023-09-12 23 struct pgp_parse_context { b78af6579e15dcd David Howells 2023-09-12 24 u64 types_of_interest; b78af6579e15dcd David Howells 2023-09-12 25 int (*process_packet)(struct pgp_parse_context *context, b78af6579e15dcd David Howells 2023-09-12 @26 enum pgp_packet_tag type, b78af6579e15dcd David Howells 2023-09-12 27 u8 headerlen, b78af6579e15dcd David Howells 2023-09-12 28 const u8 *data, b78af6579e15dcd David Howells 2023-09-12 29 size_t datalen); b78af6579e15dcd David Howells 2023-09-12 30 }; b78af6579e15dcd David Howells 2023-09-12 31 b78af6579e15dcd David Howells 2023-09-12 32 extern int pgp_parse_packets(const u8 *data, size_t datalen, b78af6579e15dcd David Howells 2023-09-12 33 struct pgp_parse_context *ctx); b78af6579e15dcd David Howells 2023-09-12 34 b78af6579e15dcd David Howells 2023-09-12 35 struct pgp_parse_pubkey { b78af6579e15dcd David Howells 2023-09-12 @36 enum pgp_key_version version : 8; b78af6579e15dcd David Howells 2023-09-12 @37 enum pgp_pubkey_algo pubkey_algo : 8; b78af6579e15dcd David Howells 2023-09-12 38 __kernel_old_time_t creation_time; b78af6579e15dcd David Howells 2023-09-12 39 __kernel_old_time_t expires_at; b78af6579e15dcd David Howells 2023-09-12 40 }; b78af6579e15dcd David Howells 2023-09-12 41 :::::: The code at line 36 was first introduced by commit :::::: b78af6579e15dcdff86504da90af77f3e890270e PGPLIB: Basic packet parser :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1624/7334] drivers/cpufreq/loongson3-acpi-cpufreq.c:93:1: sparse: sparse: symbol '__pcpu_scope_msa_count' was not declared. Should it be static?
by kernel test robot 10 Apr '24

10 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 830c644d6e307456c2e77e6ce8bd6f1cf1ddc351 commit: 47a0b6f372d7f05822d021f86b21a34fd2142225 [1624/7334] cpufreq: Add cpufreq driver for LoongArch config: loongarch-randconfig-r123-20240410 (https://download.01.org/0day-ci/archive/20240410/202404100627.ugFjSuPi-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240410/202404100627.ugFjSuPi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404100627.ugFjSuPi-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/cpufreq/loongson3-acpi-cpufreq.c:93:1: sparse: sparse: symbol '__pcpu_scope_msa_count' was not declared. Should it be static? drivers/cpufreq/loongson3-acpi-cpufreq.c:169:3: sparse: sparse: symbol 'all_package_data' was not declared. Should it be static? drivers/cpufreq/loongson3-acpi-cpufreq.c:645:5: sparse: sparse: symbol 'loongson3_set_mode' was not declared. Should it be static? drivers/cpufreq/loongson3-acpi-cpufreq.c:835:14: sparse: sparse: symbol 'load_update' was not declared. Should it be static? drivers/cpufreq/loongson3-acpi-cpufreq.c: note: in included file (through arch/loongarch/include/asm/loongarch.h, arch/loongarch/include/asm/cpu-info.h, ...): ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:322:3: sparse: sparse: undefined identifier '__builtin_loongarch_iocsrwr_w' ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:25: sparse: sparse: undefined identifier '__builtin_loongarch_iocsrrd_w' ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:107:25: sparse: sparse: undefined identifier '__builtin_loongarch_cpucfg' ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:107:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:107:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:107:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:284:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:107:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:107:11: sparse: sparse: cast from unknown type ../lib/gcc/loongarch64-linux/13.2.0/include/larchintrin.h:107:11: sparse: sparse: cast from unknown type vim +/__pcpu_scope_msa_count +93 drivers/cpufreq/loongson3-acpi-cpufreq.c 92 > 93 DEFINE_PER_CPU(unsigned long, msa_count); 94 EXPORT_PER_CPU_SYMBOL(msa_count); 95 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26896/30000] kernel/sched/psi.c:198:22: sparse: sparse: symbol 'psi_stat_system' was not declared. Should it be static?
by kernel test robot 10 Apr '24

