- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 1acb6ad947eee3676d09c5626001d3bc1b69b9ce
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 1acb6ad947eee3676d09c5626001d3bc1b69b9ce !4990 vt: fix memory overlapping when deleting chars in the buffer elapsed time: 746m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 70c98c7d4aac402e0ad746c4312d808d7495c50b
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 70c98c7d4aac402e0ad746c4312d808d7495c50b !5004 nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() Warning reports: https://lore.kernel.org/oe-kbuild-all/202403080622.uNLahRYD-lkp@intel.com Warning ids grouped by kconfigs: clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns | |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns | `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode `-- x86_64-randconfig-121-20240307 `-- arch-x86-kernel-cpu-common.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__percpu-got-unsigned-short elapsed time: 732m configs tested: 7 configs skipped: 97 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 28904/30000] arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 70c98c7d4aac402e0ad746c4312d808d7495c50b commit: f4128ae8e6ff03b4c805707fe75d0345797f7f53 [28904/30000] sched: Add cluster scheduler level for x86 config: x86_64-randconfig-121-20240307 (https://download.01.org/0day-ci/archive/20240308/202403080622.uNLahRYD-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080622.uNLahRYD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080622.uNLahRYD-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/cpu/common.c:92:16: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got unsigned short * @@ arch/x86/kernel/cpu/common.c:92:16: sparse: expected void const [noderef] __percpu *__vpp_verify arch/x86/kernel/cpu/common.c:92:16: sparse: got unsigned short * arch/x86/kernel/cpu/common.c:1901:1: sparse: sparse: symbol 'fixed_percpu_data' redeclared with different type (different address spaces): arch/x86/kernel/cpu/common.c:1901:1: sparse: struct fixed_percpu_data [addressable] [noderef] [toplevel] __percpu fixed_percpu_data arch/x86/kernel/cpu/common.c: note: in included file (through arch/x86/include/asm/cpufeature.h, arch/x86/include/asm/thread_info.h, include/linux/thread_bits.h, ...): arch/x86/include/asm/processor.h:470:1: sparse: note: previously declared as: arch/x86/include/asm/processor.h:470:1: sparse: struct fixed_percpu_data extern [addressable] [toplevel] fixed_percpu_data arch/x86/kernel/cpu/common.c:144:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:145:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:146:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:147:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:148:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/kernel/cpu/common.c:149:43: sparse: sparse: cast truncates bits from constant value (fffff becomes ffff) arch/x86/include/asm/processor.h:474:31: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got char ( * )[40] @@ arch/x86/include/asm/processor.h:474:31: sparse: expected void const [noderef] __percpu *__vpp_verify arch/x86/include/asm/processor.h:474:31: sparse: got char ( * )[40] vim +92 arch/x86/kernel/cpu/common.c f8b64d08dde271 Borislav Petkov 2018-04-27 89 6f01df96c462b7 Kim Phillips 2021-08-17 90 u16 get_llc_id(unsigned int cpu) 6f01df96c462b7 Kim Phillips 2021-08-17 91 { 6f01df96c462b7 Kim Phillips 2021-08-17 @92 return per_cpu(cpu_llc_id, cpu); 6f01df96c462b7 Kim Phillips 2021-08-17 93 } 6f01df96c462b7 Kim Phillips 2021-08-17 94 EXPORT_SYMBOL_GPL(get_llc_id); 6f01df96c462b7 Kim Phillips 2021-08-17 95 :::::: The code at line 92 was first introduced by commit :::::: 6f01df96c462b77915b27d404152c47e75e879cf x86/cpu: Add get_llc_id() helper function :::::: TO: Kim Phillips <kim.phillips(a)amd.com> :::::: CC: Xie Haocheng <haocheng.xie(a)amd.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 97ba28f60ba0c12d39b4d3032121317ffebc06ba
by kernel test robot 08 Mar '24

