- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
by Baokun Li 26 Feb '24

26 Feb '24

From: Osama Muhammad <osmtendev(a)gmail.com> stable inclusion from stable-v6.6.14 commit 067a7c48c2c70f05f9460d6f0e8423e234729f05 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I93ODT CVE: CVE-2023-52448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ] Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that. Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found") Signed-off-by: Osama Muhammad <osmtendev(a)gmail.com> Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c index 9308190895c8..307b952a41f8 100644 --- a/fs/gfs2/rgrp.c +++ b/fs/gfs2/rgrp.c @@ -2306,7 +2306,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd, (unsigned long long)rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt); - if (rgd->rd_sbd->sd_args.ar_rgrplvb) { + if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) { struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf, -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
by ZhaoLong Wang 26 Feb '24

26 Feb '24

stable inclusion from stable-v4.19.306 commit aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022 category: bugfix bugzilla: 189540, https://gitee.com/src-openeuler/kernel/issues/I932W5 CVE: CVE-2023-52449 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@… [2] Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Acked-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@hu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 29c0bfd74e8a..40b2cbd8a0b5 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -521,7 +521,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -564,7 +564,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mutex_unlock(&mtd_table_mutex); -- 2.39.2

2 1

[PATCH OLK-5.10] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
by ZhaoLong Wang 26 Feb '24

26 Feb '24

stable inclusion from stable-v5.10.209 commit 001a3f59d8c914ef8273461d4bf495df384cc5f8 category: bugfix bugzilla: 189540, https://gitee.com/src-openeuler/kernel/issues/I932W5 CVE: CVE-2023-52449 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@… [2] Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Acked-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@hu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/mtd/mtd_blkdevs.c Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 5b5504e123a6..3c79cd67478a 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -527,7 +527,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -570,7 +570,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mtd_table_mutex_unlock(); -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 3 --- kernel/sched/wait.c | 59 ++++++++------------------------------------ mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 72 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/1] i2c: i801: Fix block process call transactions
by Liao Chen 26 Feb '24

26 Feb '24

According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once again before reading the incoming data from the buffer. The driver is currently missing the second reset, causing the wrong portion of the block buffer to be read. Jean Delvare (1): i2c: i801: Fix block process call transactions drivers/i2c/busses/i2c-i801.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
by ZhaoLong Wang 26 Feb '24

26 Feb '24

stable inclusion from stable-v4.19.306 commit aeba358bcc8ffddf9b4a9bd0e5ec9eb338d46022 category: bugfix bugzilla: 189540 CVE: CVE-2023-52449 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ] If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read(). ubi_gluebi_init ubi_register_volume_notifier ubi_enumerate_volumes ubi_notify_all gluebi_notify nb->notifier_call() gluebi_create mtd_device_register mtd_device_parse_register add_mtd_device blktrans_notify_add not->add() ftl_add_mtd tr->add_mtd() scan_header mtd_read mtd_read_oob mtd_read_oob_std gluebi_read mtd->read() gluebi->desc - NULL Detailed reproduction information available at the Link [1], In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference. The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME. Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1] Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@… [2] Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Acked-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@hu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 29c0bfd74e8a..40b2cbd8a0b5 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -521,7 +521,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) { struct mtd_blktrans_ops *tr; - if (mtd->type == MTD_ABSENT) + if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME) return; list_for_each_entry(tr, &blktrans_majors, list) @@ -564,7 +564,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) list_add(&tr->list, &blktrans_majors); mtd_for_each_device(mtd) - if (mtd->type != MTD_ABSENT) + if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME) tr->add_mtd(tr, mtd); mutex_unlock(&mtd_table_mutex); -- 2.39.2

2 1

[PATCH OLK-5.10] efivarfs: force RO when remounting if SetVariable is not supported
by Zhihao Cheng 26 Feb '24

26 Feb '24

From: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> stable inclusion from stable-v5.10.210 commit 94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC7 CVE: CVE-2023-52463 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0e8d2444168dd519fea501599d150e62718ed2fe upstream. If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") Signed-off-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/efivarfs/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c index 15880a68faad..3626816b174a 100644 --- a/fs/efivarfs/super.c +++ b/fs/efivarfs/super.c @@ -13,6 +13,7 @@ #include <linux/ucs2_string.h> #include <linux/slab.h> #include <linux/magic.h> +#include <linux/printk.h> #include "internal.h" @@ -231,8 +232,19 @@ static int efivarfs_get_tree(struct fs_context *fc) return get_tree_single(fc, efivarfs_fill_super); } +static int efivarfs_reconfigure(struct fs_context *fc) +{ + if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { + pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); + return -EINVAL; + } + + return 0; +} + static const struct fs_context_operations efivarfs_context_ops = { .get_tree = efivarfs_get_tree, + .reconfigure = efivarfs_reconfigure, }; static int efivarfs_init_fs_context(struct fs_context *fc) -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS v2] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum.h drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 5 +++++ drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 3 ++- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h index 3cdb7aca90b7..7d2978223c16 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h @@ -491,6 +491,7 @@ enum mlxsw_sp_acl_profile { }; struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl); +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl); struct mlxsw_sp *mlxsw_sp_acl_block_mlxsw_sp(struct mlxsw_sp_acl_block *block); unsigned int mlxsw_sp_acl_block_rule_count(struct mlxsw_sp_acl_block *block); void mlxsw_sp_acl_block_disable_inc(struct mlxsw_sp_acl_block *block); diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c index c99f5542da1e..22ba0600ccb5 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c @@ -38,6 +38,11 @@ struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) return acl->afk; } +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl) +{ + return &acl->tcam; +} + struct mlxsw_sp_acl_block_binding { struct list_head list; struct net_device *dev; diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..1c961fd5cffa 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -571,12 +571,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = mlxsw_sp_acl_to_tcam(mlxsw_sp->acl); const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); mlxsw_afk_key_info_put(region->key_info); kfree(region); } -- 2.34.1

2 1

[PATCH OLK-6.6] efivarfs: force RO when remounting if SetVariable is not supported
by Zhihao Cheng 26 Feb '24

26 Feb '24

From: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> stable inclusion from stable-v6.6.14 commit 0049fe7e4a85849bdd778cdb72e51a791ff3d737 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC7 CVE: CVE-2023-52463 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 0e8d2444168dd519fea501599d150e62718ed2fe upstream. If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") Signed-off-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/efivarfs/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c index 996271473609..05c01694e852 100644 --- a/fs/efivarfs/super.c +++ b/fs/efivarfs/super.c @@ -14,6 +14,7 @@ #include <linux/slab.h> #include <linux/magic.h> #include <linux/statfs.h> +#include <linux/printk.h> #include "internal.h" @@ -275,8 +276,19 @@ static int efivarfs_get_tree(struct fs_context *fc) return get_tree_single(fc, efivarfs_fill_super); } +static int efivarfs_reconfigure(struct fs_context *fc) +{ + if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { + pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); + return -EINVAL; + } + + return 0; +} + static const struct fs_context_operations efivarfs_context_ops = { .get_tree = efivarfs_get_tree, + .reconfigure = efivarfs_reconfigure, }; static int efivarfs_init_fs_context(struct fs_context *fc) -- 2.31.1

2 1

[PATCH OLK-5.10] efivarfs: force RO when remounting if SetVariable is not supported
by Zhihao Cheng 26 Feb '24

26 Feb '24

From: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> stable inclusion from stable-v5.10.210 commit 94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8 category: bugfix bugzilla: 189543 CVE: CVE-2023-52463 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0e8d2444168dd519fea501599d150e62718ed2fe upstream. If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction") Signed-off-by: Ilias Apalodimas <ilias.apalodimas(a)linaro.org> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/efivarfs/super.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c index 15880a68faad..3626816b174a 100644 --- a/fs/efivarfs/super.c +++ b/fs/efivarfs/super.c @@ -13,6 +13,7 @@ #include <linux/ucs2_string.h> #include <linux/slab.h> #include <linux/magic.h> +#include <linux/printk.h> #include "internal.h" @@ -231,8 +232,19 @@ static int efivarfs_get_tree(struct fs_context *fc) return get_tree_single(fc, efivarfs_fill_super); } +static int efivarfs_reconfigure(struct fs_context *fc) +{ + if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) { + pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n"); + return -EINVAL; + } + + return 0; +} + static const struct fs_context_operations efivarfs_context_ops = { .get_tree = efivarfs_get_tree, + .reconfigure = efivarfs_reconfigure, }; static int efivarfs_init_fs_context(struct fs_context *fc) -- 2.31.1

2 1

[PATCH openEuler-22.03-LTS] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 2 -- kernel/sched/wait.c | 59 ++++++++------------------------------------ mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 71 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 v2] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum.h drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c | 5 +++++ drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h index 3e7576e671df..a4e229210b93 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h @@ -850,6 +850,7 @@ enum mlxsw_sp_acl_profile { }; struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl); +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl); int mlxsw_sp_acl_ruleset_bind(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_flow_block *block, diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c index 8cfa03a75374..9209562a5007 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl.c @@ -40,6 +40,11 @@ struct mlxsw_afk *mlxsw_sp_acl_afk(struct mlxsw_sp_acl *acl) return acl->afk; } +struct mlxsw_sp_acl_tcam *mlxsw_sp_acl_to_tcam(struct mlxsw_sp_acl *acl) +{ + return &acl->tcam; +} + struct mlxsw_sp_acl_ruleset_ht_key { struct mlxsw_sp_flow_block *block; u32 chain_index; diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 7cccc41dd69c..ddf7e03c6b43 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -744,13 +744,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = mlxsw_sp_acl_to_tcam(mlxsw_sp->acl); const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, - region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); kfree(region); } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS] ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
by Yuntao Liu 26 Feb '24