10 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9f126942e6d283d9a0ca99f3e46dbebe8aec3afd commit: 0ccf285cd2e038da074744e99cb916c5bcf3d55b [26896/30000] PSI: Introduce pressure.stat in psi config: x86_64-randconfig-r132-20240409 (https://download.01.org/0day-ci/archive/20240410/202404100544.ypHpNB9p-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240410/202404100544.ypHpNB9p-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404100544.ypHpNB9p-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/sched/psi.c:198:22: sparse: sparse: symbol 'psi_stat_system' was not declared. Should it be static? >> kernel/sched/psi.c:202:22: sparse: sparse: symbol 'to_psi_group_ext' was not declared. Should it be static? kernel/sched/psi.c:401:22: sparse: sparse: dereference of noderef expression kernel/sched/psi.c:402:38: sparse: sparse: dereference of noderef expression kernel/sched/psi.c:952:13: sparse: sparse: dereference of noderef expression vim +/psi_stat_system +198 kernel/sched/psi.c eb414681d5a07d2 Johannes Weiner 2018-10-26 194 65479800e82741c Lu Jialin 2023-11-29 195 #ifdef CONFIG_PSI_FINE_GRAINED 65479800e82741c Lu Jialin 2023-11-29 196 /* System-level fine grained pressure and stall tracking */ cc71a821d3f13cb Lu Jialin 2023-11-29 197 static DEFINE_PER_CPU(struct psi_group_stat_cpu, system_stat_group_pcpu); cc71a821d3f13cb Lu Jialin 2023-11-29 @198 struct psi_group_ext psi_stat_system = { cc71a821d3f13cb Lu Jialin 2023-11-29 199 .pcpu = &system_stat_group_pcpu, cc71a821d3f13cb Lu Jialin 2023-11-29 200 }; 65479800e82741c Lu Jialin 2023-11-29 201 65479800e82741c Lu Jialin 2023-11-29 @202 struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) 65479800e82741c Lu Jialin 2023-11-29 203 { 65479800e82741c Lu Jialin 2023-11-29 204 if (psi == &psi_system) 65479800e82741c Lu Jialin 2023-11-29 205 return &psi_stat_system; 65479800e82741c Lu Jialin 2023-11-29 206 else 65479800e82741c Lu Jialin 2023-11-29 207 return container_of(psi, struct psi_group_ext, psi); 65479800e82741c Lu Jialin 2023-11-29 208 } 65479800e82741c Lu Jialin 2023-11-29 209 #else 65479800e82741c Lu Jialin 2023-11-29 210 static inline struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) 65479800e82741c Lu Jialin 2023-11-29 211 { 65479800e82741c Lu Jialin 2023-11-29 212 return NULL; 65479800e82741c Lu Jialin 2023-11-29 213 } 65479800e82741c Lu Jialin 2023-11-29 214 #endif 65479800e82741c Lu Jialin 2023-11-29 215 :::::: The code at line 198 was first introduced by commit :::::: cc71a821d3f13cbd9ad3d3eec9fa394f3b2ae96b PSI: Introduce fine grained stall time collect for cgroup reclaim :::::: TO: Lu Jialin <lujialin4(a)huawei.com> :::::: CC: Lu Jialin <lujialin4(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 830c644d6e307456c2e77e6ce8bd6f1cf1ddc351
by kernel test robot 10 Apr '24