08 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 97ba28f60ba0c12d39b4d3032121317ffebc06ba !5024 v2 vmemmap optimize bugfix Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202403080243.ondrgrmr-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202403080412.gcDr9v5Q-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: expecting prototype for rnp_set_rxfh(). Prototype was for rnp_set_rxnfc() instead drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1856: warning: expecting prototype for rnp_tet_rxfh(). Prototype was for rnp_get_rxfh() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2013: warning: expecting prototype for rnp_write_eitr(). Prototype was for rnp_write_eitr_rx() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1175: warning: expecting prototype for rnp_mbx_stat_mark(). Prototype was for rnp_link_stat_mark() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:823: warning: expecting prototype for rnp_mbx_link_event_eanble(). Prototype was for rnp_mbx_link_event_enable() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1135: warning: expecting prototype for rnp_init_hw_n10(). Prototype was for rnp_init_hw_ops_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: expecting prototype for rnp_write_uc_addr_list(). Prototype was for rnp_write_uc_addr_list_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:3270: warning: expecting prototype for rnpm_device_supports_autoneg_fc(). Prototype was for rnp_device_supports_autoneg_fc() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: expecting prototype for rnp_fc_mode_n10(). Prototype was for rnp_mac_fc_mode_n10() instead Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-r111-20240227 | `-- mm-memcontrol.c:sparse:sparse:symbol-hisi_oom_recover-was-not-declared.-Should-it-be-static `-- loongarch-allmodconfig |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_set_rxfh().-Prototype-was-for-rnp_set_rxnfc()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:expecting-prototype-for-rnp_tet_rxfh().-Prototype-was-for-rnp_get_rxfh()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:directive-output-may-be-truncated-writing-byte-into-a-region-of-size-between-and |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:expecting-prototype-for-rnp_write_eitr().-Prototype-was-for-rnp_write_eitr_rx()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_link_event_eanble().-Prototype-was-for-rnp_mbx_link_event_enable()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:expecting-prototype-for-rnp_mbx_stat_mark().-Prototype-was-for-rnp_link_stat_mark()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-rnp_mbx_lldp_all_ports_enable |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_fc_mode_n10().-Prototype-was-for-rnp_mac_fc_mode_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_init_hw_n10().-Prototype-was-for-rnp_init_hw_ops_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnp_write_uc_addr_list().-Prototype-was-for-rnp_write_uc_addr_list_n10()-instead |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:expecting-prototype-for-rnpm_device_supports_autoneg_fc().-Prototype-was-for-rnp_device_supports_autoneg_fc()-instead |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_mbx_lldp_all_ports_enable | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 740m configs tested: 10 configs skipped: 94 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3862/3876] drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 97ba28f60ba0c12d39b4d3032121317ffebc06ba commit: 455d45ae080810ae554f5e586adb9004230f9f70 [3862/3876] drivers: initial support for rnp drivers from Mucse Technology config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240308/202403080412.gcDr9v5Q-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080412.gcDr9v5Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080412.gcDr9v5Q-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_mbx_get_temp': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1105:13: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1105 | int err; | ^~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: At top level: drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:5: warning: no previous prototype for 'rnp_fw_reg_read' [-Wmissing-prototypes] 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_fw_reg_read': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1145:13: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1145 | int value; | ^~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: At top level: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c: In function 'rnp_mbx_reg_write': drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:602:9: warning: 'build_writereg_req' accessing 16 bytes in a region of size 4 [-Wstringop-overflow=] 602 | build_writereg_req(&req, NULL, fw_reg, 4, &value); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:602:9: note: referencing argument 5 of type 'int[4]' In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960, from drivers/net/ethernet/mucse/rnp/rnp.h:20, from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:799:20: note: in a call to function 'build_writereg_req' 799 | static inline void build_writereg_req(struct mbx_fw_cmd_req *req, | ^~~~~~~~~~~~~~~~~~ In file included from include/linux/string.h:294, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from arch/loongarch/include/asm/processor.h:9, from arch/loongarch/include/asm/thread_info.h:15, from include/linux/thread_bits.h:32, from include/linux/thread_info.h:16, from include/asm-generic/preempt.h:5, from ./arch/loongarch/include/generated/asm/preempt.h:1, from include/linux/preempt.h:79, from include/linux/spinlock.h:56, from include/linux/wait.h:9, from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:4: In function 'fortify_memcpy_chk', inlined from 'rnp_mbx_phy_read' at drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1386:3: include/linux/fortify-string.h:592:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnp/rnp_n10.c:458: warning: Function parameter or member 'sriov_flag' not described in 'rnp_eth_update_rss_key_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:1135: warning: expecting prototype for rnp_init_hw_n10(). Prototype was for rnp_init_hw_ops_n10() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: Function parameter or member 'hw' not described in 'rnp_write_uc_addr_list_n10' drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: Function parameter or member 'sriov_flag' not described in 'rnp_write_uc_addr_list_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:1368: warning: expecting prototype for rnp_write_uc_addr_list(). Prototype was for rnp_write_uc_addr_list_n10() instead >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:3270: warning: expecting prototype for rnpm_device_supports_autoneg_fc(). Prototype was for rnp_device_supports_autoneg_fc() instead drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: Function parameter or member 'mac' not described in 'rnp_mac_fc_mode_n10' >> drivers/net/ethernet/mucse/rnp/rnp_n10.c:4152: warning: expecting prototype for rnp_fc_mode_n10(). Prototype was for rnp_mac_fc_mode_n10() instead -- >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:823: warning: expecting prototype for rnp_mbx_link_event_eanble(). Prototype was for rnp_mbx_link_event_enable() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value0' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value1' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value2' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:902: warning: Function parameter or member 'value3' not described in 'rnp_set_lane_fun' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1024: warning: Function parameter or member 'info' not described in 'rnp_mbx_get_capability' drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1024: warning: Excess function parameter 'rnp_info' description in 'rnp_mbx_get_capability' >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1175: warning: expecting prototype for rnp_mbx_stat_mark(). Prototype was for rnp_link_stat_mark() instead drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1414: warning: Function parameter or member 'adv' not described in 'rnp_mbx_phy_link_set' -- drivers/net/ethernet/mucse/rnp/rnp_main.c:175:6: warning: no previous prototype for 'rnp_unmap_and_free_tx_resource' [-Wmissing-prototypes] 175 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:670:5: warning: no previous prototype for 'rnp_rx_ring_reinit' [-Wmissing-prototypes] 670 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:6: warning: no previous prototype for 'rnp_write_eitr_rx' [-Wmissing-prototypes] 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:3176:6: warning: no previous prototype for 'rnp_vlan_stags_flag' [-Wmissing-prototypes] 3176 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:3580:5: warning: no previous prototype for 'rnp_xmit_nop_frame_ring' [-Wmissing-prototypes] 3580 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:4842:6: warning: no previous prototype for 'rnp_service_timer' [-Wmissing-prototypes] 4842 | void rnp_service_timer(struct timer_list *t) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:4950:6: warning: no previous prototype for 'rnp_service_task' [-Wmissing-prototypes] 4950 | void rnp_service_task(struct work_struct *work) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:5972:5: warning: no previous prototype for 'rnp_delete_knode' [-Wmissing-prototypes] 5972 | int rnp_delete_knode(struct net_device *dev, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6061:5: warning: no previous prototype for 'rnp_config_knode' [-Wmissing-prototypes] 6061 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6120:5: warning: no previous prototype for 'rnp_setup_tc_cls_u32' [-Wmissing-prototypes] 6120 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6197:6: warning: no previous prototype for 'rnp_do_reset' [-Wmissing-prototypes] 6197 | void rnp_do_reset(struct net_device *netdev) | ^~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6452:6: warning: no previous prototype for 'rnp_assign_netdev_ops' [-Wmissing-prototypes] 6452 | void rnp_assign_netdev_ops(struct net_device *dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c:6628:5: warning: no previous prototype for 'rnp_can_rpu_start' [-Wmissing-prototypes] 6628 | int rnp_can_rpu_start(struct rnp_adapter *adapter) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_main.c: In function 'rnp_request_msix_irqs': >> drivers/net/ethernet/mucse/rnp/rnp_main.c:2402:71: warning: '-' directive output may be truncated writing 1 byte into a region of size between 0 and 17 [-Wformat-truncation=] 2402 | sizeof(q_vector->name) - 1, "%s-%s-%d-%d", | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2401:25: note: 'snprintf' output between 10 and 37 bytes into a destination of size 24 2401 | snprintf(q_vector->name, | ^~~~~~~~~~~~~~~~~~~~~~~~ 2402 | sizeof(q_vector->name) - 1, "%s-%s-%d-%d", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2403 | netdev->name, "TxRx", i, q_vector->v_idx); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Function parameter or member 'rnp_queue' not described in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Function parameter or member 'rnp_msix_vector' not described in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Excess function parameter 'queue' description in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:158: warning: Excess function parameter 'msix_vector' description in 'rnp_set_ring_vector' drivers/net/ethernet/mucse/rnp/rnp_main.c:288: warning: Function parameter or member 'napi_budget' not described in 'rnp_clean_tx_irq' drivers/net/ethernet/mucse/rnp/rnp_main.c:672: warning: Function parameter or member 'adapter' not described in 'rnp_rx_ring_reinit' drivers/net/ethernet/mucse/rnp/rnp_main.c:1130: warning: Excess function parameter 'skb' description in 'rnp_is_non_eop' >> drivers/net/ethernet/mucse/rnp/rnp_main.c:2013: warning: expecting prototype for rnp_write_eitr(). Prototype was for rnp_write_eitr_rx() instead drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Function parameter or member 'adapter' not described in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Excess function parameter 'netdev' description in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:2563: warning: Excess function parameter 'maxrate' description in 'rnp_tx_maxrate_own' drivers/net/ethernet/mucse/rnp/rnp_main.c:3779: warning: Function parameter or member 'txqueue' not described in 'rnp_tx_timeout' drivers/net/ethernet/mucse/rnp/rnp_main.c:3888: warning: Function parameter or member 'adapter' not described in 'rnp_setup_tx_resources' drivers/net/ethernet/mucse/rnp/rnp_main.c:3981: warning: Function parameter or member 'adapter' not described in 'rnp_setup_rx_resources' drivers/net/ethernet/mucse/rnp/rnp_main.c:4643: warning: Excess function parameter 'link_speed' description in 'rnp_watchdog_update_link' drivers/net/ethernet/mucse/rnp/rnp_main.c:4843: warning: Function parameter or member 't' not described in 'rnp_service_timer' drivers/net/ethernet/mucse/rnp/rnp_main.c:4843: warning: Excess function parameter 'data' description in 'rnp_service_timer' drivers/net/ethernet/mucse/rnp/rnp_main.c:5903: warning: Function parameter or member 'dev' not described in 'rnp_setup_tc' drivers/net/ethernet/mucse/rnp/rnp_main.c:5903: warning: Excess function parameter 'netdev' description in 'rnp_setup_tc' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Function parameter or member 'adapter' not described in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Function parameter or member 'subdevice_id' not described in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Excess function parameter 'hw' description in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:6471: warning: Excess function parameter 'subdev_id' description in 'rnp_wol_supported' drivers/net/ethernet/mucse/rnp/rnp_main.c:7056: warning: Function parameter or member 'id' not described in 'rnp_probe' drivers/net/ethernet/mucse/rnp/rnp_main.c:7056: warning: Excess function parameter 'ent' description in 'rnp_probe' -- drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:179: warning: Function parameter or member 'data' not described in 'rnp_reg_test' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:466: warning: Function parameter or member 'dev' not described in 'rnp_get_ts_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:466: warning: Excess function parameter 'netdev' description in 'rnp_get_ts_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:527: warning: Function parameter or member 'dev' not described in 'rnp_get_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:527: warning: Excess function parameter 'netdev' description in 'rnp_get_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:561: warning: Function parameter or member 'dev' not described in 'rnp_set_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:561: warning: Excess function parameter 'netdev' description in 'rnp_set_channels' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:600: warning: Function parameter or member 'dev' not described in 'rnp_get_module_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:600: warning: Excess function parameter 'netdev' description in 'rnp_get_module_info' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:653: warning: Function parameter or member 'dev' not described in 'rnp_get_module_eeprom' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:653: warning: Excess function parameter 'netdev' description in 'rnp_get_module_eeprom' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:700: warning: Function parameter or member 'ker' not described in 'rnp_get_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:700: warning: Function parameter or member 'extack' not described in 'rnp_get_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:725: warning: Function parameter or member 'ker' not described in 'rnp_set_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:725: warning: Function parameter or member 'extack' not described in 'rnp_set_ringparam' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'coal' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'kernel_coal' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Function parameter or member 'extack' not described in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Excess function parameter 'cmd' description in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:945: warning: Excess function parameter 'ec' description in 'rnp_get_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Function parameter or member 'kernel_coal' not described in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Function parameter or member 'extack' not described in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:987: warning: Excess function parameter 'cmd' description in 'rnp_set_coalesce' drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: Function parameter or member 'dev' not described in 'rnp_set_rxnfc' >> drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1788: warning: expecting prototype for rnp_set_rxfh(). Prototype was for rnp_set_rxnfc() instead >> drivers/net/ethernet/mucse/rnp/rnp_ethtool.c:1856: warning: expecting prototype for rnp_tet_rxfh(). Prototype was for rnp_get_rxfh() instead vim +2402 drivers/net/ethernet/mucse/rnp/rnp_main.c 2378 2379 /** 2380 * rnp_request_msix_irqs - Initialize MSI-X interrupts 2381 * @adapter: board private structure 2382 * 2383 * rnp_request_msix_irqs allocates MSI-X vectors and requests 2384 * interrupts from the kernel. 2385 **/ 2386 static int rnp_request_msix_irqs(struct rnp_adapter *adapter) 2387 { 2388 struct net_device *netdev = adapter->netdev; 2389 int err; 2390 int i = 0; 2391 2392 DPRINTK(IFUP, INFO, "[%s] num_q_vectors:%d\n", __func__, 2393 adapter->num_q_vectors); 2394 2395 for (i = 0; i < adapter->num_q_vectors; i++) { 2396 struct rnp_q_vector *q_vector = adapter->q_vector[i]; 2397 struct msix_entry *entry = 2398 &adapter->msix_entries[i + adapter->q_vector_off]; 2399 2400 if (q_vector->tx.ring && q_vector->rx.ring) { 2401 snprintf(q_vector->name, > 2402 sizeof(q_vector->name) - 1, "%s-%s-%d-%d", 2403 netdev->name, "TxRx", i, q_vector->v_idx); 2404 } else { 2405 WARN(!(q_vector->tx.ring && q_vector->rx.ring), 2406 "%s vector%d tx rx is null, v_idx:%d\n", 2407 netdev->name, i, q_vector->v_idx); 2408 /* skip this unused q_vector */ 2409 continue; 2410 } 2411 err = request_irq(entry->vector, &rnp_msix_clean_rings, 0, 2412 q_vector->name, q_vector); 2413 if (err) { 2414 e_err(probe, 2415 "%s:request_irq failed for MSIX interrupt:%d", 2416 netdev->name, entry->vector); 2417 e_err(probe, "Error: %d\n", err); 2418 goto free_queue_irqs; 2419 } 2420 /* register for affinity change notifications */ 2421 q_vector->affinity_notify.notify = rnp_irq_affinity_notify; 2422 q_vector->affinity_notify.release = 2423 rnp_irq_affinity_release; 2424 irq_set_affinity_notifier(entry->vector, 2425 &q_vector->affinity_notify); 2426 DPRINTK(IFUP, INFO, "[%s] set %s affinity_mask\n", 2427 __func__, q_vector->name); 2428 2429 irq_set_affinity_hint(entry->vector, 2430 &q_vector->affinity_mask); 2431 } 2432 2433 return 0; 2434 2435 free_queue_irqs: 2436 while (i) { 2437 i--; 2438 irq_set_affinity_hint( 2439 adapter->msix_entries[i + adapter->q_vector_off].vector, 2440 NULL); 2441 free_irq(adapter->msix_entries[i + adapter->q_vector_off].vector, 2442 adapter->q_vector[i]); 2443 irq_set_affinity_notifier( 2444 adapter->msix_entries[i + adapter->q_vector_off].vector, 2445 NULL); 2446 irq_set_affinity_hint( 2447 adapter->msix_entries[i + adapter->q_vector_off].vector, 2448 NULL); 2449 } 2450 return err; 2451 } 2452 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3862/3876] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable'
by kernel test robot 08 Mar '24