26 Feb '24

From: Tuo Li <islituo(a)gmail.com> stable inclusion from stable-v5.10.192 commit 9f9eed451176ffcac6b5ba0f6dae1a6b4a1cb0eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I917HR CVE: CVE-2024-23196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ] The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck <bass(a)buaa.edu.cn> Signed-off-by: Tuo Li <islituo(a)gmail.com> Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/sound/hda/hdac_regmap.c b/sound/hda/hdac_regmap.c index f258cb3a6895..9b1bcabd8414 100644 --- a/sound/hda/hdac_regmap.c +++ b/sound/hda/hdac_regmap.c @@ -596,10 +596,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once); */ void snd_hdac_regmap_sync(struct hdac_device *codec) { - if (codec->regmap) { - mutex_lock(&codec->regmap_lock); + mutex_lock(&codec->regmap_lock); + if (codec->regmap) regcache_sync(codec->regmap); - mutex_unlock(&codec->regmap_lock); - } + mutex_unlock(&codec->regmap_lock); } EXPORT_SYMBOL_GPL(snd_hdac_regmap_sync); -- 2.34.1

2 1

[PATCH OLK-5.10 0/6] CVE-2024-26586
by Liu Jian 26 Feb '24

26 Feb '24

backport the fix patches from 5.10lts Amit Cohen (1): mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Christophe JAILLET (1): mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable Ido Schimmel (4): mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() mlxsw: spectrum_acl_tcam: Make fini symmetric to init mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations mlxsw: spectrum_acl_tcam: Fix stack corruption .../mellanox/mlxsw/spectrum_acl_atcam.c | 8 +- .../mellanox/mlxsw/spectrum_acl_erp.c | 8 +- .../mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++++++--------- .../ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +- .../mellanox/mlxsw/spectrum_switchdev.c | 11 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++++++++- 6 files changed, 187 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 26 Feb '24

26 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 9 +++---- kernel/sched/wait.c | 60 ++++++++------------------------------------ mm/filemap.c | 21 +--------------- 3 files changed, 14 insertions(+), 76 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 7cccc41dd69c..a7689cdd1efc 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -744,13 +744,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = &mlxsw_sp->acl->tcam; const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, - region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); kfree(region); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
by Zhengchao Shao 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EE7 CVE: CVE-2024-26595 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: 22a677661f56 ("mlxsw: spectrum: Introduce ACL core with simple TCAM implementation") Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/fb6a4542bbc9fcab5a523802d97059bffbca7126.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..7ce670e71a7c 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -571,12 +571,13 @@ static void mlxsw_sp_acl_tcam_region_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_acl_tcam_region *region) { + struct mlxsw_sp_acl_tcam *tcam = &mlxsw_sp->acl->tcam; const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops; ops->region_fini(mlxsw_sp, region->priv); mlxsw_sp_acl_tcam_region_disable(mlxsw_sp, region); mlxsw_sp_acl_tcam_region_free(mlxsw_sp, region); - mlxsw_sp_acl_tcam_region_id_put(region->group->tcam, region->id); + mlxsw_sp_acl_tcam_region_id_put(tcam, region->id); mlxsw_afk_key_info_put(region->key_info); kfree(region); } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 14777/21632] drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 26 Feb '24

26 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [14777/21632] scsi/hifc: add hifc driver FC service module config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240226/202402261420.bgeVvnXn-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240226/202402261420.bgeVvnXn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402261420.bgeVvnXn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/scsi/huawei/hifc/hifc_hwif.c:27:16: sparse: sparse: cast to restricted __be32 drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: expected unsigned int val drivers/scsi/huawei/hifc/hifc_hwif.c:32:16: sparse: got restricted __be32 [usertype] drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/scsi/huawei/hifc/hifc_hwif.c:453:29: sparse: got void *cfg_reg_base drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/scsi/huawei/hifc/hifc_hwif.c:454:30: sparse: got void *intr_reg_base drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/scsi/huawei/hifc/hifc_hwif.c:457:23: sparse: got void *db_base >> drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: expected restricted gfp_t [usertype] flag drivers/scsi/huawei/hifc/hifc_hwif.c:517:65: sparse: got unsigned int flag drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: expected restricted gfp_t [usertype] flag drivers/scsi/huawei/hifc/hifc_hwif.c:532:65: sparse: got unsigned int flag In file included from drivers/scsi/huawei/hifc/hifc_hwif.c:14: In file included from drivers/scsi/huawei/hifc/hifc_knl_adp.h:30: In file included from include/scsi/scsi_host.h:12: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'intr_reg_base' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'db_base_phy' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'db_base' not described in 'hifc_init_hwif' drivers/scsi/huawei/hifc/hifc_hwif.c:442: warning: Function parameter or member 'dwqe_mapping' not described in 'hifc_init_hwif' vim +517 drivers/scsi/huawei/hifc/hifc_hwif.c 218105be120513 Chenguangli 2020-11-16 508 218105be120513 Chenguangli 2020-11-16 509 int hifc_dma_zalloc_coherent_align(void *dev_hdl, u64 size, u64 align, 218105be120513 Chenguangli 2020-11-16 510 unsigned flag, 218105be120513 Chenguangli 2020-11-16 511 struct hifc_dma_addr_align *mem_align) 218105be120513 Chenguangli 2020-11-16 512 { 218105be120513 Chenguangli 2020-11-16 513 void *vaddr, *align_vaddr; 218105be120513 Chenguangli 2020-11-16 514 dma_addr_t paddr, align_paddr; 218105be120513 Chenguangli 2020-11-16 515 u64 real_size = size; 218105be120513 Chenguangli 2020-11-16 516 218105be120513 Chenguangli 2020-11-16 @517 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 218105be120513 Chenguangli 2020-11-16 518 if (!vaddr) 218105be120513 Chenguangli 2020-11-16 519 return -ENOMEM; 218105be120513 Chenguangli 2020-11-16 520 218105be120513 Chenguangli 2020-11-16 521 align_paddr = ALIGN(paddr, align); 218105be120513 Chenguangli 2020-11-16 522 /* align */ 218105be120513 Chenguangli 2020-11-16 523 if (align_paddr == paddr) { 218105be120513 Chenguangli 2020-11-16 524 align_vaddr = vaddr; 218105be120513 Chenguangli 2020-11-16 525 goto out; 218105be120513 Chenguangli 2020-11-16 526 } 218105be120513 Chenguangli 2020-11-16 527 218105be120513 Chenguangli 2020-11-16 528 dma_free_coherent(dev_hdl, real_size, vaddr, paddr); 218105be120513 Chenguangli 2020-11-16 529 218105be120513 Chenguangli 2020-11-16 530 /* realloc memory for align */ 218105be120513 Chenguangli 2020-11-16 531 real_size = size + align; 218105be120513 Chenguangli 2020-11-16 532 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 218105be120513 Chenguangli 2020-11-16 533 if (!vaddr) 218105be120513 Chenguangli 2020-11-16 534 return -ENOMEM; 218105be120513 Chenguangli 2020-11-16 535 218105be120513 Chenguangli 2020-11-16 536 align_paddr = ALIGN(paddr, align); 218105be120513 Chenguangli 2020-11-16 537 align_vaddr = (void *)((u64)vaddr + (align_paddr - paddr)); 218105be120513 Chenguangli 2020-11-16 538 218105be120513 Chenguangli 2020-11-16 539 out: 218105be120513 Chenguangli 2020-11-16 540 mem_align->real_size = (u32)real_size; 218105be120513 Chenguangli 2020-11-16 541 mem_align->ori_vaddr = vaddr; 218105be120513 Chenguangli 2020-11-16 542 mem_align->ori_paddr = paddr; 218105be120513 Chenguangli 2020-11-16 543 mem_align->align_vaddr = align_vaddr; 218105be120513 Chenguangli 2020-11-16 544 mem_align->align_paddr = align_paddr; 218105be120513 Chenguangli 2020-11-16 545 218105be120513 Chenguangli 2020-11-16 546 return 0; 218105be120513 Chenguangli 2020-11-16 547 } 218105be120513 Chenguangli 2020-11-16 548 :::::: The code at line 517 was first introduced by commit :::::: 218105be120513109ae9ea5418c10586913274d4 scsi/hifc: add hifc driver chip resource module :::::: TO: Chenguangli <chenguangli2(a)huawei.com> :::::: CC: Yang Yingliang <yangyingliang(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mlxsw: spectrum_acl_tcam: Fix stack corruption
by Liu Jian 26 Feb '24

26 Feb '24

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.8-rc1 commit 483ae90d8f976f8339cf81066312e1329f2d3706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932WD CVE: CVE-2024-26586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash when this condition is hit. [1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") Reported-by: Orel Hagag <orelh(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: Petr Machata <petrm(a)nvidia.com> Acked-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://lore.kernel.org/r/2d91c89afba59c22587b444994ae419dbea8d876.17055020… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh --- .../mellanox/mlxsw/spectrum_acl_tcam.c | 2 + .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 56 ++++++++++++++++++- 2 files changed, 57 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c index 30931a2c025b..d4ddea426939 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c @@ -57,6 +57,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp, tcam->max_groups = max_groups; tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUP_SIZE); + tcam->max_group_size = min_t(unsigned int, tcam->max_group_size, + MLXSW_REG_PAGT_ACL_MAX_NUM); err = ops->init(mlxsw_sp, tcam->priv, tcam); if (err) diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh index 3b75180f455d..61f0ce8454e0 100755 --- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh +++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh @@ -8,7 +8,7 @@ lib_dir=$(dirname $0)/../../../../net/forwarding ALL_TESTS="single_mask_test identical_filters_test two_masks_test \ - multiple_masks_test ctcam_edge_cases_test" + multiple_masks_test ctcam_edge_cases_test max_group_size_test" NUM_NETIFS=2 source $lib_dir/tc_common.sh source $lib_dir/lib.sh @@ -324,6 +324,60 @@ ctcam_edge_cases_test() ctcam_no_atcam_masks_test } +max_group_size_test() +{ + # The number of ACLs in an ACL group is limited. Once the maximum + # number of ACLs has been reached, filters cannot be added. This test + # verifies that when this limit is reached, insertion fails without + # crashing. + + RET=0 + + local num_acls=32 + local max_size + local ret + + if [[ "$tcflags" != "skip_sw" ]]; then + return 0; + fi + + for ((i=1; i < $num_acls; i++)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter add dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter add dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + + ret=$? + [[ $ret -ne 0 ]] && max_size=$((i - 1)) && break + done + + # We expect to exceed the maximum number of ACLs in a group, so that + # insertion eventually fails. Otherwise, the test should be adjusted to + # add more filters. + check_fail $ret "expected to exceed number of ACLs in a group" + + for ((; i >= 1; i--)); do + if [[ $(( i % 2 )) == 1 ]]; then + tc filter del dev $h2 ingress pref $i proto ipv4 \ + flower $tcflags dst_ip 198.51.100.1/32 \ + ip_proto tcp tcp_flags 0x01/0x01 \ + action drop &> /dev/null + else + tc filter del dev $h2 ingress pref $i proto ipv6 \ + flower $tcflags dst_ip 2001:db8:1::1/128 \ + action drop &> /dev/null + fi + done + + log_test "max ACL group size test ($tcflags). max size $max_size" +} + setup_prepare() { h1=${NETIFS[p1]} -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/1] backport patch to fix CVE vulnerabilities from olk-6.6
by Yuntao Liu 26 Feb '24