10 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 830c644d6e307456c2e77e6ce8bd6f1cf1ddc351 !5800 firmware: arm_sdei: Move sdei_cpuhp_up/down() before lockup_detector_online_cpu() Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202404092155.wk6wC2Wu-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/mucse/rnp/rnp_main.c:5739: warning: Function parameter or member 'netdev' not described in 'rnp_netpoll' drivers/net/ethernet/mucse/rnp/rnp_main.c:5739: warning: expecting prototype for Polling 'interrupt'(). Prototype was for rnp_netpoll() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:65: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst Error/Warning ids grouped by kconfigs: gcc_recent_errors `-- loongarch-allmodconfig |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_get_ringparam |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:no-previous-prototype-for-rnpgbevf_set_ringparam |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_ethtool.c:warning:rnp_gstrings_test-defined-but-not-used |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_alloc_rx_buffers |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_rx_ring |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_configure_tx_ring |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_disable_rx_queue |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_enable_rx_queue |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_maybe_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_unmap_and_free_tx_resource |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_write_eitr_rx |-- drivers-net-ethernet-mucse-rnpgbevf-rnpgbevf_main.c:warning:no-previous-prototype-for-rnpgbevf_xmit_frame_ring |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_addr_list_itr |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_get_queues |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_negotiate_api_version |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_veb_mac_n500 |-- drivers-net-ethernet-mucse-rnpgbevf-vf.c:warning:no-previous-prototype-for-rnpgbevf_set_vlan_n500 |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-rnpm_get_phy_statistics |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_layer2_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:warning:no-previous-prototype-for-rnpm_setup_tuple5_remapping_tcam |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-clean_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-control_mac_rx |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_can_rpu_start |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_check_mc_addr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_clear_udp_tunnel_port |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_fix_queue_number |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_event_schedule |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_task |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_pf_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_rx_ring_reinit |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_service_timer |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_vlan_stags_flag |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_write_eitr |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-rnpm_xmit_nop_frame_ring_temp |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-update_pf_vlan |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:no-previous-prototype-for-wait_all_port_resetting |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:build_writereg_req-accessing-bytes-in-a-region-of-size |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-mbx_cookie_zalloc |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_get_capablity |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_reg_read |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_fw_send_cmd_wait |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_get_port_stats2 |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_link_stat_mark_disable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_fw_post_req |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_pluginout_evt_en |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:no-previous-prototype-for-rnpm_mbx_write_posted_locked |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:no-previous-prototype-for-rnpm_reset_pipeline_n10 |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:no-previous-prototype-for-rnpm_ptp_setup_ptp |-- drivers-net-ethernet-mucse-rnpm-rnpm_ptp.c:warning:suggest-braces-around-empty-body-in-an-if-statement |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_get_vf_ringnum |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-rnpm_setup_ring_maxrate |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used |-- drivers-net-ethernet-mucse-rnpm-rnpm_sysfs.c:warning:no-previous-prototype-for-rnpm_mbx_get_pn_sn |-- drivers-net-ethernet-mucse-rnpm-rnpm_tc_u32_parse.h:warning:rnpm_ipv4_parser-defined-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-rnpvf_get_ringparam |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:rnp_gstrings_test-defined-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_alloc_rx_buffers |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_rx_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_configure_tx_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_disable_rx_queue |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_enable_rx_queue |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_maybe_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_unmap_and_free_tx_resource |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_write_eitr_rx |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-rnpvf_xmit_frame_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-update_rx_count |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_addr_list_itr |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_get_queues |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_negotiate_api_version |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_veb_mac_n10 |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-rnpvf_set_vlan_n10 `-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used clang_recent_errors |-- arm64-allmodconfig | |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_cfg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dbg.c:warning:arithmetic-between-different-enumeration-types-(-enum-hinic_node_id-and-enum-hinic_fault_err_level-) | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: | |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate | |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-function-rnpvf_get_ringparam | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:unused-variable-rnp_gstrings_test | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-is-uninitialized-when-used-here | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf | |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_alloc_rx_buffers | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_rx_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_tx_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_disable_rx_queue | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_enable_rx_queue | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_maybe_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_xmit_frame_ring | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-update_rx_count | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_good-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_addr_list_itr | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_get_queues | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_negotiate_api_version | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_veb_mac_n10 | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_vlan_n10 | |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used | |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead | `-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead `-- x86_64-allyesconfig |-- drivers-net-ethernet-huawei-hinic-hinic_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_register_sw_cb().-Prototype-was-for-hinic_aeq_register_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_aeq_unregister_sw_cb().-Prototype-was-for-hinic_aeq_unregister_swe_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_eqs.c:warning:expecting-prototype-for-hinic_ceq_register_sw_cb().-Prototype-was-for-hinic_ceq_register_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mbox.c:warning:expecting-prototype-for-hinic_unregister_ppf_mbox_cb().