08 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 97ba28f60ba0c12d39b4d3032121317ffebc06ba commit: 455d45ae080810ae554f5e586adb9004230f9f70 [3862/3876] drivers: initial support for rnp drivers from Mucse Technology config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240308/202403080243.ondrgrmr-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 503c55e17037436dcd45ac69dea8967e67e3f5e8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240308/202403080243.ondrgrmr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403080243.ondrgrmr-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:9: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:571:18: warning: array index 0 is past the end of the array (that has type 'char[0]', cast to 'int *') [-Warray-bounds] 571 | ret = ((int *)(cookie->priv))[0]; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:60:2: note: array 'priv' declared here 60 | char priv[0]; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1105:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1105 | int err; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1145:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1145 | int value; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:5: warning: no previous prototype for function 'rnp_fw_reg_read' [-Wmissing-prototypes] 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1141:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1141 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ | static >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:5: warning: no previous prototype for function 'rnp_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1456:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1456 | int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1519:18: warning: array index 0 is past the end of the array (that has type 'char[0]', cast to 'int *') [-Warray-bounds] 1519 | ret = ((int *)(cookie->priv))[0]; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:60:2: note: array 'priv' declared here 60 | char priv[0]; | ^ In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:4: In file included from include/linux/wait.h:9: In file included from include/linux/spinlock.h:63: In file included from include/linux/lockdep.h:14: In file included from include/linux/smp.h:13: In file included from include/linux/cpumask.h:12: In file included from include/linux/bitmap.h:11: In file included from include/linux/string.h:294: include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^ 12 warnings generated. vim +/rnp_mbx_lldp_all_ports_enable +1456 drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c 1455 > 1456 int rnp_mbx_lldp_all_ports_enable(struct rnp_hw *hw, bool enable) 1457 { 1458 struct mbx_fw_cmd_req req; 1459 int err; 1460 1461 if (!hw->fw_lldp_ablity) 1462 return -EOPNOTSUPP; 1463 1464 memset(&req, 0, sizeof(req)); 1465 1466 build_lldp_ctrl_set(&req, LLDP_TX_ALL_LANES, enable); 1467 1468 err = rnp_mbx_write_posted_locked(hw, &req); 1469 return err; 1470 } 1471 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
by Zeng Heng 07 Mar '24

07 Mar '24

From: Vincent Pelletier <plr.vincent(a)gmail.com> mainline inclusion from mainline-v5.16-rc8 commit b1e0887379422975f237d43d8839b751a6bcf154 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96S0P CVE: CVE-2021-46933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls. Also, set epfiles to NULL right after de-allocating it, for readability. For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported): /sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb84 r6:c3a12260 r5:bf54d014 r4:c229f000 [ 1946.646273] [<bf547d74>] (ffs_fs_kill_sb [usb_f_fs]) from [<c0326d50>] (deactivate_locked_super+0x54/0x9c) [ 1946.664893] r5:bf54d014 r4:c229f000 [ 1946.672921] [<c0326cfc>] (deactivate_locked_super) from [<c0326df8>] (deactivate_super+0x60/0x64) [ 1946.690722] r5:c2a09000 r4:c229f000 [ 1946.698706] [<c0326d98>] (deactivate_super) from [<c0349a28>] (cleanup_mnt+0xe4/0x14c) [ 1946.715553] r5:c2a09000 r4:00000000 [ 1946.723528] [<c0349944>] (cleanup_mnt) from [<c0349b08>] (__cleanup_mnt+0x1c/0x20) [ 1946.739922] r7:c0dfcb84 r6:c3a12260 r5:c3a126fc r4:00000000 [ 1946.750088] [<c0349aec>] (__cleanup_mnt) from [<c0143d10>] (task_work_run+0x84/0xb8) [ 1946.766602] [<c0143c8c>] (task_work_run) from [<c010bdc8>] (do_work_pending+0x470/0x56c) [ 1946.783540] r7:5ac3c35a r6:c0d0424c r5:c200bfb0 r4:c200a000 [ 1946.793614] [<c010b958>] (do_work_pending) from [<c01000c0>] (slow_work_pending+0xc/0x20) [ 1946.810553] Exception stack(0xc200bfb0 to 0xc200bff8) [ 1946.820129] bfa0: 00000000 00000000 000000aa b5e21430 [ 1946.837104] bfc0: bef867a0 00000001 bef86840 00000034 bef86838 bef86790 bef86794 bef867a0 [ 1946.854125] bfe0: 00000000 bef86798 b67b7a1c b6d626a4 60000010 b5a23760 [ 1946.865335] r10:00000000 r9:c200a000 r8:c0100224 r7:00000034 r6:bef86840 r5:00000001 [ 1946.881914] r4:bef867a0 [ 1946.888793] ---[ end trace 7387f2a9725b28d0 ]--- Fixes: 5e33f6fdf735 ("usb: gadget: ffs: add eventfd notification about ffs events") Cc: stable <stable(a)vger.kernel.org> Signed-off-by: Vincent Pelletier <plr.vincent(a)gmail.com> Link: https://lore.kernel.org/r/f79eeea29f3f98de6782a064ec0f7351ad2f598f.16397939… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/usb/gadget/function/f_fs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 2050993fb58b..221aee81f012 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1698,11 +1698,15 @@ static void ffs_data_clear(struct ffs_data *ffs) BUG_ON(ffs->gadget); - if (ffs->epfiles) + if (ffs->epfiles) { ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count); + ffs->epfiles = NULL; + } - if (ffs->ffs_eventfd) + if (ffs->ffs_eventfd) { eventfd_ctx_put(ffs->ffs_eventfd); + ffs->ffs_eventfd = NULL; + } kfree(ffs->raw_descs_data); kfree(ffs->raw_strings); @@ -1715,7 +1719,6 @@ static void ffs_data_reset(struct ffs_data *ffs) ffs_data_clear(ffs); - ffs->epfiles = NULL; ffs->raw_descs_data = NULL; ffs->raw_descs = NULL; ffs->raw_strings = NULL; -- 2.25.1

2 1

[PATCH OLK-6.6 0/8] cpuset featrue
by Chen Ridong 07 Mar '24

07 Mar '24

Harshit Mogalapalli (1): cgroup/cpuset: Cleanup signedness issue in cpu_exclusive_check() Kamalesh Babulal (1): cgroup/cpuset: Fix retval in update_cpumask() Waiman Long (6): cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2 cgroup/cpuset: Add cpuset.cpus.exclusive for v2 cgroup/cpuset: Introduce remote partition cgroup/cpuset: Check partition conflict with housekeeping setup cgroup/cpuset: Enable invalid to valid local partition transition cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() kernel/cgroup/cpuset.c | 1306 ++++++++++++++++++++++++++++++---------- 1 file changed, 975 insertions(+), 331 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 V3 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 07 Mar '24

07 Mar '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Changes in V3: - corrected the wrong bugzilla number in commit message. Changes in V2: - fixed incorrect mainline patch adaptation of WQ_FLAG_{CUSTOM, DONE}. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 7 ++---- kernel/sched/wait.c | 57 +++++++------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 74 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] net/sched: act_ct: fix wild memory access when clearing fragments
by Zhengchao Shao 07 Mar '24