26 Feb '24

patch to fix CVE-2024-23196. Tuo Li (1): ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2023-52435
by Ziyang Xuan 26 Feb '24

26 Feb '24

v3: - Add fixes tag for patch 2. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] kvm: kabi: KABI reservation for RME
by Guangwei Zhou 26 Feb '24

26 Feb '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I92TT5 CVE: NA ---------------------------------------------------------------------- Reserve KABI for struct kvm_arch and struct kvm_vcpu_arch for ARMv9 RME feature. Signed-off-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index 993b60d7219d..7c34e0b0b875 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -27,6 +27,7 @@ #include <asm/fpsimd.h> #include <asm/kvm.h> #include <asm/kvm_asm.h> +#include <linux/kabi.h> #define __KVM_HAVE_ARCH_INTC_INITIALIZED @@ -286,6 +287,15 @@ struct kvm_arch { cpumask_var_t sched_cpus; /* Union of all vcpu's cpus_ptr */ u64 tlbi_dvmbm; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct kvm_vcpu_fault_info { @@ -604,6 +614,26 @@ struct kvm_vcpu_arch { cpumask_var_t sched_cpus; cpumask_var_t pre_sched_cpus; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) }; /* -- 2.33.0

2 1

[PATCH OLK-6.6] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.14 commit d3c0b49aaa12a61d560528f5d605029ab57f0728 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 193b22a2d6bf..02d9c47797be 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1106,7 +1106,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v5.10.209 commit 6f866885e147d33efc497f1095f35b2ee5ec7310 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 72b109685db4..99e4ec48d2a4 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1066,7 +1066,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