-Prototype-was-for-hinic_unregister_ppf_to_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic-hinic_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-alloc_cmd_buf().-Prototype-was-for-alloc_resp_buf()-instead |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_api_cmd.c:warning:expecting-prototype-for-prepare_cell().-Prototype-was-for-wait_for_resp_polling()-instead |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_devlink.c:warning:variable-pdev-set-but-not-used |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mbox.c:warning:expecting-prototype-for-hinic3_unregister_ppf_mbox_cb().-Prototype-was-for-hinic3_unregister_ppf_to_pf_mbox_cb()-instead |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_free().-Prototype-was-for-hinic3_pf_to_mgmt_free()-instead |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_mgmt.c:warning:expecting-prototype-for-hinic_pf_to_mgmt_init().-Prototype-was-for-hinic3_pf_to_mgmt_init()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-netdev-not-described-in-rnp_netpoll |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-Polling-interrupt-().-Prototype-was-for-rnp_netpoll()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_enable_rx_buff().-Prototype-was-for-rnpm_enable_rx_buff_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_common.c:warning:expecting-prototype-for-rnpm_update_mc_addr_list_generic().-Prototype-was-for-rnpm_update_mutiport_mc_addr_list_generic()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_debugfs.c:warning:expecting-prototype-for-rnpm_dbg_reg_ops_write().-Prototype-was-for-rnpm_dbg_phy_ops_write()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_ethtool.c:warning:no-previous-prototype-for-function-rnpm_get_phy_statistics |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-ixgbe_write_eitr().-Prototype-was-for-rnpm_write_eitr()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_notify().-Prototype-was-for-rnpm_irq_affinity_notify()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_irq_affinity_release().-Prototype-was-for-rnpm_irq_affinity_release()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnp_is_non_eop().-Prototype-was-for-rnpm_is_non_eop()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:warning:expecting-prototype-for-rnpm_set_ivar().-Prototype-was-for-rnpm_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.c:warning:Cannot-understand-speed: |-- drivers-net-ethernet-mucse-rnpm-rnpm_n10.c:warning:expecting-prototype-for-rnpm_atr_add_signature_filter_n10().-Prototype-was-for-rnpm_fdir_add_signature_filter_n10()-instead |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_get_vf_ringnum |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:no-previous-prototype-for-function-rnpm_setup_ring_maxrate |-- drivers-net-ethernet-mucse-rnpm-rnpm_sriov.c:warning:variable-y-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:no-previous-prototype-for-function-rnpvf_get_ringparam |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:unused-variable-rnp_gstrings_test |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-is-uninitialized-when-used-here |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-advertising-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-ethtool.c:warning:variable-queue_idx-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_ack_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_msg_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_check_for_rst_msg_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_obtain_mbx_lock_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_ack |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_poll_for_msg |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_mbx_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_read_posted_mbx |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_mbx_vf |-- drivers-net-ethernet-mucse-rnpvf-mbx.c:warning:Function-parameter-or-member-to_cm3-not-described-in-rnpvf_write_posted_mbx |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-data-description-in-rnpvf_watchdog |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-rx_ring-description-in-rnpvf_pull_tail |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Excess-function-parameter-skb-description-in-rnpvf_is_non_eop |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_msix_vector-not-described-in-rnpvf_set_ring_vector |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-rnpvf_queue-not-described-in-rnpvf_set_ring_vector |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-t-not-described-in-rnpvf_watchdog |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:Function-parameter-or-member-type-not-described-in-rnpvf_update_itr |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_irq().-Prototype-was-for-rnpvf_clean_rx_irq()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnp_clean_rx_ring().-Prototype-was-for-rnpvf_clean_rx_ring()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_set_ivar().-Prototype-was-for-rnpvf_set_ring_vector()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:expecting-prototype-for-rnpvf_write_eitr().-Prototype-was-for-rnpvf_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_alloc_rx_buffers |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_assign_netdev_ops |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_rx_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_configure_tx_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_disable_rx_queue |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_enable_rx_queue |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_maybe_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_tx_ctxtdesc |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_unmap_and_free_tx_resource |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_write_eitr_rx |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-rnpvf_xmit_frame_ring |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:no-previous-prototype-for-function-update_rx_count |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-err-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-hw-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_err-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-ring_csum_good-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-vector_threshold-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-rnpvf_main.c:warning:variable-xdp_xmit-set-but-not-used |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:Excess-function-parameter-mac_addr-description-in-rnpvf_get_queues_vf |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_addr_list_itr |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_get_queues |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_negotiate_api_version |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_veb_mac_n10 |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:no-previous-prototype-for-function-rnpvf_set_vlan_n10 |-- drivers-net-ethernet-mucse-rnpvf-vf.c:warning:variable-number_of_queues-set-but-not-used |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_cq().-Prototype-was-for-hiraid_create_complete_queue()-instead |-- drivers-scsi-hisi_raid-hiraid_main.c:warning:expecting-prototype-for-hiraid_create_sq().-Prototype-was-for-hiraid_create_send_queue()-instead |-- ld.lld:error:duplicate-symbol:__cfi_register_mbx_irq |-- ld.lld:error:duplicate-symbol:__cfi_remove_mbx_irq |-- ld.lld:error:duplicate-symbol:__cfi_set_slave_host_enable |-- ld.lld:error:duplicate-symbol:register_mbx_irq |-- ld.lld:error:duplicate-symbol:remove_mbx_irq `-- ld.lld:error:duplicate-symbol:rnp10_netdev_ops elapsed time: 726m configs tested: 29 configs skipped: 143 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240409 gcc arm64 randconfig-002-20240409 gcc arm64 randconfig-003-20240409 clang arm64 randconfig-004-20240409 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240409 gcc loongarch randconfig-002-20240409 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240409 clang x86_64 buildonly-randconfig-002-20240409 clang x86_64 buildonly-randconfig-003-20240409 gcc x86_64 buildonly-randconfig-004-20240409 gcc x86_64 buildonly-randconfig-005-20240409 clang x86_64 buildonly-randconfig-006-20240409 clang x86_64 defconfig gcc x86_64 randconfig-001-20240409 clang x86_64 randconfig-002-20240409 clang x86_64 randconfig-003-20240409 gcc x86_64 randconfig-004-20240409 gcc x86_64 randconfig-005-20240409 clang x86_64 randconfig-006-20240409 clang x86_64 randconfig-011-20240409 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 26370/30000] drivers/cpuinspect/inspector.c:34:22: sparse: sparse: symbol 'prev_cpu_inspector' was not declared. Should it be static?
by kernel test robot 10 Apr '24