07 Mar '24

From: Davide Caratti <dcaratti(a)redhat.com> mainline inclusion from mainline-v5.13-rc1 commit f77bd544a6bbe69aa50d9ed09f13494cf36ff806 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JMO CVE: CVE-2021-47014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one: KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ> when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS. Fixes: ae372cb1750f ("net/sched: act_ct: fix restore the qdisc_skb_cb after defrag") Fixes: 7baf2429a1a9 ("net/sched: cls_flower add CT_FLAGS_INVALID flag support") Reported-by: Shuang Li <shuali(a)redhat.com> Signed-off-by: Davide Caratti <dcaratti(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/sched/act_ct.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/act_ct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 2d41d866de3e..35668ce0b4a8 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -735,7 +735,8 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, #endif } - *qdisc_skb_cb(skb) = cb; + if (err != -EINPROGRESS) + *qdisc_skb_cb(skb) = cb; skb_clear_hash(skb); skb->ignore_df = 1; return err; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport etmem swapcache recalim feature to OLK 6.6
by Yuchen Tang 07 Mar '24

07 Mar '24

From: tangyuchen <tangyuchen5(a)huawei.com> v1 -> v2 - remove redundant symbol export - use safer kthread_freezable_should_stop - make THP out recalim candidate Yuchen Tang (2): etmem: Expose symbol reclaim_folio_list etmem: add swapcache reclaim to etmem fs/proc/etmem_swap.c | 173 +++++++++++++++++++++++++++++++++++++++++ include/linux/etmem.h | 29 +++++++ include/linux/swap.h | 2 + mm/etmem.c | 174 ++++++++++++++++++++++++++++++++++++++++++ mm/vmscan.c | 2 +- 5 files changed, 379 insertions(+), 1 deletion(-) -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS V2 0/2] Fix CVE-2021-47047
by Guan Jing 07 Mar '24

07 Mar '24

fix CVE-2021-47047 Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS V1 0/2] fix dma_map_single fails
by Guan Jing 07 Mar '24

07 Mar '24

fix dma_map_single fails Guan Jing (2): spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails spi: spi-zynqmp-gqspi: Handle error for dma_set_mask drivers/spi/spi-zynqmp-gqspi.c | 4 ++++ 1 file changed, 4 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Fixed CVE-2021-47037
by Zheng Zengkai 07 Mar '24

07 Mar '24

Q6afe-clocks driver can get reprobed. For example if the APR services are restarted after the firmware crash. However currently Q6afe-clocks driver will oops because hw.init will get cleared during first _probe call. Rewrite the driver to fill the clock data at runtime rather than using big static array of clocks. This issue was identified as CVE-2021-47037. Backport patches from linux 5.13-rc1 to fix this CVE. Dmitry Baryshkov (1): ASoC: q6afe-clocks: fix reprobing of the driver Srinivas Kandagatla (1): ASoC: q6afe-clocks: fix warning on symbol scope sound/soc/qcom/qdsp6/q6afe-clocks.c | 209 ++++++++++++++-------------- sound/soc/qcom/qdsp6/q6afe.c | 2 +- sound/soc/qcom/qdsp6/q6afe.h | 2 +- 3 files changed, 108 insertions(+), 105 deletions(-) -- 2.20.1

2 3

[PATCH v2 OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 0/2] vmemmap optimize bugfix
by Yuan Can 07 Mar '24

07 Mar '24

Yuan Can (2): mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes mm: hugetlb_vmemmap: allow alloc vmemmap pages fallback to other nodes mm/hugetlb_vmemmap.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS] ethernet:enic: Fix a use after free bug in enic_hard_start_xmit
by Liu Jian 07 Mar '24

07 Mar '24

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v4.19.191 commit 25a87b1f566b5eb2af2857a928f0e2310d900976 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCD CVE: CVE-2021-46998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 643001b47adc844ae33510c4bb93c236667008a3 ] In enic_hard_start_xmit, it calls enic_queue_wq_skb(). Inside enic_queue_wq_skb, if some error happens, the skb will be freed by dev_kfree_skb(skb). But the freed skb is still used in skb_tx_timestamp(skb). My patch makes enic_queue_wq_skb() return error and goto spin_unlock() incase of error. The solution is provided by Govind. See https://lkml.org/lkml/2021/4/30/961. Fixes: fb7516d42478e ("enic: add sw timestamp support") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Acked-by: Govindarajulu Varadarajan <gvaradar(a)cisco.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/net/ethernet/cisco/enic/enic_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c index 733d9172425b..f8e82bc55f0f 100644 --- a/drivers/net/ethernet/cisco/enic/enic_main.c +++ b/drivers/net/ethernet/cisco/enic/enic_main.c @@ -803,7 +803,7 @@ static inline int enic_queue_wq_skb_encap(struct enic *enic, struct vnic_wq *wq, return err; } -static inline void enic_queue_wq_skb(struct enic *enic, +static inline int enic_queue_wq_skb(struct enic *enic, struct vnic_wq *wq, struct sk_buff *skb) { unsigned int mss = skb_shinfo(skb)->gso_size; @@ -849,6 +849,7 @@ static inline void enic_queue_wq_skb(struct enic *enic, wq->to_use = buf->next; dev_kfree_skb(skb); } + return err; } /* netif_tx_lock held, process context with BHs disabled, or BH */ @@ -892,7 +893,8 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, return NETDEV_TX_BUSY; } - enic_queue_wq_skb(enic, wq, skb); + if (enic_queue_wq_skb(enic, wq, skb)) + goto error; if (vnic_wq_desc_avail(wq) < MAX_SKB_FRAGS + ENIC_DESC_MAX_SPLITS) netif_tx_stop_queue(txq); @@ -900,6 +902,7 @@ static netdev_tx_t enic_hard_start_xmit(struct sk_buff *skb, if (!skb->xmit_more || netif_xmit_stopped(txq)) vnic_wq_doorbell(wq); +error: spin_unlock(&enic->wq_lock[txq_map]); return NETDEV_TX_OK; -- 2.34.1

2 1

[PATCH OLK-6.6 00/12] LoongArch: fix some known issue and update defconfig
by Hongchen Zhang 07 Mar '24

07 Mar '24

Chong Qiao (1): irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. Hongchen Zhang (2): net: stmmac: fix potential double free of dma descriptor resources LoongArch: enable CONFIG_DEBUG_INFO_BTF by default Huacai Chen (1): drm/radeon: Workaround radeon driver bug for Loongson Jianmin Lv (1): LoongArch: Remove generic irq migration Tianli Xiong (1): irqchip/loongson-liointc: Set different isr for differnt core Yingkun Meng (1): LoongArch: defconfig: Enable a large number of configurations Youling Tang (4): LoongArch: kdump: Add memory reservation for old kernel LoongArch: kexec: Add compatibility with old interfaces LoongArch: Fix kdump failure on v40 interface specification LoongArch: kdump: Add high memory reservation zhangtianyang (1): LoongArch: Adapted SECTION_SIZE_BITS with page size arch/loongarch/Kconfig | 1 - arch/loongarch/configs/loongson3_defconfig | 1571 +++++++++++++++-- arch/loongarch/include/asm/irq.h | 1 + arch/loongarch/include/asm/sparsemem.h | 2 +- arch/loongarch/kernel/irq.c | 36 + arch/loongarch/kernel/machine_kexec.c | 45 +- arch/loongarch/kernel/setup.c | 94 +- arch/loongarch/kernel/smp.c | 3 +- drivers/gpu/drm/radeon/cik.c | 3 + drivers/gpu/drm/radeon/evergreen.c | 3 + drivers/gpu/drm/radeon/r600.c | 3 + drivers/gpu/drm/radeon/si.c | 3 + drivers/irqchip/irq-loongson-liointc.c | 4 +- drivers/irqchip/irq-loongson-pch-pic.c | 16 +- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 + kernel/irq/Kconfig | 4 +- 16 files changed, 1622 insertions(+), 178 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-22.03-LTS-SP2] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH 1/2] mm: hugetlb_vmemmap: fix hugetlb page number decrease failed on movable nodes
by Yuan Can 07 Mar '24