1 0

[openeuler:openEuler-1.0-LTS 13425/21632] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 90f09a01314abe26de1a722d1b51c351d84e1f5b [13425/21632] net/hinic: Add support for X86 Arch config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402252031.ls64imy6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: expected unsigned int val drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:970:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:979:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'intr_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base_phy' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'dwqe_mapping' not described in 'hinic_init_hwif' vim +649 drivers/net/ethernet/huawei/hinic/hinic_hwif.c 746ea35981b1f7 Xue 2019-01-30 640 746ea35981b1f7 Xue 2019-01-30 641 int hinic_dma_zalloc_coherent_align(void *dev_hdl, u64 size, u64 align, 746ea35981b1f7 Xue 2019-01-30 642 unsigned int flag, 746ea35981b1f7 Xue 2019-01-30 643 struct hinic_dma_addr_align *mem_align) 746ea35981b1f7 Xue 2019-01-30 644 { 746ea35981b1f7 Xue 2019-01-30 645 void *vaddr, *align_vaddr; 746ea35981b1f7 Xue 2019-01-30 646 dma_addr_t paddr, align_paddr; 746ea35981b1f7 Xue 2019-01-30 647 u64 real_size = size; 746ea35981b1f7 Xue 2019-01-30 648 746ea35981b1f7 Xue 2019-01-30 @649 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 650 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 651 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 652 746ea35981b1f7 Xue 2019-01-30 653 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 654 /* align */ 746ea35981b1f7 Xue 2019-01-30 655 if (align_paddr == paddr) { 746ea35981b1f7 Xue 2019-01-30 656 align_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 657 goto out; 746ea35981b1f7 Xue 2019-01-30 658 } 746ea35981b1f7 Xue 2019-01-30 659 746ea35981b1f7 Xue 2019-01-30 660 dma_free_coherent(dev_hdl, real_size, vaddr, paddr); 746ea35981b1f7 Xue 2019-01-30 661 746ea35981b1f7 Xue 2019-01-30 662 /* realloc memory for align */ 746ea35981b1f7 Xue 2019-01-30 663 real_size = size + align; 746ea35981b1f7 Xue 2019-01-30 664 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 665 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 666 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 667 746ea35981b1f7 Xue 2019-01-30 668 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 669 align_vaddr = (void *)((u64)vaddr + (align_paddr - paddr)); 746ea35981b1f7 Xue 2019-01-30 670 746ea35981b1f7 Xue 2019-01-30 671 out: 746ea35981b1f7 Xue 2019-01-30 672 mem_align->real_size = (u32)real_size; 746ea35981b1f7 Xue 2019-01-30 673 mem_align->ori_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 674 mem_align->ori_paddr = paddr; 746ea35981b1f7 Xue 2019-01-30 675 mem_align->align_vaddr = align_vaddr; 746ea35981b1f7 Xue 2019-01-30 676 mem_align->align_paddr = align_paddr; 746ea35981b1f7 Xue 2019-01-30 677 746ea35981b1f7 Xue 2019-01-30 678 return 0; 746ea35981b1f7 Xue 2019-01-30 679 } 746ea35981b1f7 Xue 2019-01-30 680 :::::: The code at line 649 was first introduced by commit :::::: 746ea35981b1f77e988d48642409d73f0470b3eb net: hinic: Add Hardware Abstract Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 10454/21632] sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: c6a3607c78f8035db0efc67cb41374fe49e4709d [10454/21632] ALSA: usb-audio: More validations of descriptor units config: x86_64-randconfig-121-20240224 (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402250716.ZS5etOKl-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer vim +113 sound/usb/validate.c 67 68 /* both for processing and extension units; covering all UACs */ 69 static bool validate_processing_unit(const void *p, 70 const struct usb_desc_validator *v) 71 { 72 const struct uac_processing_unit_descriptor *d = p; 73 const unsigned char *hdr = p; 74 size_t len, m; 75 76 if (d->bLength < sizeof(*d)) 77 return false; 78 len = d->bLength < sizeof(*d) + d->bNrInPins; 79 if (d->bLength < len) 80 return false; 81 switch (v->protocol) { 82 case UAC_VERSION_1: 83 default: 84 /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */ 85 len += 1 + 2 + 1 + 1; 86 if (d->bLength < len) /* bControlSize */ 87 return false; 88 m = hdr[len]; 89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ 90 break; 91 case UAC_VERSION_2: 92 /* bNrChannels, bmChannelConfig, iChannelNames */ 93 len += 1 + 4 + 1; 94 if (v->type == UAC2_PROCESSING_UNIT_V2) 95 len += 2; /* bmControls -- 2 bytes for PU */ 96 else 97 len += 1; /* bmControls -- 1 byte for EU */ 98 len += 1; /* iProcessing */ 99 break; 100 case UAC_VERSION_3: 101 /* wProcessingDescrStr, bmControls */ 102 len += 2 + 4; 103 break; 104 } 105 if (d->bLength < len) 106 return false; 107 108 switch (v->protocol) { 109 case UAC_VERSION_1: 110 default: 111 if (v->type == UAC1_EXTENSION_UNIT) 112 return true; /* OK */ > 113 switch (d->wProcessType) { 114 case UAC_PROCESS_UP_DOWNMIX: 115 case UAC_PROCESS_DOLBY_PROLOGIC: 116 if (d->bLength < len + 1) /* bNrModes */ 117 return false; 118 m = hdr[len]; 119 len += 1 + m * 2; /* bNrModes, waModes(n) */ 120 break; 121 default: 122 break; 123 } 124 break; 125 case UAC_VERSION_2: 126 if (v->type == UAC2_EXTENSION_UNIT_V2) 127 return true; /* OK */ 128 switch (d->wProcessType) { 129 case UAC2_PROCESS_UP_DOWNMIX: 130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ 131 if (d->bLength < len + 1) /* bNrModes */ 132 return false; 133 m = hdr[len]; 134 len += 1 + m * 4; /* bNrModes, daModes(n) */ 135 break; 136 default: 137 break; 138 } 139 break; 140 case UAC_VERSION_3: 141 if (v->type == UAC3_EXTENSION_UNIT) { 142 len += 2; /* wClusterDescrID */ 143 break; 144 } 145 switch (d->wProcessType) { 146 case UAC3_PROCESS_UP_DOWNMIX: 147 if (d->bLength < len + 1) /* bNrModes */ 148 return false; 149 m = hdr[len]; 150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */ 151 break; 152 case UAC3_PROCESS_MULTI_FUNCTION: 153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */ 154 break; 155 default: 156 break; 157 } 158 break; 159 } 160 if (d->bLength < len) 161 return false; 162 163 return true; 164 } 165 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13350/21632] ld.lld: error: undefined symbol: kfree_skb
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/21632] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-001-20240224 (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402242133.TAc5acto-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: __alloc_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: __nlmsg_put >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: kfree_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_broadcast >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: init_net >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: __netlink_kernel_create >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_kernel_release >>> referenced by super.c >>> fs/ext4/super.o:(ext4_exit_fs) in archive built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29649/30000] drivers/ub/urma/ubcore/ubcore_device.c:393:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy'
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [29649/30000] ubcore: fix the bug of tp negotiation concurrency config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402242102.SLiva8Ut-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_device.c:306:6: warning: no previous prototype for function 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 306 | void ubcore_destroy_upi_list(void) | ^ drivers/ub/urma/ubcore/ubcore_device.c:306:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 306 | void ubcore_destroy_upi_list(void) | ^ | static >> drivers/ub/urma/ubcore/ubcore_device.c:393:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy' [-Wmissing-prototypes] 393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ drivers/ub/urma/ubcore/ubcore_device.c:393:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ | static 2 warnings generated. -- drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for function 'ubcore_get_mtu' [-Wmissing-prototypes] 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^ drivers/ub/urma/ubcore/ubcore_tp.c:66:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^ | static >> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for function 'ubcore_modify_tp_state' [-Wmissing-prototypes] 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^ drivers/ub/urma/ubcore/ubcore_tp.c:392:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^ | static drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for function 'ubcore_create_vtp' [-Wmissing-prototypes] 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^ drivers/ub/urma/ubcore/ubcore_tp.c:894:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^ | static drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for function 'ubcore_destroy_vtp' [-Wmissing-prototypes] 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^ drivers/ub/urma/ubcore/ubcore_tp.c:920:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^ | static 4 warnings generated. -- >> drivers/ub/urma/uburma/uburma_main.c:640:6: warning: no previous prototype for function 'uburma_dev_accessible_by_ns' [-Wmissing-prototypes] 640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net) | ^ drivers/ub/urma/uburma/uburma_main.c:640:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net) | ^ | static >> drivers/ub/urma/uburma/uburma_main.c:665:5: warning: no previous prototype for function 'uburma_set_dev_ns' [-Wmissing-prototypes] 665 | int uburma_set_dev_ns(char *device_name, int ns_fd) | ^ drivers/ub/urma/uburma/uburma_main.c:665:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 665 | int uburma_set_dev_ns(char *device_name, int ns_fd) | ^ | static >> drivers/ub/urma/uburma/uburma_main.c:723:5: warning: no previous prototype for function 'uburma_set_ns_mode' [-Wmissing-prototypes] 723 | int uburma_set_ns_mode(bool shared) | ^ drivers/ub/urma/uburma/uburma_main.c:723:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 723 | int uburma_set_ns_mode(bool shared) | ^ | static 3 warnings generated. vim +/ubcore_find_tpf_device_legacy +393 drivers/ub/urma/ubcore/ubcore_device.c 392 > 393 struct ubcore_device *ubcore_find_tpf_device_legacy(void) 394 { 395 if (g_tpf == NULL) 396 ubcore_log_err("tpf is not registered yet"); 397 398 ubcore_get_device(g_tpf); 399 return g_tpf; 400 } 401 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3269/3388] security/integrity/ima/ima_fs.c:773:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0e6ac87df9e5122747ac5d9e7da9a45555f16374 commit: 0e45634e06109de7611c36f8d25c0ab35baa0624 [3269/3388] ima: Introduce new securityfs files config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240224/202402241932.aJqB4j0N-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241932.aJqB4j0N-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241932.aJqB4j0N-lkp@intel.com/ All warnings (new ones prefixed by >>): >> security/integrity/ima/ima_fs.c:773:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 773 | if (IS_ERR(digest_list_data_del)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ security/integrity/ima/ima_fs.c:791:9: note: uninitialized use occurs here 791 | return ret; | ^~~ security/integrity/ima/ima_fs.c:773:2: note: remove the 'if' if its condition is always false 773 | if (IS_ERR(digest_list_data_del)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 774 | goto out; | ~~~~~~~~ security/integrity/ima/ima_fs.c:767:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 767 | if (IS_ERR(digest_list_data)) | ^~~~~~~~~~~~~~~~~~~~~~~~ security/integrity/ima/ima_fs.c:791:9: note: uninitialized use occurs here 791 | return ret; | ^~~ security/integrity/ima/ima_fs.c:767:2: note: remove the 'if' if its condition is always false 767 | if (IS_ERR(digest_list_data)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 768 | goto out; | ~~~~~~~~ security/integrity/ima/ima_fs.c:761:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 761 | if (IS_ERR(digests_count)) | ^~~~~~~~~~~~~~~~~~~~~ security/integrity/ima/ima_fs.c:791:9: note: uninitialized use occurs here 791 | return ret; | ^~~ security/integrity/ima/ima_fs.c:761:2: note: remove the 'if' if its condition is always false 761 | if (IS_ERR(digests_count)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 762 | goto out; | ~~~~~~~~ security/integrity/ima/ima_fs.c:690:9: note: initialize the variable 'ret' to silence this warning 690 | int ret; | ^ | = 0 3 warnings generated. vim +773 security/integrity/ima/ima_fs.c 687 688 int __init ima_fs_init(void) 689 { 690 int ret; 691 692 ima_dir = securityfs_create_dir("ima", integrity_dir); 693 if (IS_ERR(ima_dir)) 694 return PTR_ERR(ima_dir); 695 696 ima_symlink = securityfs_create_symlink("ima", NULL, "integrity/ima", 697 NULL); 698 if (IS_ERR(ima_symlink)) { 699 ret = PTR_ERR(ima_symlink); 700 goto out; 701 } 702 703 binary_runtime_measurements = 704 securityfs_create_file("binary_runtime_measurements", 705 S_IRUSR | S_IRGRP, ima_dir, NULL, 706 &ima_measurements_ops); 707 if (IS_ERR(binary_runtime_measurements)) { 708 ret = PTR_ERR(binary_runtime_measurements); 709 goto out; 710 } 711 712 ascii_runtime_measurements = 713 securityfs_create_file("ascii_runtime_measurements", 714 S_IRUSR | S_IRGRP, ima_dir, NULL, 715 &ima_ascii_measurements_ops); 716 if (IS_ERR(ascii_runtime_measurements)) { 717 ret = PTR_ERR(ascii_runtime_measurements); 718 goto out; 719 } 720 721 runtime_measurements_count = 722 securityfs_create_file("runtime_measurements_count", 723 S_IRUSR | S_IRGRP, ima_dir, NULL, 724 #ifdef CONFIG_IMA_DIGEST_LIST 725 &ima_htable_value_ops); 726 #else 727 &ima_measurements_count_ops); 728 #endif 729 if (IS_ERR(runtime_measurements_count)) { 730 ret = PTR_ERR(runtime_measurements_count); 731 goto out; 732 } 733 734 violations = 735 securityfs_create_file("violations", S_IRUSR | S_IRGRP, 736 #ifdef CONFIG_IMA_DIGEST_LIST 737 ima_dir, NULL, &ima_htable_value_ops); 738 #else 739 ima_dir, NULL, &ima_htable_violations_ops); 740 #endif 741 if (IS_ERR(violations)) { 742 ret = PTR_ERR(violations); 743 goto out; 744 } 745 746 ima_policy = securityfs_create_file("policy", POLICY_FILE_FLAGS, 747 ima_dir, NULL, 748 #ifdef CONFIG_IMA_DIGEST_LIST 749 &ima_data_upload_ops); 750 #else 751 &ima_measure_policy_ops); 752 #endif 753 if (IS_ERR(ima_policy)) { 754 ret = PTR_ERR(ima_policy); 755 goto out; 756 } 757 #ifdef CONFIG_IMA_DIGEST_LIST 758 digests_count = securityfs_create_file("digests_count", 759 S_IRUSR | S_IRGRP, ima_dir, 760 NULL, &ima_htable_value_ops); 761 if (IS_ERR(digests_count)) 762 goto out; 763 764 digest_list_data = securityfs_create_file("digest_list_data", S_IWUSR, 765 ima_dir, NULL, 766 &ima_data_upload_ops); 767 if (IS_ERR(digest_list_data)) 768 goto out; 769 770 digest_list_data_del = securityfs_create_file("digest_list_data_del", 771 S_IWUSR, ima_dir, NULL, 772 &ima_data_upload_ops); > 773 if (IS_ERR(digest_list_data_del)) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19387/30000] drivers/vdpa/vdpa_sim/vdpa_sim_net.c:36:4: sparse: sparse: symbol 'macaddr_buf' was not declared. Should it be static?
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 commit: d4a6c405d07d2c7eb60a781368d94c476ebe24ab [19387/30000] vdpa: split vdpasim to core and net modules config: x86_64-randconfig-122-20240224 (https://download.01.org/0day-ci/archive/20240224/202402241904.fKVDwGyh-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241904.fKVDwGyh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241904.fKVDwGyh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/vdpa/vdpa_sim/vdpa_sim_net.c:36:4: sparse: sparse: symbol 'macaddr_buf' was not declared. Should it be static? vim +/macaddr_buf +36 drivers/vdpa/vdpa_sim/vdpa_sim_net.c 35 > 36 u8 macaddr_buf[ETH_ALEN]; 37 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 19778/30000] drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:113:5: sparse: sparse: symbol 'ngbe_poll_for_msg' was not declared. Should it be static?
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 commit: a5961b4bc6ce09a70902686ecc848a47493a9251 [19778/30000] openeuler: net: ngbe: add ngbe module support config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240224/202402241626.MnVH3cCn-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241626.MnVH3cCn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241626.MnVH3cCn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:113:5: sparse: sparse: symbol 'ngbe_poll_for_msg' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:143:5: sparse: sparse: symbol 'ngbe_poll_for_ack' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:244:5: sparse: sparse: symbol 'ngbe_read_v2p_mailbox' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:262:5: sparse: sparse: symbol 'ngbe_check_for_bit_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:278:5: sparse: sparse: symbol 'ngbe_check_for_msg_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:298:5: sparse: sparse: symbol 'ngbe_check_for_ack_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:318:5: sparse: sparse: symbol 'ngbe_check_for_rst_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:337:5: sparse: sparse: symbol 'ngbe_obtain_mbx_lock_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:365:5: sparse: sparse: symbol 'ngbe_write_mbx_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:403:5: sparse: sparse: symbol 'ngbe_read_mbx_vf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:461:5: sparse: sparse: symbol 'ngbe_check_for_bit_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:481:5: sparse: sparse: symbol 'ngbe_check_for_msg_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:501:5: sparse: sparse: symbol 'ngbe_check_for_ack_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:521:5: sparse: sparse: symbol 'ngbe_check_for_rst_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:544:5: sparse: sparse: symbol 'ngbe_obtain_mbx_lock_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:572:5: sparse: sparse: symbol 'ngbe_write_mbx_pf' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c:612:5: sparse: sparse: symbol 'ngbe_read_mbx_pf' was not declared. Should it be static? -- >> drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:818:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:818:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:818:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:1268:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:1268:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:1268:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:1297:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:1297:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:1297:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:474:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:474:25: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:474:25: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:474:25: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:474:25: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:474:25: sparse: int -- >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:16:6: sparse: sparse: symbol 'ngbe_check_reset_blocked' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:33:5: sparse: sparse: symbol 'ngbe_phy_read_reg' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:56:5: sparse: sparse: symbol 'ngbe_phy_write_reg' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:74:5: sparse: sparse: symbol 'ngbe_check_internal_phy_id' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:273:5: sparse: sparse: symbol 'ngbe_check_mdi_phy_id' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:337:6: sparse: sparse: symbol 'ngbe_validate_phy_addr' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:353:5: sparse: sparse: symbol 'ngbe_check_yt_phy_id' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1242:5: sparse: sparse: symbol 'ngbe_phy_get_advertised_pause' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1279:5: sparse: sparse: symbol 'ngbe_phy_get_lp_advertised_pause' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1324:5: sparse: sparse: symbol 'ngbe_phy_set_pause_advertisement' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1450:5: sparse: sparse: symbol 'ngbe_phy_setup' was not declared. Should it be static? -- >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:399:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:399:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:399:9: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:752:6: sparse: sparse: symbol 'ngbe_add_uc_addr' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:885:6: sparse: sparse: symbol 'ngbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1937:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1937:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1937:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2186:5: sparse: sparse: symbol 'ngbe_setup_mac_link_hostif' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2222:5: sparse: sparse: symbol 'ngbe_crc16_ccitt' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2897:23: sparse: sparse: symbol 'ngbe_ptype_lookup' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3296:5: sparse: sparse: symbol 'ngbe_get_copper_link_capabilities' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3456:5: sparse: sparse: symbol 'ngbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3751:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3751:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3751:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3753:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3753:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3753:17: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3910:5: sparse: sparse: symbol 'ngbe_read_ee_hostif_data' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3981:5: sparse: sparse: symbol 'ngbe_phy_led_oem_chk' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4066:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4066:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4066:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4148:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4148:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4148:9: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4163:5: sparse: sparse: symbol 'ngbe_read_ee_hostif_data32' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4208:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4208:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4208:17: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4225:5: sparse: sparse: symbol 'ngbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4264:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4264:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4264:17: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4282:5: sparse: sparse: symbol 'ngbe_write_ee_hostif_data32' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4320:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4320:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4320:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4365:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4365:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4365:9: sparse: int -- >> drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:128:5: sparse: sparse: symbol 