10 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9f126942e6d283d9a0ca99f3e46dbebe8aec3afd commit: 069486b6d96472a22fc9fdb779ae3676710eea5a [26370/30000] cpuinspect: add CPU-inspect infrastructure config: x86_64-randconfig-r132-20240409 (https://download.01.org/0day-ci/archive/20240410/202404100142.WYaJGYT1-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240410/202404100142.WYaJGYT1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404100142.WYaJGYT1-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/cpuinspect/inspector.c:34:22: sparse: sparse: symbol 'prev_cpu_inspector' was not declared. Should it be static? -- >> drivers/cpuinspect/sysfs.c:92:9: sparse: sparse: symbol 'patrol_complete_show' was not declared. Should it be static? >> drivers/cpuinspect/sysfs.c:98:9: sparse: sparse: symbol 'cpu_utility_show' was not declared. Should it be static? >> drivers/cpuinspect/sysfs.c:104:9: sparse: sparse: symbol 'cpu_utility_store' was not declared. Should it be static? >> drivers/cpuinspect/sysfs.c:117:9: sparse: sparse: symbol 'patrol_times_show' was not declared. Should it be static? >> drivers/cpuinspect/sysfs.c:123:9: sparse: sparse: symbol 'patrol_times_store' was not declared. Should it be static? >> drivers/cpuinspect/sysfs.c:139:9: sparse: sparse: symbol 'start_patrol_store' was not declared. Should it be static? vim +/prev_cpu_inspector +34 drivers/cpuinspect/inspector.c 31 32 LIST_HEAD(cpu_inspectors); 33 struct cpu_inspector *curr_cpu_inspector; > 34 struct cpu_inspector *prev_cpu_inspector; 35 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] fix CVE-2024-26669
by Zhengchao Shao 09 Apr '24