07 Mar '24

mainline inclusion from mainline commit 2eaa6c2abb9dd55041a05c20c451790c124d5cf0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96CYK CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- The decreasing of hugetlb pages number failed with the following message given: sh: page allocation failure: order:0, mode:0x204cc0(GFP_KERNEL|__GFP_RETRY_MAYFAIL|__GFP_THISNODE) CPU: 1 PID: 112 Comm: sh Not tainted 6.5.0-rc7-... #45 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.6+0x84/0xe4 show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x24 warn_alloc+0x100/0x1bc __alloc_pages_slowpath.constprop.107+0xa40/0xad8 __alloc_pages+0x244/0x2d0 hugetlb_vmemmap_restore+0x104/0x1e4 __update_and_free_hugetlb_folio+0x44/0x1f4 update_and_free_hugetlb_folio+0x20/0x68 update_and_free_pages_bulk+0x4c/0xac set_max_huge_pages+0x198/0x334 nr_hugepages_store_common+0x118/0x178 nr_hugepages_store+0x18/0x24 kobj_attr_store+0x18/0x2c sysfs_kf_write+0x40/0x54 kernfs_fop_write_iter+0x164/0x1dc vfs_write+0x3a8/0x460 ksys_write+0x6c/0x100 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.1+0x6c/0xe4 do_el0_svc+0x38/0x94 el0_svc+0x28/0x74 el0t_64_sync_handler+0xa0/0xc4 el0t_64_sync+0x174/0x178 Mem-Info: ... The reason is that the hugetlb pages being released are allocated from movable nodes, and with hugetlb_optimize_vmemmap enabled, vmemmap pages need to be allocated from the same node during the hugetlb pages releasing. With GFP_KERNEL and __GFP_THISNODE set, allocating from movable node is always failed. Fix this problem by removing __GFP_THISNODE. Link: https://lkml.kernel.org/r/20230905124503.24899-1-yuancan@huawei.com Fixes: ad2fa3717b74 ("mm: hugetlb: alloc the vmemmap pages associated with each HugeTLB page") Signed-off-by: Yuan Can <yuancan(a)huawei.com> Reviewed-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Mike Kravetz <mike.kravetz(a)oracle.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/hugetlb_vmemmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c index 90aee2cd3dab..b3bc59160003 100644 --- a/mm/hugetlb_vmemmap.c +++ b/mm/hugetlb_vmemmap.c @@ -381,7 +381,7 @@ static int vmemmap_remap_free(unsigned long start, unsigned long end, static int alloc_vmemmap_page_list(unsigned long start, unsigned long end, struct list_head *list) { - gfp_t gfp_mask = GFP_KERNEL | __GFP_RETRY_MAYFAIL | __GFP_THISNODE; + gfp_t gfp_mask = GFP_KERNEL | __GFP_RETRY_MAYFAIL; unsigned long nr_pages = (end - start) >> PAGE_SHIFT; int nid = page_to_nid((struct page *)start); struct page *page, *next; -- 2.17.1

1 1

[PATCH OLK-5.10] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 07 Mar '24

07 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v5.10.198 commit 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aadea660c66c..b0077f5f7112 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 2644e97ceb4e48ac50ba90491e02bc6db6eec979
by kernel test robot 07 Mar '24

07 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2644e97ceb4e48ac50ba90491e02bc6db6eec979 !4925 v2 btrfs: do not ASSERT() if the newly created subvolume already got read Warning: (recently discovered and may have been fixed) drivers/net/ethernet/huawei/hinic/hinic_lld.c:956:33: warning: 'strncpy' output may be truncated copying 15 bytes from a string of length 15 [-Wstringop-truncation] Warning ids grouped by kconfigs: gcc_recent_errors `-- arm64-randconfig-003-20240306 `-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length clang_recent_errors `-- x86_64-allyesconfig |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-function-ubcore_find_tpf_device_legacy |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-function-ubcore_modify_tp_state |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_dev_accessible_by_ns |-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_dev_ns `-- drivers-ub-urma-uburma-uburma_main.c:warning:no-previous-prototype-for-function-uburma_set_ns_mode elapsed time: 1034m configs tested: 11 configs skipped: 133 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240307 gcc arm64 randconfig-002-20240307 gcc arm64 randconfig-003-20240307 gcc arm64 randconfig-004-20240307 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f1e6c574c7e9942b39f099e93601ea84a6c4f737
by kernel test robot 07 Mar '24

07 Mar '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f1e6c574c7e9942b39f099e93601ea84a6c4f737 !4930 erofs: fix lz4 inplace decompression Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- aarch64-linux-ld:arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- aarch64-linux-ld:arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-include-asm-kvm_mmu.h:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):dangerous-relocation:unsupported-relocation | |-- arch-arm64-kvm-hyp-nvhe-..-pgtable.c:(.hyp.text):undefined-reference-to-__kvm_nvhe_kvm_ncsnp_support | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-001-20240306 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-003-20240306 | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- drivers-platform-mpam-mpam_devices.c:error:implicit-declaration-of-function-__acpi_get_mem_attribute | `-- drivers-platform-mpam-mpam_devices.c:error:incompatible-types-when-assigning-to-type-pgprot_t-from-type-int |-- loongarch-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-infiniband-hw-hns-hns_roce_hw_v2.c:warning:no-previous-prototype-for-hns_roce_hw_v2_get_dscp | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_register_performance | |-- loongson3-acpi-cpufreq.c:(.text):undefined-reference-to-acpi_processor_unregister_performance | `-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-ima_get_hash_algo |-- loongarch-randconfig-001-20240306 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead `-- loongarch-randconfig-002-20240306 `-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead clang_recent_errors |-- arm64-allmodconfig | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here | |-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true |-- arm64-randconfig-002-20240306 | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- arm64-randconfig-004-20240306 | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | `-- drivers-irqchip-irq-mbigen.c:warning:expecting-prototype-for-Due-to-the-existence-of-hyper().-Prototype-was-for-GICR_LENGTH()-instead |-- x86_64-allyesconfig | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:no-previous-prototype-for-function-tsse_stop_dev | |-- drivers-crypto-montage-tsse-tsse_dev_mgr.c:warning:variable-ptr-is-used-uninitialized-whenever-for-loop-exits-because-its-condition-is-false | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_free | |-- drivers-crypto-montage-tsse-tsse_fw_service.c:warning:no-previous-prototype-for-function-fw_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-get_msginf | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_hw_init | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_init_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_recieve_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-ipc_send_msg | |-- drivers-crypto-montage-tsse-tsse_ipc.c:warning:no-previous-prototype-for-function-msg_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:no-previous-prototype-for-function-service_rout | |-- drivers-crypto-montage-tsse-tsse_service.c:warning:variable-ret-set-but-not-used | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-i2c-busses-i2c-hisi.c:warning:expecting-prototype-for-i2c_dw_acpi_pin_mux_change().-Prototype-was-for-i2c_hisi_pin_mux_change()-instead | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used | |-- security-integrity-ima-ima_appraise.c:warning:no-previous-prototype-for-function-ima_get_hash_algo | `-- security-integrity-ima-ima_fs.c:warning:variable-ret-is-used-uninitialized-whenever-if-condition-is-true `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 978m configs tested: 16 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240306 gcc arm64 randconfig-002-20240306 clang arm64 randconfig-003-20240306 gcc arm64 randconfig-004-20240306 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240306 gcc loongarch randconfig-002-20240306 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-46984
by Li Nan 06 Mar '24

06 Mar '24

Li Nan (1): kyber: fix kabi broken in ->bio_merge() Omar Sandoval (1): kyber: fix out of bounds access when preempted block/kyber-iosched.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2021-47074
by Li Nan 06 Mar '24

06 Mar '24

Chaitanya Kulkarni (1): nvme-loop: don't put ctrl on nvme_init_ctrl error Wu Bo (1): nvme-loop: fix memory leak in nvme_loop_create_ctrl() drivers/nvme/target/loop.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/1] Fixed CVE-2023-52504
by Zheng Zengkai 06 Mar '24

06 Mar '24

Considering that CONFIG_X86_5LEVEL is enabled in openEuler-1.0-LTS, Backport 4.19.297 LTS patch to fix CVE-2023-52504. https://nvd.nist.gov/vuln/detail/CVE-2023-52504 Kirill A. Shutemov (1): x86/alternatives: Disable KASAN in apply_alternatives() arch/x86/kernel/alternative.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) -- 2.20.1

2 2

[PATCH openEuler-1.0-LTS 1/2] nvme-loop: don't put ctrl on nvme_init_ctrl error
by Li Nan 06 Mar '24

06 Mar '24

From: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> mainline inclusion from mainline-v5.10-rc1 commit 1401fcc4e3da97c44dcc7cbf538c07e24768d791 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I956G7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function nvme_init_ctrl() gets the ctrl reference & when it fails it does put the ctrl reference in the error unwind code. When creating loop ctrl in nvme_loop_create_ctrl() if nvme_init_ctrl() returns non zero (i.e. error) value it jumps to the "out_put_ctrl" label which calls nvme_put_ctrl(), that will lead to douple ctrl put in error unwind path. Update nvme_loop_create_ctrl() such that this patch removes the "out_put_ctrl" label, add a new "out" label after nvme_put_ctrl() in error unwind path and jump to newly added label when nvme_init_ctrl() call retuns an error. Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflict: Commit 64d452b3560b and b6cec06d19d9 changed context. Does not affect the logic of this patch. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/nvme/target/loop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c index 1eee21310dee..985479f10597 100644 --- a/drivers/nvme/target/loop.c +++ b/drivers/nvme/target/loop.c @@ -608,7 +608,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops, 0 /* no quirks, we're perfect! */); if (ret) - goto out_put_ctrl; + goto out; ret = -ENOMEM; @@ -661,8 +661,8 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, kfree(ctrl->queues); out_uninit_ctrl: nvme_uninit_ctrl(&ctrl->ctrl); -out_put_ctrl: nvme_put_ctrl(&ctrl->ctrl); +out: if (ret > 0) ret = -EIO; return ERR_PTR(ret); -- 2.39.2

2 2

[PATCH openEuler-1.0-LTS] soundwire: stream: fix memory leak in stream config error path
by Zhu Wang 06 Mar '24