'ngbe_get_link_ksettings' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1548:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1548:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1548:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1570:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1570:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1570:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1607:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1607:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1607:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1611:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1611:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1611:9: sparse: int -- >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:139:6: sparse: sparse: symbol 'ngbe_service_event_schedule' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:888:57: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:888:57: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/netswift/ngbe/ngbe_main.c:888:57: sparse: got unsigned short [usertype] >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2458:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2458:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2458:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2507:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2507:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2507:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3155:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3155:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3155:9: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3159:6: sparse: sparse: symbol 'ngbe_configure_isb' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3173:6: sparse: sparse: symbol 'ngbe_configure_port' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3541:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3541:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3541:9: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3644:5: sparse: sparse: symbol 'ngbe_init_shared_code' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3751:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3751:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3751:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4298:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4298:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4298:17: sparse: int >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5193:40: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5219:37: sparse: sparse: restricted __be16 degrades to integer drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5242:40: sparse: sparse: restricted __be16 degrades to integer >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5791:5: sparse: sparse: symbol 'ngbe_skb_pad_nonzero' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5833:30: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5833:30: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5833:30: sparse: got restricted __be16 [usertype] protocol >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5870:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] protocol @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5870:26: sparse: expected unsigned short [usertype] protocol drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5870:26: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5871:29: sparse: sparse: cast from restricted __be16 >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6192:26: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] protocol @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6192:26: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6192:26: sparse: got restricted __be16 [usertype] protocol >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6206:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] type @@ got restricted __be16 [usertype] h_vlan_encapsulated_proto @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6206:22: sparse: expected unsigned short [usertype] type drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6206:22: sparse: got restricted __be16 [usertype] h_vlan_encapsulated_proto >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6232:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_add_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6232:35: sparse: expected int ( *ndo_vlan_rx_add_vid )( ... ) drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6232:35: sparse: got int ( * )( ... ) >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6233:35: sparse: sparse: incorrect type in initializer (incompatible argument 2 (different base types)) @@ expected int ( *ndo_vlan_rx_kill_vid )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6233:35: sparse: expected int ( *ndo_vlan_rx_kill_vid )( ... ) drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6233:35: sparse: got int ( * )( ... ) >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6237:35: sparse: sparse: incorrect type in initializer (incompatible argument 5 (different base types)) @@ expected int ( *ndo_set_vf_vlan )( ... ) @@ got int ( * )( ... ) @@ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6237:35: sparse: expected int ( *ndo_set_vf_vlan )( ... ) drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6237:35: sparse: got int ( * )( ... ) drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6400:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6400:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6400:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6490:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6490:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6490:9: sparse: int vim +/ngbe_poll_for_msg +113 drivers/net/ethernet/netswift/ngbe/ngbe_mbx.c 105 106 /** 107 * ngbe_poll_for_msg - Wait for message notification 108 * @hw: pointer to the HW structure 109 * @mbx_id: id of mailbox to write 110 * 111 * returns SUCCESS if it successfully received a message notification 112 **/ > 113 int ngbe_poll_for_msg(struct ngbe_hw *hw, u16 mbx_id) 114 { 115 struct ngbe_mbx_info *mbx = &hw->mbx; 116 int countdown = mbx->timeout; 117 118 if (!countdown || !mbx->ops.check_for_msg) 119 goto out; 120 121 while (countdown && TCALL(hw, mbx.ops.check_for_msg, mbx_id)) { 122 countdown--; 123 if (!countdown) 124 break; 125 udelay(mbx->udelay); 126 } 127 128 if (countdown == 0) 129 ERROR_REPORT2(NGBE_ERROR_POLLING, 130 "Polling for VF%d mailbox message timedout", mbx_id); 131 132 out: 133 return countdown ? 0 : NGBE_ERR_MBX; 134 } 135 136 /** 137 * ngbe_poll_for_ack - Wait for message acknowledngbeent 138 * @hw: pointer to the HW structure 139 * @mbx_id: id of mailbox to write 140 * 141 * returns SUCCESS if it successfully received a message acknowledngbeent 142 **/ > 143 int ngbe_poll_for_ack(struct ngbe_hw *hw, u16 mbx_id) 144 { 145 struct ngbe_mbx_info *mbx = &hw->mbx; 146 int countdown = mbx->timeout; 147 148 if (!countdown || !mbx->ops.check_for_ack) 149 goto out; 150 151 while (countdown && TCALL(hw, mbx.ops.check_for_ack, mbx_id)) { 152 countdown--; 153 if (!countdown) 154 break; 155 udelay(mbx->udelay); 156 } 157 158 if (countdown == 0) 159 ERROR_REPORT2(NGBE_ERROR_POLLING, 160 "Polling for VF%d mailbox ack timedout", mbx_id); 161 162 out: 163 return countdown ? 0 : NGBE_ERR_MBX; 164 } 165 166 /** 167 * ngbe_read_posted_mbx - Wait for message notification and receive message 168 * @hw: pointer to the HW structure 169 * @msg: The message buffer 170 * @size: Length of buffer 171 * @mbx_id: id of mailbox to write 172 * 173 * returns SUCCESS if it successfully received a message notification and 174 * copied it into the receive buffer. 175 **/ 176 int ngbe_read_posted_mbx(struct ngbe_hw *hw, u32 *msg, u16 size, u16 mbx_id) 177 { 178 struct ngbe_mbx_info *mbx = &hw->mbx; 179 int err = NGBE_ERR_MBX; 180 181 if (!mbx->ops.read) 182 goto out; 183 184 err = ngbe_poll_for_msg(hw, mbx_id); 185 186 /* if ack received read message, otherwise we timed out */ 187 if (!err) 188 err = TCALL(hw, mbx.ops.read, msg, size, mbx_id); 189 out: 190 return err; 191 } 192 193 /** 194 * ngbe_write_posted_mbx - Write a message to the mailbox, wait for ack 195 * @hw: pointer to the HW structure 196 * @msg: The message buffer 197 * @size: Length of buffer 198 * @mbx_id: id of mailbox to write 199 * 200 * returns SUCCESS if it successfully copied message into the buffer and 201 * received an ack to that message within delay * timeout period 202 **/ 203 int ngbe_write_posted_mbx(struct ngbe_hw *hw, u32 *msg, u16 size, 204 u16 mbx_id) 205 { 206 struct ngbe_mbx_info *mbx = &hw->mbx; 207 int err; 208 209 /* exit if either we can't write or there isn't a defined timeout */ 210 if (!mbx->timeout) 211 return NGBE_ERR_MBX; 212 213 /* send msg */ 214 err = TCALL(hw, mbx.ops.write, msg, size, mbx_id); 215 216 /* if msg sent wait until we receive an ack */ 217 if (!err) 218 err = ngbe_poll_for_ack(hw, mbx_id); 219 220 return err; 221 } 222 223 /** 224 * ngbe_init_mbx_ops - Initialize MB function pointers 225 * @hw: pointer to the HW structure 226 * 227 * Setups up the mailbox read and write message function pointers 228 **/ 229 void ngbe_init_mbx_ops(struct ngbe_hw *hw) 230 { 231 struct ngbe_mbx_info *mbx = &hw->mbx; 232 233 mbx->ops.read_posted = ngbe_read_posted_mbx; 234 mbx->ops.write_posted = ngbe_write_posted_mbx; 235 } 236 237 /** 238 * ngbe_read_v2p_mailbox - read v2p mailbox 239 * @hw: pointer to the HW structure 240 * 241 * This function is used to read the v2p mailbox without losing the read to 242 * clear status bits. 243 **/ > 244 u32 ngbe_read_v2p_mailbox(struct ngbe_hw *hw) 245 { 246 u32 v2p_mailbox = rd32(hw, NGBE_VXMAILBOX); 247 248 v2p_mailbox |= hw->mbx.v2p_mailbox; 249 hw->mbx.v2p_mailbox |= v2p_mailbox & NGBE_VXMAILBOX_R2C_BITS; 250 251 return v2p_mailbox; 252 } 253 254 /** 255 * ngbe_check_for_bit_vf - Determine if a status bit was set 256 * @hw: pointer to the HW structure 257 * @mask: bitmask for bits to be tested and cleared 258 * 259 * This function is used to check for the read to clear bits within 260 * the V2P mailbox. 261 **/ > 262 int ngbe_check_for_bit_vf(struct ngbe_hw *hw, u32 mask) 263 { 264 u32 mailbox = ngbe_read_v2p_mailbox(hw); 265 266 hw->mbx.v2p_mailbox &= ~mask; 267 268 return (mailbox & mask ? 0 : NGBE_ERR_MBX); 269 } 270 271 /** 272 * ngbe_check_for_msg_vf - checks to see if the PF has sent mail 273 * @hw: pointer to the HW structure 274 * @mbx_id: id of mailbox to check 275 * 276 * returns SUCCESS if the PF has set the Status bit or else ERR_MBX 277 **/ > 278 int ngbe_check_for_msg_vf(struct ngbe_hw *hw, u16 __always_unused mbx_id) 279 { 280 int err = NGBE_ERR_MBX; 281 282 /* read clear the pf sts bit */ 283 if (!ngbe_check_for_bit_vf(hw, NGBE_VXMAILBOX_PFSTS)) { 284 err = 0; 285 hw->mbx.stats.reqs++; 286 } 287 288 return err; 289 } 290 291 /** 292 * ngbe_check_for_ack_vf - checks to see if the PF has ACK'd 293 * @hw: pointer to the HW structure 294 * @mbx_id: id of mailbox to check 295 * 296 * returns SUCCESS if the PF has set the ACK bit or else ERR_MBX 297 **/ > 298 int ngbe_check_for_ack_vf(struct ngbe_hw *hw, u16 __always_unused mbx_id) 299 { 300 int err = NGBE_ERR_MBX; 301 302 /* read clear the pf ack bit */ 303 if (!ngbe_check_for_bit_vf(hw, NGBE_VXMAILBOX_PFACK)) { 304 err = 0; 305 hw->mbx.stats.acks++; 306 } 307 308 return err; 309 } 310 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3159/3388] arch/arm64/include/asm/kvm_mmu.h:221:undefined reference to `__kvm_nvhe_kvm_ncsnp_support'
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0e6ac87df9e5122747ac5d9e7da9a45555f16374 commit: 625086f87673687dc420e79c9fedff0c2d65cb49 [3159/3388] KVM: arm64: Add support for probing Hisi ncsnp capability config: arm64-defconfig (https://download.01.org/0day-ci/archive/20240224/202402241512.XOiHdLOg-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241512.XOiHdLOg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241512.XOiHdLOg-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: arch/arm64/kvm/hyp/nvhe/kvm_nvhe.o: in function `__clean_dcache_guest_page': >> arch/arm64/include/asm/kvm_mmu.h:221:(.hyp.text+0x6898): undefined reference to `__kvm_nvhe_kvm_ncsnp_support' aarch64-linux-ld: arch/arm64/kvm/hyp/nvhe/kvm_nvhe.o: relocation R_AARCH64_ADR_PREL_PG_HI21 against symbol `__kvm_nvhe_kvm_ncsnp_support' which may bind externally can not be used when making a shared object; recompile with -fPIC >> arch/arm64/include/asm/kvm_mmu.h:221:(.hyp.text+0x6898): dangerous relocation: unsupported relocation >> aarch64-linux-ld: arch/arm64/include/asm/kvm_mmu.h:221:(.hyp.text+0x689c): undefined reference to `__kvm_nvhe_kvm_ncsnp_support' aarch64-linux-ld: arch/arm64/kvm/hyp/nvhe/kvm_nvhe.o: in function `kvm_pgtable_stage2_flush': >> arch/arm64/kvm/hyp/nvhe/../pgtable.c:1345:(.hyp.text+0x10554): undefined reference to `__kvm_nvhe_kvm_ncsnp_support' aarch64-linux-ld: arch/arm64/kvm/hyp/nvhe/kvm_nvhe.o: relocation R_AARCH64_ADR_PREL_PG_HI21 against symbol `__kvm_nvhe_kvm_ncsnp_support' which may bind externally can not be used when making a shared object; recompile with -fPIC >> arch/arm64/kvm/hyp/nvhe/../pgtable.c:1345:(.hyp.text+0x10554): dangerous relocation: unsupported relocation >> aarch64-linux-ld: arch/arm64/kvm/hyp/nvhe/../pgtable.c:1345:(.hyp.text+0x1056c): undefined reference to `__kvm_nvhe_kvm_ncsnp_support' vim +221 arch/arm64/include/asm/kvm_mmu.h 212 213 static inline void __clean_dcache_guest_page(void *va, size_t size) 214 { 215 /* 216 * With FWB, we ensure that the guest always accesses memory using 217 * cacheable attributes, and we don't have to clean to PoC when 218 * faulting in pages. Furthermore, FWB implies IDC, so cleaning to 219 * PoU is not required either in this case. 220 */ > 221 if (kvm_ncsnp_support || cpus_have_const_cap(ARM64_HAS_STAGE2_FWB)) 222 return; 223 224 kvm_flush_dcache_to_poc(va, size); 225 } 226 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3267/3388] security/integrity/ima/ima_appraise.c:188:16: warning: no previous prototype for 'ima_get_hash_algo'
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0e6ac87df9e5122747ac5d9e7da9a45555f16374 commit: b3fef06570ef2b61dd7181e5c1d128bfcbf6b2ef [3267/3388] ima: Add parser of compact digest list config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240224/202402241446.c26kZvcP-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241446.c26kZvcP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241446.c26kZvcP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> security/integrity/ima/ima_appraise.c:188:16: warning: no previous prototype for 'ima_get_hash_algo' [-Wmissing-prototypes] 188 | enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value, | ^~~~~~~~~~~~~~~~~ vim +/ima_get_hash_algo +188 security/integrity/ima/ima_appraise.c d79d72e02485c0 Mimi Zohar 2012-12-03 187 50f742dd91474e THOBY Simon 2021-08-16 @188 enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value, 1525b06d99b117 Dmitry Kasatkin 2014-10-30 189 int xattr_len) d3634d0f426bde Dmitry Kasatkin 2013-04-25 190 { d3634d0f426bde Dmitry Kasatkin 2013-04-25 191 struct signature_v2_hdr *sig; b4bfec7f4a8642 Seth Forshee 2016-08-01 192 enum hash_algo ret; d3634d0f426bde Dmitry Kasatkin 2013-04-25 193 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 194 if (!xattr_value || xattr_len < 2) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 195 /* return default hash algo */ 1525b06d99b117 Dmitry Kasatkin 2014-10-30 196 return ima_hash_algo; d3634d0f426bde Dmitry Kasatkin 2013-04-25 197 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 198 switch (xattr_value->type) { 398c42e2c46c88 Mimi Zohar 2021-11-24 199 case IMA_VERITY_DIGSIG: 398c42e2c46c88 Mimi Zohar 2021-11-24 200 sig = (typeof(sig))xattr_value; 398c42e2c46c88 Mimi Zohar 2021-11-24 201 if (sig->version != 3 || xattr_len <= sizeof(*sig) || 398c42e2c46c88 Mimi Zohar 2021-11-24 202 sig->hash_algo >= HASH_ALGO__LAST) 398c42e2c46c88 Mimi Zohar 2021-11-24 203 return ima_hash_algo; 398c42e2c46c88 Mimi Zohar 2021-11-24 204 return sig->hash_algo; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 205 case EVM_IMA_XATTR_DIGSIG: 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 206 sig = (typeof(sig))xattr_value; cb181da161963e THOBY Simon 2021-08-22 207 if (sig->version != 2 || xattr_len <= sizeof(*sig) cb181da161963e THOBY Simon 2021-08-22 208 || sig->hash_algo >= HASH_ALGO__LAST) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 209 return ima_hash_algo; 1525b06d99b117 Dmitry Kasatkin 2014-10-30 210 return sig->hash_algo; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 211 case IMA_XATTR_DIGEST_NG: 650b29dbdf2caf Thiago Jung Bauermann 2019-06-11 212 /* first byte contains algorithm id */ 650b29dbdf2caf Thiago Jung Bauermann 2019-06-11 213 ret = xattr_value->data[0]; b4bfec7f4a8642 Seth Forshee 2016-08-01 214 if (ret < HASH_ALGO__LAST) b4bfec7f4a8642 Seth Forshee 2016-08-01 215 return ret; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 216 break; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 217 case IMA_XATTR_DIGEST: 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 218 /* this is for backward compatibility */ 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 219 if (xattr_len == 21) { 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 220 unsigned int zero = 0; 650b29dbdf2caf Thiago Jung Bauermann 2019-06-11 221 if (!memcmp(&xattr_value->data[16], &zero, 4)) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 222 return HASH_ALGO_MD5; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 223 else 1525b06d99b117 Dmitry Kasatkin 2014-10-30 224 return HASH_ALGO_SHA1; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 225 } else if (xattr_len == 17) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 226 return HASH_ALGO_MD5; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 227 break; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 228 } 1525b06d99b117 Dmitry Kasatkin 2014-10-30 229 1525b06d99b117 Dmitry Kasatkin 2014-10-30 230 /* return default hash algo */ 1525b06d99b117 Dmitry Kasatkin 2014-10-30 231 return ima_hash_algo; d3634d0f426bde Dmitry Kasatkin 2013-04-25 232 } d3634d0f426bde Dmitry Kasatkin 2013-04-25 233 :::::: The code at line 188 was first introduced by commit :::::: 50f742dd91474e7f4954bf88d094eede59783883 IMA: block writes of the security.ima xattr with unsupported algorithms :::::: TO: THOBY Simon <Simon.THOBY(a)viveris.fr> :::::: CC: Mimi Zohar <zohar(a)linux.ibm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3267/3388] security/integrity/ima/ima_appraise.c:188:16: warning: no previous prototype for function 'ima_get_hash_algo'
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0e6ac87df9e5122747ac5d9e7da9a45555f16374 commit: b3fef06570ef2b61dd7181e5c1d128bfcbf6b2ef [3267/3388] ima: Add parser of compact digest list config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240224/202402241300.uvUkIofs-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402241300.uvUkIofs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402241300.uvUkIofs-lkp@intel.com/ All warnings (new ones prefixed by >>): >> security/integrity/ima/ima_appraise.c:188:16: warning: no previous prototype for function 'ima_get_hash_algo' [-Wmissing-prototypes] 188 | enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value, | ^ security/integrity/ima/ima_appraise.c:188:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 188 | enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value, | ^ | static 1 warning generated. vim +/ima_get_hash_algo +188 security/integrity/ima/ima_appraise.c d79d72e02485c0 Mimi Zohar 2012-12-03 187 50f742dd91474e THOBY Simon 2021-08-16 @188 enum hash_algo ima_get_hash_algo(const struct evm_ima_xattr_data *xattr_value, 1525b06d99b117 Dmitry Kasatkin 2014-10-30 189 int xattr_len) d3634d0f426bde Dmitry Kasatkin 2013-04-25 190 { d3634d0f426bde Dmitry Kasatkin 2013-04-25 191 struct signature_v2_hdr *sig; b4bfec7f4a8642 Seth Forshee 2016-08-01 192 enum hash_algo ret; d3634d0f426bde Dmitry Kasatkin 2013-04-25 193 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 194 if (!xattr_value || xattr_len < 2) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 195 /* return default hash algo */ 1525b06d99b117 Dmitry Kasatkin 2014-10-30 196 return ima_hash_algo; d3634d0f426bde Dmitry Kasatkin 2013-04-25 197 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 198 switch (xattr_value->type) { 398c42e2c46c88 Mimi Zohar 2021-11-24 199 case IMA_VERITY_DIGSIG: 398c42e2c46c88 Mimi Zohar 2021-11-24 200 sig = (typeof(sig))xattr_value; 398c42e2c46c88 Mimi Zohar 2021-11-24 201 if (sig->version != 3 || xattr_len <= sizeof(*sig) || 398c42e2c46c88 Mimi Zohar 2021-11-24 202 sig->hash_algo >= HASH_ALGO__LAST) 398c42e2c46c88 Mimi Zohar 2021-11-24 203 return ima_hash_algo; 398c42e2c46c88 Mimi Zohar 2021-11-24 204 return sig->hash_algo; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 205 case EVM_IMA_XATTR_DIGSIG: 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 206 sig = (typeof(sig))xattr_value; cb181da161963e THOBY Simon 2021-08-22 207 if (sig->version != 2 || xattr_len <= sizeof(*sig) cb181da161963e THOBY Simon 2021-08-22 208 || sig->hash_algo >= HASH_ALGO__LAST) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 209 return ima_hash_algo; 1525b06d99b117 Dmitry Kasatkin 2014-10-30 210 return sig->hash_algo; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 211 case IMA_XATTR_DIGEST_NG: 650b29dbdf2caf Thiago Jung Bauermann 2019-06-11 212 /* first byte contains algorithm id */ 650b29dbdf2caf Thiago Jung Bauermann 2019-06-11 213 ret = xattr_value->data[0]; b4bfec7f4a8642 Seth Forshee 2016-08-01 214 if (ret < HASH_ALGO__LAST) b4bfec7f4a8642 Seth Forshee 2016-08-01 215 return ret; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 216 break; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 217 case IMA_XATTR_DIGEST: 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 218 /* this is for backward compatibility */ 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 219 if (xattr_len == 21) { 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 220 unsigned int zero = 0; 650b29dbdf2caf Thiago Jung Bauermann 2019-06-11 221 if (!memcmp(&xattr_value->data[16], &zero, 4)) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 222 return HASH_ALGO_MD5; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 223 else 1525b06d99b117 Dmitry Kasatkin 2014-10-30 224 return HASH_ALGO_SHA1; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 225 } else if (xattr_len == 17) 1525b06d99b117 Dmitry Kasatkin 2014-10-30 226 return HASH_ALGO_MD5; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 227 break; 3ea7a56067e663 Dmitry Kasatkin 2013-08-12 228 } 1525b06d99b117 Dmitry Kasatkin 2014-10-30 229 1525b06d99b117 Dmitry Kasatkin 2014-10-30 230 /* return default hash algo */ 1525b06d99b117 Dmitry Kasatkin 2014-10-30 231 return ima_hash_algo; d3634d0f426bde Dmitry Kasatkin 2013-04-25 232 } d3634d0f426bde Dmitry Kasatkin 2013-04-25 233 :::::: The code at line 188 was first introduced by commit :::::: 50f742dd91474e7f4954bf88d094eede59783883 IMA: block writes of the security.ima xattr with unsupported algorithms :::::: TO: THOBY Simon <Simon.THOBY(a)viveris.fr> :::::: CC: Mimi Zohar <zohar(a)linux.ibm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION b97b63500af297c36f80416fd1f1193d227cf51a
by kernel test robot 24 Feb '24