09 Apr '24

fix CVE-2024-26669. Ido Schimmel (1): net/sched: flower: Fix chain template offload Zhengchao Shao (1): net/sched: flower: Fix kabi change net/sched/cls_api.c | 20 ++++++++++++++++++++ net/sched/cls_flower.c | 23 +++++++++++++++++++++++ 2 files changed, 43 insertions(+) -- 2.34.1

2 3

[openeuler:OLK-5.10 13866/30000] mm/page_cache_limit.c:39:50: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 09 Apr '24

09 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5c90c8c1e78b11cba596b4cf0756220759f4ebae commit: 581a69b81673ae3cecd41af71338af42855964e2 [13866/30000] mm: support periodical memory reclaim config: x86_64-randconfig-r132-20240409 (https://download.01.org/0day-ci/archive/20240409/202404092240.lrAGVAyn-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240409/202404092240.lrAGVAyn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404092240.lrAGVAyn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/page_cache_limit.c:39:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/page_cache_limit.c:39:50: sparse: expected void * mm/page_cache_limit.c:39:50: sparse: got void [noderef] __user *buffer mm/page_cache_limit.c:55:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/page_cache_limit.c:55:50: sparse: expected void * mm/page_cache_limit.c:55:50: sparse: got void [noderef] __user *buffer >> mm/page_cache_limit.c:73:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/page_cache_limit.c:73:35: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/page_cache_limit.c:73:35: sparse: got int ( * )( ... ) mm/page_cache_limit.c:91:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/page_cache_limit.c:91:35: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/page_cache_limit.c:91:35: sparse: got int ( * )( ... ) vim +39 mm/page_cache_limit.c 33 34 static int cache_reclaim_enable_handler(struct ctl_table *table, int write, 35 void __user *buffer, size_t *length, loff_t *ppos) 36 { 37 int ret; 38 > 39 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 40 if (ret || !write) 41 return ret; 42 43 if (should_periodical_reclaim()) 44 schedule_delayed_work(&shepherd, round_jiffies_relative( 45 (unsigned long)vm_cache_reclaim_s * HZ)); 46 47 return 0; 48 } 49 50 static int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, 51 void __user *buffer, size_t *length, loff_t *ppos) 52 { 53 int ret; 54 55 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 56 if (ret || !write) 57 return ret; 58 59 if (should_periodical_reclaim()) 60 mod_delayed_work(system_unbound_wq, &shepherd, 61 round_jiffies_relative( 62 (unsigned long)vm_cache_reclaim_s * HZ)); 63 64 return ret; 65 } 66 67 static struct ctl_table ctl_table[] = { 68 { 69 .procname = "cache_reclaim_s", 70 .data = &vm_cache_reclaim_s, 71 .maxlen = sizeof(vm_cache_reclaim_s), 72 .mode = 0644, > 73 .proc_handler = cache_reclaim_sysctl_handler, 74 .extra1 = SYSCTL_ZERO, 75 .extra2 = &vm_cache_reclaim_s_max, 76 }, 77 { 78 .procname = "cache_reclaim_weight", 79 .data = &vm_cache_reclaim_weight, 80 .maxlen = sizeof(vm_cache_reclaim_weight), 81 .mode = 0644, 82 .proc_handler = proc_dointvec_minmax, 83 .extra1 = SYSCTL_ONE, 84 .extra2 = &vm_cache_reclaim_weight_max, 85 }, 86 { 87 .procname = "cache_reclaim_enable", 88 .data = &vm_cache_reclaim_enable, 89 .maxlen = sizeof(vm_cache_reclaim_enable), 90 .mode = 0644, 91 .proc_handler = cache_reclaim_enable_handler, 92 .extra1 = SYSCTL_ZERO, 93 .extra2 = SYSCTL_ONE, 94 }, 95 {} 96 }; 97 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] CVE-2023-52484
by Guo Mengqi 09 Apr '24