06 Mar '24

From: Rander Wang <rander.wang(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit 48f17f96a81763c7c8bf5500460a359b9939359f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOP CVE: CVE-2021-47020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak. Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") Signed-off-by: Rander Wang <rander.wang(a)intel.com> Reviewed-by: Keyon Jie <yang.jie(a)intel.com> Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.inte… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- drivers/soundwire/stream.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 907a548645b7..42bc701e2304 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, } ret = sdw_config_stream(&slave->dev, stream, stream_config, true); - if (ret) + if (ret) { + /* + * sdw_release_master_stream will release s_rt in slave_rt_list in + * stream_error case, but s_rt is only added to slave_rt_list + * when sdw_config_stream is successful, so free s_rt explicitly + * when sdw_config_stream is failed. + */ + kfree(s_rt); goto stream_error; + } list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 1/1] soundwire: stream: fix memory leak in stream config error path
by Zhu Wang 06 Mar '24

06 Mar '24

From: Rander Wang <rander.wang(a)intel.com> mainline inclusion from mainline-v5.13-rc1 commit 48f17f96a81763c7c8bf5500460a359b9939359f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOP CVE: CVE-2021-47020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak. Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") Signed-off-by: Rander Wang <rander.wang(a)intel.com> Reviewed-by: Keyon Jie <yang.jie(a)intel.com> Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.inte… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- drivers/soundwire/stream.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 907a548645b7..42bc701e2304 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, } ret = sdw_config_stream(&slave->dev, stream, stream_config, true); - if (ret) + if (ret) { + /* + * sdw_release_master_stream will release s_rt in slave_rt_list in + * stream_error case, but s_rt is only added to slave_rt_list + * when sdw_config_stream is successful, so free s_rt explicitly + * when sdw_config_stream is failed. + */ + kfree(s_rt); goto stream_error; + } list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
by Zeng Heng 06 Mar '24

06 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95A33 CVE: NA ---------------------------------------- When the monitor is created, the configuration should follow its parent's configuration, instead of the last used configuration, or that would lead to misconfiguration of monitor group. Fixes: 08127bbfcfae ("mpam: update monitor rmid and group configuration") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 7659b29e6fe3..e89683a27a98 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -229,6 +229,8 @@ static void resctrl_group_resync_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, @@ -287,6 +289,8 @@ static void resctrl_group_update_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, -- 2.25.1

2 1

[PATCH OLK-5.10] mpam/mpam_ctrlmon: update monitor config with its parent's ctrl_val
by Zeng Heng 06 Mar '24

06 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I95A33 CVE: NA ---------------------------------------- When the monitor is created, the configuration should follow its parent's configuration, instead of the last used configuration, or that would lead to misconfiguration of monitor group. Fixes: 08127bbfcfae ("mpam: update monitor rmid and group configuration") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_ctrlmon.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/mpam/mpam_ctrlmon.c b/arch/arm64/kernel/mpam/mpam_ctrlmon.c index 08d7b002517d..dc9716b3fd5a 100644 --- a/arch/arm64/kernel/mpam/mpam_ctrlmon.c +++ b/arch/arm64/kernel/mpam/mpam_ctrlmon.c @@ -225,6 +225,8 @@ static void resctrl_group_resync_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, @@ -285,6 +287,8 @@ static void resctrl_group_update_domain_ctrls(struct rdtgroup *rdtgrp, * we should synchronize all child mon groups' * configuration from this ctrl rdtgrp */ + resctrl_cdp_mpamid_map_val(rdtgrp->closid.intpartid, + cfg[i].conf_type, closid.intpartid); head = &rdtgrp->mon.crdtgrp_list; list_for_each_entry(entry, head, mon.crdtgrp_list) { resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, -- 2.25.1

2 1

[PATCH v3 OLK-6.6 0/3] kworker: Fix the problem of ipsan performance degradation
by jiangdongxu 06 Mar '24

06 Mar '24

From: Shao Denghui <shaodenghui(a)huawei.com> When the current downstream FS tests IPSAN, it is found that the performance on ARM is much worse than that on X86, and the test data of IPSAN fluctuates greatly. After analysis, the reason is that when iscsi issues IO, the task is sent to kworker for processing by iscsi_xmitworker. The workqueue created by iscsi can automatically identify the CPU of the soft interrupt currently processed by iscsi, and automatically schedule the workqueue to the corresponding NUMA node. Shao Denghui (3): workqueue: add member for NUMA aware order workqueue and implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance Add kernel compilation configuration options Kconfig | 2 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/iscsi_tcp.c | 13 +++++++++++++ drivers/scsi/libiscsi.c | 24 ++++++++++++++++++++++-- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/workqueue.c | 21 +++++++++++++++++++-- lib/Kconfig.openeuler | 8 ++++++++ 9 files changed, 68 insertions(+), 4 deletions(-) create mode 100644 lib/Kconfig.openeuler -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS] bnxt_en: Fix RX consumer index logic in the error path.
by Ziyang Xuan 06 Mar '24

06 Mar '24

From: Michael Chan <michael.chan(a)broadcom.com> mainline inclusion from mainline-v5.13-rc1 commit bbd6f0a948139970f4a615dff189d9a503681a39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94J1Q CVE: CVE-2021-47015 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In bnxt_rx_pkt(), the RX buffers are expected to complete in order. If the RX consumer index indicates an out of order buffer completion, it means we are hitting a hardware bug and the driver will abort all remaining RX packets and reset the RX ring. The RX consumer index that we pass to bnxt_discard_rx() is not correct. We should be passing the current index (tmp_raw_cons) instead of the old index (raw_cons). This bug can cause us to be at the wrong index when trying to abort the next RX packet. It can crash like this: #0 [ffff9bbcdf5c39a8] machine_kexec at ffffffff9b05e007 #1 [ffff9bbcdf5c3a00] __crash_kexec at ffffffff9b111232 #2 [ffff9bbcdf5c3ad0] panic at ffffffff9b07d61e #3 [ffff9bbcdf5c3b50] oops_end at ffffffff9b030978 #4 [ffff9bbcdf5c3b78] no_context at ffffffff9b06aaf0 #5 [ffff9bbcdf5c3bd8] __bad_area_nosemaphore at ffffffff9b06ae2e #6 [ffff9bbcdf5c3c28] bad_area_nosemaphore at ffffffff9b06af24 #7 [ffff9bbcdf5c3c38] __do_page_fault at ffffffff9b06b67e #8 [ffff9bbcdf5c3cb0] do_page_fault at ffffffff9b06bb12 #9 [ffff9bbcdf5c3ce0] page_fault at ffffffff9bc015c5 [exception RIP: bnxt_rx_pkt+237] RIP: ffffffffc0259cdd RSP: ffff9bbcdf5c3d98 RFLAGS: 00010213 RAX: 000000005dd8097f RBX: ffff9ba4cb11b7e0 RCX: ffffa923cf6e9000 RDX: 0000000000000fff RSI: 0000000000000627 RDI: 0000000000001000 RBP: ffff9bbcdf5c3e60 R8: 0000000000420003 R9: 000000000000020d R10: ffffa923cf6ec138 R11: ffff9bbcdf5c3e83 R12: ffff9ba4d6f928c0 R13: ffff9ba4cac28080 R14: ffff9ba4cb11b7f0 R15: ffff9ba4d5a30000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 Fixes: a1b0e4e684e9 ("bnxt_en: Improve RX consumer index validity check.") Reviewed-by: Pavan Chebbi <pavan.chebbi(a)broadcom.com> Reviewed-by: Andy Gospodarek <gospo(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 2f61175f5655a..25104ad935404 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -1547,12 +1547,14 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_napi *bnapi, u32 *raw_cons, cons = rxcmp->rx_cmp_opaque; if (unlikely(cons != rxr->rx_next_cons)) { - int rc1 = bnxt_discard_rx(bp, bnapi, raw_cons, rxcmp); + int rc1 = bnxt_discard_rx(bp, bnapi, &tmp_raw_cons, rxcmp); netdev_warn(bp->dev, "RX cons %x != expected cons %x\n", cons, rxr->rx_next_cons); bnxt_sched_reset(bp, rxr); - return rc1; + if (rc1) + return rc1; + goto next_rx_no_prod_no_len; } rx_buf = &rxr->rx_buf_ring[cons]; data = rx_buf->data; -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] CVE-2023-52568
by Chen Ridong 06 Mar '24

06 Mar '24

*** BLURB HERE *** Haitao Huang (1): x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race arch/x86/kernel/cpu/sgx/encl.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] vt: fix memory overlapping when deleting chars in the buffer
by Yi Yang 06 Mar '24