24 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: b97b63500af297c36f80416fd1f1193d227cf51a !4643 f2fs: explicitly null-terminate the xattr list Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202402240932.WccokBnQ-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/dax/pmem/.tmp_core.o: warning: objtool: missing symbol for section .text Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-002-20240223 | |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-ce-description-in-qm_hw_error_init | |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-fe-description-in-qm_hw_error_init | |-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-msi-description-in-qm_hw_error_init | `-- drivers-crypto-hisilicon-qm.c:warning:Excess-function-parameter-nfe-description-in-qm_hw_error_init |-- x86_64-buildonly-randconfig-003-20240220 | `-- drivers-dax-pmem-.tmp_core.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-defconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- x86_64-randconfig-002-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- x86_64-randconfig-004-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- x86_64-randconfig-005-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- x86_64-randconfig-011-20240224 | `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- x86_64-randconfig-012-20240224 | `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- x86_64-randconfig-013-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- x86_64-randconfig-071-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. `-- x86_64-randconfig-161-20240224 |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. clang_recent_errors |-- x86_64-allnoconfig | `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- x86_64-buildonly-randconfig-001-20240224 | `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- x86_64-buildonly-randconfig-003-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- x86_64-buildonly-randconfig-004-20240224 | `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- x86_64-buildonly-randconfig-005-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | `-- net-appletalk-sysctl_net_atalk.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | `-- drivers-staging-erofs-unzip_vle_lz4.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-001-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-003-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-006-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-014-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-015-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-016-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() |-- x86_64-randconfig-072-20240224 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_del-falls-through-to-next-function-tcp_metrics_fill_info() | `-- net-ipv4-tcp_metrics.o:warning:objtool:tcp_metrics_nl_cmd_get-falls-through-to-next-function-tcp_metrics_nl_dump() `-- x86_64-rhel-8.3-rust `-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call elapsed time: 1459m configs tested: 50 configs skipped: 120 tested configs: alpha allnoconfig gcc alpha allyesconfig gcc alpha defconfig gcc arc allnoconfig gcc arc defconfig gcc arm allnoconfig gcc arm defconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240223 gcc arm64 randconfig-002-20240223 gcc arm64 randconfig-003-20240223 gcc arm64 randconfig-004-20240223 gcc csky allnoconfig gcc csky defconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc m68k allnoconfig gcc m68k defconfig gcc microblaze allnoconfig gcc microblaze defconfig gcc mips allnoconfig gcc nios2 allnoconfig gcc nios2 defconfig gcc um allmodconfig gcc um allyesconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240224 clang x86_64 buildonly-randconfig-002-20240224 clang x86_64 buildonly-randconfig-003-20240224 clang x86_64 buildonly-randconfig-004-20240224 clang x86_64 buildonly-randconfig-005-20240224 clang x86_64 buildonly-randconfig-006-20240224 clang x86_64 defconfig gcc x86_64 randconfig-001-20240224 clang x86_64 randconfig-002-20240224 gcc x86_64 randconfig-003-20240224 clang x86_64 randconfig-004-20240224 gcc x86_64 randconfig-005-20240224 gcc x86_64 randconfig-006-20240224 clang x86_64 randconfig-011-20240224 gcc x86_64 randconfig-012-20240224 gcc x86_64 randconfig-013-20240224 gcc x86_64 randconfig-014-20240224 clang x86_64 randconfig-015-20240224 clang x86_64 randconfig-016-20240224 clang x86_64 randconfig-071-20240224 gcc x86_64 randconfig-072-20240224 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 0e6ac87df9e5122747ac5d9e7da9a45555f16374
by kernel test robot 24 Feb '24