09 Apr '24

CVE-2023-52484 Nicolin Chen (2): iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range() iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 37 +++++++++++++++++-- 1 file changed, 33 insertions(+), 4 deletions(-) -- 2.17.1

2 3

[PATCH OLK-5.10 1/2] iommu/arm-smmu-v3: Fix size calculation in arm_smmu_mm_invalidate_range()
by Guo Mengqi 09 Apr '24

09 Apr '24

From: Nicolin Chen <nicolinc(a)nvidia.com> stable inclusion from stable-v5.15.39 commit 2c14dda7a4dfecbda191351da29e4756b7377ee7 bugzilla: 189652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 95d4782c34a60800ccf91d9f0703137d4367a2fc upstream. The arm_smmu_mm_invalidate_range function is designed to be called by mm core for Shared Virtual Addressing purpose between IOMMU and CPU MMU. However, the ways of two subsystems defining their "end" addresses are slightly different. IOMMU defines its "end" address using the last address of an address range, while mm core defines that using the following address of an address range: include/linux/mm_types.h: unsigned long vm_end; /* The first byte after our end address ... This mismatch resulted in an incorrect calculation for size so it failed to be page-size aligned. Further, it caused a dead loop at "while (iova < end)" check in __arm_smmu_tlb_inv_range function. This patch fixes the issue by doing the calculation correctly. Fixes: 2f7e8c553e98 ("iommu/arm-smmu-v3: Hook up ATC invalidation to mm ops") Cc: stable(a)vger.kernel.org Signed-off-by: Nicolin Chen <nicolinc(a)nvidia.com> Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com> Reviewed-by: Robin Murphy <robin.murphy(a)arm.com> Reviewed-by: Jean-Philippe Brucker <jean-philippe(a)linaro.org> Link: https://lore.kernel.org/r/20220419210158.21320-1-nicolinc@nvidia.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c index a8e8fd9d7c8b..e74fe4f60646 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c @@ -187,7 +187,14 @@ static void arm_smmu_mm_invalidate_range(struct mmu_notifier *mn, { struct arm_smmu_mmu_notifier *smmu_mn = mn_to_smmu(mn); struct arm_smmu_domain *smmu_domain = smmu_mn->domain; - size_t size = end - start + 1; + size_t size; + + /* + * The mm_types defines vm_end as the first byte after the end address, + * different from IOMMU subsystem using the last address of an address + * range. So do a simple translation here by calculating size correctly. + */ + size = end - start; if (!(smmu_domain->smmu->features & ARM_SMMU_FEAT_BTM)) arm_smmu_tlb_inv_range_asid(start, size, smmu_mn->cd->asid, -- 2.17.1

2 2

[PATCH] dm-crypt: don't modify the data when using authenticated encryption
by Li Lingfeng 09 Apr '24

09 Apr '24

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v5.10.211 commit 3c652f6fa1e1f9f02c3fbf359d260ad153ec5f90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2LW CVE: CVE-2024-26763 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 50c70240097ce41fe6bce6478b80478281e4d0f7 upstream. It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. So, fix this problem by copying the data into the clone bio first and then encrypt them inside the clone bio. This may reduce performance, but it is needed to prevent the user from corrupting the device by writing data with O_DIRECT and modifying them at the same time. [1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-crypt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 5d772f322a24..5edcdcee91c2 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -2064,6 +2064,12 @@ static void kcryptd_crypt_write_convert(struct dm_crypt_io *io) io->ctx.bio_out = clone; io->ctx.iter_out = clone->bi_iter; + if (crypt_integrity_aead(cc)) { + bio_copy_data(clone, io->base_bio); + io->ctx.bio_in = clone; + io->ctx.iter_in = clone->bi_iter; + } + sector += bio_sectors(clone); crypt_inc_pending(io); -- 2.31.1

1 0