06 Mar '24

From: Yangxi Xiang <xyangxi5(a)gmail.com> mainline inclusion from mainline-v5.19-rc7 commit 39cdb68c64d84e71a4a717000b6e5de208ee60cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ATI CVE: CVE-2022-48627 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buffer overlaps with the source buffer. The line buffer is not always broken, because the memcpy utilizes the hardware acceleration, whose result is not deterministic. Fix this problem by using replacing the scr_memcpyw with scr_memmovew. Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Signed-off-by: Yangxi Xiang <xyangxi5(a)gmail.com> Link: https://lore.kernel.org/r/20220628093322.5688-1-xyangxi5@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflicts: drivers/tty/vt/vt.c Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 20565603a365..163186cbfe79 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -855,7 +855,7 @@ static void delete_char(struct vc_data *vc, unsigned int nr) unsigned short *p = (unsigned short *) vc->vc_pos; vc_uniscr_delete(vc, nr); - scr_memcpyw(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2); + scr_memmovew(p, p + nr, (vc->vc_cols - vc->vc_x - nr) * 2); scr_memsetw(p + vc->vc_cols - vc->vc_x - nr, vc->vc_video_erase_char, nr * 2); vc->vc_need_wrap = 0; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] nvme-loop: fix memory leak in nvme_loop_create_ctrl()
by Li Nan 06 Mar '24

06 Mar '24

From: Wu Bo <wubo40(a)huawei.com> mainline inclusion from mainline-v5.13-rc3 commit 03504e3b54cc8118cc26c064e60a0b00c2308708 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I956G7 CVE: CVE-2021-47074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl() fails, the loop ctrl should be freed before jumping to the "out" label. Fixes: 3a85a5de29ea ("nvme-loop: add a NVMe loopback host driver") Signed-off-by: Wu Bo <wubo40(a)huawei.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflict: In mainline, commit 64d452b3560b and b6cec06d19d9 changed context. Does not affect the logic of this patch. Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/nvme/target/loop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c index 1eee21310dee..a8d15fd6ebe9 100644 --- a/drivers/nvme/target/loop.c +++ b/drivers/nvme/target/loop.c @@ -607,8 +607,10 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev, ret = nvme_init_ctrl(&ctrl->ctrl, dev, &nvme_loop_ctrl_ops, 0 /* no quirks, we're perfect! */); - if (ret) + if (ret) { + kfree(ctrl); goto out_put_ctrl; + } ret = -ENOMEM; -- 2.39.2

2 1

[PATCH OLK-5.10] ieee802154: ca8210: Fix a potential UAF in ca8210_probe
by Yu Liao 06 Mar '24

06 Mar '24

From: Dinghao Liu <dinghao.liu(a)zju.edu.cn> stable inclusion from stable-v5.10.199 commit 55e06850c7894f00d41b767c5f5665459f83f58f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95ASM CVE: CVE-2023-52510 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f990874b1c98fe8e57ee9385669f501822979258 ] If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca8210_probe() then calls ca8210_remove(), where priv->clk is freed again in ca8210_unregister_ext_clock(). In this case, a use-after-free may happen in the second time we call clk_unregister(). Fix this by removing the first clk_unregister(). Also, priv->clk could be an error code on failure of clk_register_fixed_rate(). Use IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock(). Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: Dinghao Liu <dinghao.liu(a)zju.edu.cn> Message-ID: <20231007033049.22353-1-dinghao.liu(a)zju.edu.cn> Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- drivers/net/ieee802154/ca8210.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index 1c5d70c60354..0ce426c0c0bf 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -2783,7 +2783,6 @@ static int ca8210_register_ext_clock(struct spi_device *spi) struct device_node *np = spi->dev.of_node; struct ca8210_priv *priv = spi_get_drvdata(spi); struct ca8210_platform_data *pdata = spi->dev.platform_data; - int ret = 0; if (!np) return -EFAULT; @@ -2800,18 +2799,8 @@ static int ca8210_register_ext_clock(struct spi_device *spi) dev_crit(&spi->dev, "Failed to register external clk\n"); return PTR_ERR(priv->clk); } - ret = of_clk_add_provider(np, of_clk_src_simple_get, priv->clk); - if (ret) { - clk_unregister(priv->clk); - dev_crit( - &spi->dev, - "Failed to register external clock as clock provider\n" - ); - } else { - dev_info(&spi->dev, "External clock set as clock provider\n"); - } - return ret; + return of_clk_add_provider(np, of_clk_src_simple_get, priv->clk); } /** @@ -2823,8 +2812,8 @@ static void ca8210_unregister_ext_clock(struct spi_device *spi) { struct ca8210_priv *priv = spi_get_drvdata(spi); - if (!priv->clk) - return + if (IS_ERR_OR_NULL(priv->clk)) + return; of_clk_del_provider(spi->dev.of_node); clk_unregister(priv->clk); -- 2.25.1

2 1

[PATCH OLK-5.10] net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
by Zhang Xiaoxu 06 Mar '24

06 Mar '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v5.10.198 commit 30bc4d7aebe33904b0f2d3aad4b4a9c6029ad0c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXT CVE: CVE-2023-52528 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e9c65989920f7c28775ec4e0c11b483910fb67b8 ] syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] BUG: KMSAN: uninit-value in smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 CPU: 0 PID: 8696 Comm: kworker/0:3 Not tainted 5.8.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 usbnet_probe+0x1152/0x3f90 drivers/net/usb/usbnet.c:1737 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Local variable ----buf.i87@smsc75xx_bind created at: __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 This issue is caused because usbnet_read_cmd() reads less bytes than requested (zero byte in the reproducer). In this case, 'buf' is not properly filled. This patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads less bytes than requested. Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") Reported-and-tested-by: syzbot+6966546b78d050bb0b5d(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6966546b78d050bb0b5d Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20230923173549.3284502-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/net/usb/smsc75xx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c index fb1389bd0939..6310841aeac7 100644 --- a/drivers/net/usb/smsc75xx.c +++ b/drivers/net/usb/smsc75xx.c @@ -90,7 +90,9 @@ static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index, ret = fn(dev, USB_VENDOR_REQUEST_READ_REGISTER, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, index, &buf, 4); - if (unlikely(ret < 0)) { + if (unlikely(ret < 4)) { + ret = ret < 0 ? ret : -ENODATA; + netdev_warn(dev->net, "Failed to read reg index 0x%08x: %d\n", index, ret); return ret; -- 2.34.1

2 1

[openeuler:OLK-6.6 2180/3862] kernel/sched/fair.c:8988:1: sparse: sparse: symbol 'qos_smt_expell_switch' was not declared. Should it be static?
by kernel test robot 06 Mar '24

06 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f44547cb66ee30ed552adb15046a912cd1409c1f commit: a62d532da0b51fe39f726c4c08f3debc8b3bc5d7 [2180/3862] sched/fair: Add cmdline nosmtexpell config: arm64-randconfig-r111-20240227 (https://download.01.org/0day-ci/archive/20240306/202403061134.XUPVJszR-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240306/202403061134.XUPVJszR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403061134.XUPVJszR-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/fair.c:151:14: sparse: sparse: symbol 'sysctl_overload_detect_period' was not declared. Should it be static? kernel/sched/fair.c:152:14: sparse: sparse: symbol 'sysctl_offline_wait_interval' was not declared. Should it be static? kernel/sched/fair.c:1284:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1284:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1284:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:13325:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:13325:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:13325:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:6038:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:6038:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:6038:22: sparse: struct task_struct * kernel/sched/fair.c:6780:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6780:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6780:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8163:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8163:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:8163:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8478:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8478:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8478:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8590:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8590:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8590:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8936:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:8936:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:8936:22: sparse: struct task_struct * >> kernel/sched/fair.c:8988:1: sparse: sparse: symbol 'qos_smt_expell_switch' was not declared. Should it be static? kernel/sched/fair.c:9122:51: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *sibling_p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9122:51: sparse: expected struct task_struct *sibling_p kernel/sched/fair.c:9122:51: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9127:30: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:9127:30: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:9127:30: sparse: struct task_struct * kernel/sched/fair.c:9205:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:9454:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:10525:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:11162:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:11162:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:11162:22: sparse: struct task_struct * kernel/sched/fair.c:12603:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12603:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12603:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12260:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12260:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:12260:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12699:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12699:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12699:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * kernel/sched/sched.h:2346:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2346:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2346:9: sparse: struct task_struct * kernel/sched/sched.h:2346:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2346:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2346:9: sparse: struct task_struct * kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * kernel/sched/sched.h:2182:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2182:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2182:25: sparse: struct task_struct * vim +/qos_smt_expell_switch +8988 kernel/sched/fair.c 8986 8987 #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER > 8988 DEFINE_STATIC_KEY_TRUE(qos_smt_expell_switch); 8989 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
by Ziyang Xuan 06 Mar '24

06 Mar '24

From: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> stable inclusion from stable-v4.19.191 commit 16d8c44be52e3650917736d45f5904384a9da834 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JI5 CVE: CVE-2021-47013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6d72e7c767acbbdd44ebc7d89c6690b405b32b57 ] In emac_mac_tx_buf_send, it calls emac_tx_fill_tpd(..,skb,..). If some error happens in emac_tx_fill_tpd(), the skb will be freed via dev_kfree_skb(skb) in error branch of emac_tx_fill_tpd(). But the freed skb is still used via skb->len by netdev_sent_queue(,skb->len). As i observed that emac_tx_fill_tpd() haven't modified the value of skb->len, thus my patch assigns skb->len to 'len' before the possible free and use 'len' instead of skb->len later. Fixes: b9b17debc69d2 ("net: emac: emac gigabit ethernet controller driver") Signed-off-by: Lv Yunlong <lyl2019(a)mail.ustc.edu.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c index 031f6e6ee9c17..351a906980103 100644 --- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c +++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c @@ -1449,6 +1449,7 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q, { struct emac_tpd tpd; u32 prod_idx; + int len; memset(&tpd, 0, sizeof(tpd)); @@ -1468,9 +1469,10 @@ int emac_mac_tx_buf_send(struct emac_adapter *adpt, struct emac_tx_queue *tx_q, if (skb_network_offset(skb) != ETH_HLEN) TPD_TYP_SET(&tpd, 1); + len = skb->len; emac_tx_fill_tpd(adpt, tx_q, skb, &tpd); - netdev_sent_queue(adpt->netdev, skb->len); + netdev_sent_queue(adpt->netdev, len); /* Make sure the are enough free descriptors to hold one * maximum-sized SKB. We need one desc for each fragment, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
by felix 06 Mar '24