24 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 0e6ac87df9e5122747ac5d9e7da9a45555f16374 !3880 ima: Add IMA digest lists extension Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-randconfig-001-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-allmodconfig | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-001-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- loongarch-randconfig-002-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device `-- x86_64-randconfig-161-20240224 `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device clang_recent_errors |-- arm64-allmodconfig | |-- WARNING:modpost:vmlinux:section-mismatch-in-reference:resctrl_init-(section:.text)-rdtgroup_setup_default-(section:.init.text) | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_cursor_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-pe22_dc.c:warning:no-previous-prototype-for-function-pe22_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_reset | |-- drivers-gpu-drm-phytium-pe22_dp.c:warning:no-previous-prototype-for-function-pe22_dp_hw_spread_is_enable | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_crtc.c:warning:no-previous-prototype-for-function-phytium_crtc_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_connector_add | |-- drivers-gpu-drm-phytium-phytium_debugfs.c:warning:no-previous-prototype-for-function-phytium_debugfs_display_register | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_adjust_link_train_parameter | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_coding_8b10b_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_dpcd_sink_dpms | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_encoder_destroy | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_fast_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_get_link_train_fallback_values | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hpd_poll_handler | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_config_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_disable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_audio | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_input_source | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_output | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_enable_video | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_hpd_irq_setup | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_init | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_output_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_hw_video_is_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_scrambled_need_enable | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_dp_start_link_train | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_encoder_mode_valid | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:no-previous-prototype-for-function-phytium_get_encoder_crtc_mask | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_fini | |-- drivers-gpu-drm-phytium-phytium_fbdev.c:warning:no-previous-prototype-for-function-phytium_drm_fbdev_init | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_dma_transfer | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_gem_prime_vunmap | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_alloc | |-- drivers-gpu-drm-phytium-phytium_gem.c:warning:no-previous-prototype-for-function-phytium_memory_pool_free | |-- drivers-gpu-drm-phytium-phytium_panel.c:warning:no-previous-prototype-for-function-phytium_dp_panel_release_backlight_funcs | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_dma_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_fini | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_hw_init | |-- drivers-gpu-drm-phytium-phytium_pci.c:warning:no-previous-prototype-for-function-phytium_pci_vram_init | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_destroy_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_duplicate_state | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_atomic_set_property | |-- drivers-gpu-drm-phytium-phytium_plane.c:warning:no-previous-prototype-for-function-phytium_plane_destroy | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_fini | |-- drivers-gpu-drm-phytium-phytium_platform.c:warning:no-previous-prototype-for-function-phytium_platform_carveout_mem_init | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_clear_msi_irq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_config_pix_clock | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_disable | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_fb_format_check | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_cursor_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_plane_get_primary_format | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_dcreq | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_update_primary_hi_addr | |-- drivers-gpu-drm-phytium-px210_dc.c:warning:no-previous-prototype-for-function-px210_dc_hw_vram_init | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_get_source_lane_count | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_reset | |-- drivers-gpu-drm-phytium-px210_dp.c:warning:no-previous-prototype-for-function-px210_dp_hw_spread_is_enable | `-- drivers-iommu-arm-arm-smmu-v3-arm-smmu-v3.c:warning:variable-pre_addr-is-uninitialized-when-used-here |-- arm64-randconfig-003-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- arm64-randconfig-004-20240224 | `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device |-- x86_64-allyesconfig | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-sm3_generic_block_fn | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_finup | |-- arch-x86-crypto-sm3-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-zx_sm3_update | |-- arch-x86-crypto-sm4-zhaoxin-gmi.c:warning:no-previous-prototype-for-function-gmi_sm4_set_key | |-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-base_offset-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-pin-set-but-not-used | |-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_back-set-but-not-used | `-- drivers-pinctrl-zhaoxin-pinctrl-zhaoxin.c:warning:variable-value_read-set-but-not-used `-- x86_64-rhel-8.3-rust `-- drivers-dax-super.c:warning:Function-parameter-or-member-KABI_RESERVE(-not-described-in-dax_device elapsed time: 993m configs tested: 16 configs skipped: 126 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240224 gcc arm64 randconfig-002-20240224 gcc arm64 randconfig-003-20240224 clang arm64 randconfig-004-20240224 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240224 gcc loongarch randconfig-002-20240224 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 17747/21632] drivers/dax/pmem/.tmp_core.o: warning: objtool: missing symbol for section .text
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 31251a62e6358cf3a099926bfecf4170263b4bf8 [17747/21632] Intel: device-dax: Add /sys/class/dax backwards compatibility config: x86_64-buildonly-randconfig-003-20240220 (https://download.01.org/0day-ci/archive/20240224/202402240932.WccokBnQ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402240932.WccokBnQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402240932.WccokBnQ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/dax/pmem/.tmp_core.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 4fee6fdef7d687d6ce43289fd7e7f96fde039af0
by kernel test robot 24 Feb '24

24 Feb '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 !4662 v3 CVE-2023-52435 elapsed time: 822m configs tested: 11 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240224 gcc arm64 randconfig-002-20240224 gcc arm64 randconfig-003-20240224 clang arm64 randconfig-004-20240224 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH V5 OLK-6.6 00/13] Backport vDPA migration support patches
by Jiang Dongxu 23 Feb '24

23 Feb '24

From: shaodenghui <shaodenghui(a)huawei.com> Backport vDPA migration support patches merged on branch OLK-5.10 V5: fix compile error of kernel-6.6 new vdpa driver eni_vdpa V4: add CONFIG_VHOST_VDPA_MIGRATION to control vdpa migration code compile or not. V3: fix compile error of kernel-6.6 new vdpa driver pds_vdpa V2: fix compile error of kernel-6.6 new vdpa driver vduse and snet_vdpa jiangdongxu (13): vdpa: add log operations vhost-vdpa: add uAPI for logging vdpa: add device state operations vhost-vdpa: add uAPI for device buffer vdpa: add vdpa device migration status ops vhost-vdpa: add uAPI for device migration status vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG vhost-vdpa: Allow transparent MSI IOV vhost-vdpa: fix msi irq request err vhost-vdpa: allow set feature VHOST_F_LOG_ALL when been negotiated. vhost-vdpa: add reset state params to indicate reset level vdpa: add vmstate header file vdpa: add CONFIG_VHOST_VDPA_MIGRATION arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/vdpa/alibaba/eni_vdpa.c | 2 +- drivers/vdpa/ifcvf/ifcvf_main.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +- drivers/vdpa/pds/vdpa_dev.c | 2 +- drivers/vdpa/solidrun/snet_main.c | 2 +- drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 +- drivers/vdpa/vdpa_user/vduse_dev.c | 2 +- drivers/vdpa/virtio_pci/vp_vdpa.c | 2 +- drivers/vhost/Kconfig | 11 ++ drivers/vhost/vdpa.c | 238 ++++++++++++++++++++++--- drivers/virtio/virtio_vdpa.c | 2 +- include/linux/vdpa.h | 56 +++++- include/linux/vdpa_vmstate.h | 182 +++++++++++++++++++ include/uapi/linux/vhost.h | 12 ++ include/uapi/linux/vhost_types.h | 19 ++ 17 files changed, 506 insertions(+), 32 deletions(-) create mode 100644 include/linux/vdpa_vmstate.h -- 2.27.0

2 14

[PATCH OLK-6.6] kvm: kabi: KABI reservation for RME
by Guangwei Zhou 23 Feb '24

23 Feb '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I92TT5 CVE: NA ---------------------------------------------------------------------- Reserve KABI for struct kvm_arch and struct kvm_vcpu_arch for ARMv9 RME feature. Signed-off-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index bd7552746f9e..69d4d9466a4f 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -27,6 +27,7 @@ #include <asm/fpsimd.h> #include <asm/kvm.h> #include <asm/kvm_asm.h> +#include <linux/kabi.h> #define __KVM_HAVE_ARCH_INTC_INITIALIZED @@ -279,6 +280,15 @@ struct kvm_arch { * the associated pKVM instance in the hypervisor. */ struct kvm_protected_vm pkvm; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct kvm_vcpu_fault_info { @@ -591,6 +601,26 @@ struct kvm_vcpu_arch { /* Per-vcpu CCSIDR override or NULL */ u32 *ccsidr; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) }; /* -- 2.33.0

2 1

[PATCH OLK-5.10] uio: Fix use-after-free in uio_open
by Guo Mengqi 23 Feb '24

23 Feb '24

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v5.10.209 commit 5e0be1229ae199ebb90b33102f74a0f22d152570 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXN CVE: CVE-2023-52439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") Cc: stable <stable(a)kernel.org> Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@li… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index be06f1a961c2..f453b3c7ee42 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) mutex_lock(&minor_lock); idev = idr_find(&uio_idr, iminor(inode)); - mutex_unlock(&minor_lock); if (!idev) { ret = -ENODEV; + mutex_unlock(&minor_lock); goto out; } - get_device(&idev->dev); + mutex_unlock(&minor_lock); if (!try_module_get(idev->owner)) { ret = -ENODEV; @@ -1062,9 +1062,8 @@ void uio_unregister_device(struct uio_info *info) wake_up_interruptible(&idev->wait); kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - device_unregister(&idev->dev); - uio_free_minor(minor); + device_unregister(&idev->dev); return; } -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS] uio: Fix use-after-free in uio_open
by Guo Mengqi 23 Feb '24

23 Feb '24

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v4.19.306 commit 3174e0f7de1ba392dc191625da83df02d695b60c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I92HXN CVE: CVE-2023-52439 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream. core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock. Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered") Cc: stable <stable(a)kernel.org> Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@li… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index f43498e5cfb8..facccb36f692 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -464,13 +464,13 @@ static int uio_open(struct inode *inode, struct file *filep) mutex_lock(&minor_lock); idev = idr_find(&uio_idr, iminor(inode)); - mutex_unlock(&minor_lock); if (!idev) { ret = -ENODEV; + mutex_unlock(&minor_lock); goto out; } - get_device(&idev->dev); + mutex_unlock(&minor_lock); if (!try_module_get(idev->owner)) { ret = -ENODEV; @@ -1024,9 +1024,8 @@ void uio_unregister_device(struct uio_info *info) wake_up_interruptible(&idev->wait); kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); - device_unregister(&idev->dev); - uio_free_minor(minor); + device_unregister(&idev->dev); return; } -- 2.17.1

2 1

[PATCH OLK-6.6 0/3] audit: Backport mainline patches
by GUO Zihua 23 Feb '24

23 Feb '24

This series backports mainline bugfixes for audit. Jan Kara (3): audit_tree: Remove mark->lock locking audit: Fix possible spurious -ENOSPC error audit: Fix possible tagging failures kernel/audit_tree.c | 61 ++++++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 34 deletions(-) -- 2.34.1

2 4