06 Mar '24

From: Qinglang Miao <miaoqinglang(a)huawei.com> stable inclusion from stable-v5.10.37 commit e80ae8bde41266d3b8bf012460b6593851766006 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JR1 CVE: CVE-2020-36783 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 223125e37af8a641ea4a09747a6a52172fc4b903 ] The PM reference count is not expected to be incremented on return in functions img_i2c_xfer and img_i2c_init. However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. Fixes: 93222bd9b966 ("i2c: img-scb: Add runtime PM") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang(a)huawei.com> Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- drivers/i2c/busses/i2c-img-scb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-img-scb.c b/drivers/i2c/busses/i2c-img-scb.c index f038858b6c54..fecafb6493e2 100644 --- a/drivers/i2c/busses/i2c-img-scb.c +++ b/drivers/i2c/busses/i2c-img-scb.c @@ -1060,7 +1060,7 @@ static int img_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, atomic = true; } - ret = pm_runtime_get_sync(adap->dev.parent); + ret = pm_runtime_resume_and_get(adap->dev.parent); if (ret < 0) return ret; @@ -1161,7 +1161,7 @@ static int img_i2c_init(struct img_i2c *i2c) u32 rev; int ret; - ret = pm_runtime_get_sync(i2c->adap.dev.parent); + ret = pm_runtime_resume_and_get(i2c->adap.dev.parent); if (ret < 0) return ret; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] soundwire: stream: fix memory leak in stream config error path
by Zhu Wang 06 Mar '24

06 Mar '24

mainline inclusion from mainline-v5.13-rc1 commit 48f17f96a81763c7c8bf5500460a359b9939359f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94VOP CVE: CVE-2021-47020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When stream config is failed, master runtime will release all slave runtime in the slave_rt_list, but slave runtime is not added to the list at this time. This patch frees slave runtime in the config error path to fix the memory leak. Fixes: 89e590535f32 ("soundwire: Add support for SoundWire stream management") Signed-off-by: Rander Wang <rander.wang(a)intel.com> Reviewed-by: Keyon Jie <yang.jie(a)intel.com> Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski(a)linux.intel.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart(a)linux.intel.com> Signed-off-by: Bard Liao <yung-chuan.liao(a)linux.intel.com> Link: https://lore.kernel.org/r/20210331004610.12242-1-yung-chuan.liao@linux.inte… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Zhu Wang <wangzhu9(a)huawei.com> --- drivers/soundwire/stream.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index 907a548645b7..42bc701e2304 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -1182,8 +1182,16 @@ int sdw_stream_add_slave(struct sdw_slave *slave, } ret = sdw_config_stream(&slave->dev, stream, stream_config, true); - if (ret) + if (ret) { + /* + * sdw_release_master_stream will release s_rt in slave_rt_list in + * stream_error case, but s_rt is only added to slave_rt_list + * when sdw_config_stream is successful, so free s_rt explicitly + * when sdw_config_stream is failed. + */ + kfree(s_rt); goto stream_error; + } list_add_tail(&s_rt->m_rt_node, &m_rt->slave_rt_list); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
by Zhang Xiaoxu 06 Mar '24

06 Mar '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v4.19.296 commit 2a36d9e2995c8c3c3f179aab1215a69cff06cbed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXT CVE: CVE-2023-52528 -------------------------------- [ Upstream commit e9c65989920f7c28775ec4e0c11b483910fb67b8 ] syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] BUG: KMSAN: uninit-value in smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 CPU: 0 PID: 8696 Comm: kworker/0:3 Not tainted 5.8.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline] smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 usbnet_probe+0x1152/0x3f90 drivers/net/usb/usbnet.c:1737 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241 usb_probe_device+0x311/0x490 drivers/usb/core/driver.c:272 really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_new_device+0x1bd4/0x2a30 drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269 worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Local variable ----buf.i87@smsc75xx_bind created at: __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 This issue is caused because usbnet_read_cmd() reads less bytes than requested (zero byte in the reproducer). In this case, 'buf' is not properly filled. This patch fixes the issue by returning -ENODATA if usbnet_read_cmd() reads less bytes than requested. Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") Reported-and-tested-by: syzbot+6966546b78d050bb0b5d(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6966546b78d050bb0b5d Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20230923173549.3284502-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/net/usb/smsc75xx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c index ec287c9741e8..ef8589e3a6d1 100644 --- a/drivers/net/usb/smsc75xx.c +++ b/drivers/net/usb/smsc75xx.c @@ -102,7 +102,9 @@ static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index, ret = fn(dev, USB_VENDOR_REQUEST_READ_REGISTER, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, 0, index, &buf, 4); - if (unlikely(ret < 0)) { + if (unlikely(ret < 4)) { + ret = ret < 0 ? ret : -ENODATA; + netdev_warn(dev->net, "Failed to read reg index 0x%08x: %d\n", index, ret); return ret; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 13475/21720] net/can/j1939/main.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Mar '24

06 Mar '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba030414a07b34111e8786469740412351906964 commit: e0c2ee9edcacfdda0e806166eaec1310cdf9e324 [13475/21720] can: add support of SAE J1939 protocol config: x86_64-buildonly-randconfig-003-20240224 (https://download.01.org/0day-ci/archive/20240306/202403061005.3SMjwiSq-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240306/202403061005.3SMjwiSq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403061005.3SMjwiSq-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/can/j1939/main.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] CVE-2021-47028
by Ziyang Xuan 06 Mar '24

06 Mar '24

Patchset for CVE-2021-47028. Ryder Lee (2): mt76: mt7915: rename mt7915_mcu_get_rate_info to mt7915_mcu_get_tx_rate mt76: mt7915: fix txrate reporting .../net/wireless/mediatek/mt76/mt7915/mac.c | 2 +- .../net/wireless/mediatek/mt76/mt7915/mcu.c | 44 ++++++++++++------- .../wireless/mediatek/mt76/mt7915/mt7915.h | 2 +- 3 files changed, 29 insertions(+), 19 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
by ZhaoLong Wang 06 Mar '24

06 Mar '24

From: Pan Bian <bianpan2016(a)163.com> stable inclusion from stable-v4.19.296 commit bb61224f6abc8e71bfdf06d7c984e23460875f5b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AT5 CVE: CVE-2023-52566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke(a)gmail.com: NOTE added to the commit log] Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163… Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") Signed-off-by: Pan Bian <bianpan2016(a)163.com> Reported-by: Ferry Meng <mengferry(a)linux.alibaba.com> Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.c… Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/nilfs2/gcinode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/gcinode.c b/fs/nilfs2/gcinode.c index aa3c328ee189..719fcc67b93d 100644 --- a/fs/nilfs2/gcinode.c +++ b/fs/nilfs2/gcinode.c @@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, struct the_nilfs *nilfs = inode->i_sb->s_fs_info; err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); - if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ - brelse(bh); + if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ goto failed; - } } lock_buffer(bh); @@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struct inode *inode, sector_t blkoff, failed: unlock_page(bh->b_page); put_page(bh->b_page); + if (unlikely(err)) + brelse(bh); return err; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/6] Some optimision and bugfix for dynamic affinity
by Hui Tang 06 Mar '24

06 Mar '24

Some optimision, feature and bugfix for dynamic affinity as follows: Hui Tang (6): sched: Reorganize the code of dynamic affnity and smart grid sched: Add 'affinity_preferred_nodes' for smart grid sched: Add 'affinity_util_low_pct' for task group sched: fix ping-pang for domain level adjust sched: Check preferred_nmask is valid sched: fix mem_preferred_node_mask not update fs/proc/array.c | 10 - include/linux/sched.h | 34 +- include/linux/sched/dynamic_affinity.h | 38 ++ kernel/sched/core.c | 166 +----- kernel/sched/dynamic_affinity.c | 775 +++++++++++++++++++++++++ kernel/sched/dynamic_affinity.h | 53 ++ kernel/sched/fair.c | 584 +------------------ kernel/sched/grid/qos.c | 6 +- kernel/sched/sched.h | 47 +- kernel/sysctl.c | 7 + mm/mempolicy.c | 6 + 11 files changed, 915 insertions(+), 811 deletions(-) create mode 100644 include/linux/sched/dynamic_affinity.h create mode 100644 kernel/sched/dynamic_affinity.c create mode 100644 kernel/sched/dynamic_affinity.h -- 2.34.1

2 7