- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ksmbd: add refcnt to ksmbd_conn struct
by Long Li 06 Nov '24

06 Nov '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.10-rc2 commit ee426bfb9d09b29987369b897fe9b6485ac2be27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCR CVE: CVE-2024-49988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used. Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/connection.c | 4 ++- fs/smb/server/connection.h | 1 + fs/smb/server/oplock.c | 55 +++++++++++--------------------------- fs/smb/server/vfs_cache.c | 3 +++ 4 files changed, 23 insertions(+), 40 deletions(-) diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c index 7889df8112b4..cac80e7bfefc 100644 --- a/fs/smb/server/connection.c +++ b/fs/smb/server/connection.c @@ -39,7 +39,8 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) xa_destroy(&conn->sessions); kvfree(conn->request_buf); kfree(conn->preauth_info); - kfree(conn); + if (atomic_dec_and_test(&conn->refcnt)) + kfree(conn); } /** @@ -68,6 +69,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) conn->um = NULL; atomic_set(&conn->req_running, 0); atomic_set(&conn->r_count, 0); + atomic_set(&conn->refcnt, 1); conn->total_credits = 1; conn->outstanding_credits = 0; diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h index b93e5437793e..82343afc8d04 100644 --- a/fs/smb/server/connection.h +++ b/fs/smb/server/connection.h @@ -106,6 +106,7 @@ struct ksmbd_conn { bool signing_negotiated; __le16 signing_algorithm; bool binding; + atomic_t refcnt; }; struct ksmbd_conn_ops { diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c index e546ffa57b55..8ee86478287f 100644 --- a/fs/smb/server/oplock.c +++ b/fs/smb/server/oplock.c @@ -51,6 +51,7 @@ static struct oplock_info *alloc_opinfo(struct ksmbd_work *work, init_waitqueue_head(&opinfo->oplock_brk); atomic_set(&opinfo->refcount, 1); atomic_set(&opinfo->breaking_cnt, 0); + atomic_inc(&opinfo->conn->refcnt); return opinfo; } @@ -124,6 +125,8 @@ static void free_opinfo(struct oplock_info *opinfo) { if (opinfo->is_lease) free_lease(opinfo); + if (opinfo->conn && atomic_dec_and_test(&opinfo->conn->refcnt)) + kfree(opinfo->conn); kfree(opinfo); } @@ -163,9 +166,7 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) !atomic_inc_not_zero(&opinfo->refcount)) opinfo = NULL; else { - atomic_inc(&opinfo->conn->r_count); if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); atomic_dec(&opinfo->refcount); opinfo = NULL; } @@ -177,26 +178,11 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) return opinfo; } -static void opinfo_conn_put(struct oplock_info *opinfo) +void opinfo_put(struct oplock_info *opinfo) { - struct ksmbd_conn *conn; - if (!opinfo) return; - conn = opinfo->conn; - /* - * Checking waitqueue to dropping pending requests on - * disconnection. waitqueue_active is safe because it - * uses atomic operation for condition. - */ - if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) - wake_up(&conn->r_count_q); - opinfo_put(opinfo); -} - -void opinfo_put(struct oplock_info *opinfo) -{ if (!atomic_dec_and_test(&opinfo->refcount)) return; @@ -1127,14 +1113,11 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - atomic_inc(&opinfo->conn->r_count); - if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); + if (ksmbd_conn_releasing(opinfo->conn)) continue; - } oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); - opinfo_conn_put(opinfo); + opinfo_put(opinfo); } } up_read(&p_ci->m_lock); @@ -1167,13 +1150,10 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - atomic_inc(&opinfo->conn->r_count); - if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); + if (ksmbd_conn_releasing(opinfo->conn)) continue; - } oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); - opinfo_conn_put(opinfo); + opinfo_put(opinfo); } } up_read(&p_ci->m_lock); @@ -1252,7 +1232,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, prev_opinfo = opinfo_get_list(ci); if (!prev_opinfo || (prev_opinfo->level == SMB2_OPLOCK_LEVEL_NONE && lctx)) { - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto set_lev; } prev_op_has_lease = prev_opinfo->is_lease; @@ -1262,19 +1242,19 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, if (share_ret < 0 && prev_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) { err = share_ret; - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto err_out; } if (prev_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH && prev_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) { - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto op_break_not_needed; } list_add(&work->interim_entry, &prev_opinfo->interim_list); err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II); - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); if (err == -ENOENT) goto set_lev; /* Check all oplock was freed by close */ @@ -1337,14 +1317,14 @@ static void smb_break_all_write_oplock(struct ksmbd_work *work, return; if (brk_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH && brk_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) { - opinfo_conn_put(brk_opinfo); + opinfo_put(brk_opinfo); return; } brk_opinfo->open_trunc = is_trunc; list_add(&work->interim_entry, &brk_opinfo->interim_list); oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II); - opinfo_conn_put(brk_opinfo); + opinfo_put(brk_opinfo); } /** @@ -1376,11 +1356,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, if (!atomic_inc_not_zero(&brk_op->refcount)) continue; - atomic_inc(&brk_op->conn->r_count); - if (ksmbd_conn_releasing(brk_op->conn)) { - atomic_dec(&brk_op->conn->r_count); + if (ksmbd_conn_releasing(brk_op->conn)) continue; - } rcu_read_unlock(); if (brk_op->is_lease && (brk_op->o_lease->state & @@ -1411,7 +1388,7 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, brk_op->open_trunc = is_trunc; oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); next: - opinfo_conn_put(brk_op); + opinfo_put(brk_op); rcu_read_lock(); } rcu_read_unlock(); diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c index 8b2e37c8716e..271a23abc82f 100644 --- a/fs/smb/server/vfs_cache.c +++ b/fs/smb/server/vfs_cache.c @@ -710,6 +710,8 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon, list_for_each_entry_rcu(op, &ci->m_op_list, op_entry) { if (op->conn != conn) continue; + if (op->conn && atomic_dec_and_test(&op->conn->refcnt)) + kfree(op->conn); op->conn = NULL; } up_write(&ci->m_lock); @@ -807,6 +809,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp) if (op->conn) continue; op->conn = fp->conn; + atomic_inc(&op->conn->refcnt); } up_write(&ci->m_lock); -- 2.39.2

2 1

openEuler TC 临时会议
by openEuler conference 06 Nov '24

06 Nov '24

您好！ Kernel 邀请您参加 2024-11-09 10:00 召开的WeLink会议(自动录制) 会议主题：openEuler TC 临时会议会议链接：https://meeting.huaweicloud.com:36443/#/j/983087267 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-11-09 10:00, The subject of the conference is openEuler TC 临时会议, You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/983087267. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH v4 OLK-5.10 0/7] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Changelog since v3: - backport bugfix commit 88e4f525002b ("mm/hugetlb: add missing VM_FAULT_SET_HINDEX in hugetlb_wp") Changelog since v1: - fix incorrect patch format Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Oscar Salvador (1): mm/hugetlb: add missing VM_FAULT_SET_HINDEX in hugetlb_wp Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6] sched/fair: Take the scheduling domain into account in select_idle_smt()
by Wenyu Huang 06 Nov '24

06 Nov '24

From: Keisuke Nishimura <keisuke.nishimura(a)inria.fr> stable inclusion from stable-v6.6.23 commit 495b7cb952003973ff1fe4f70639bf3df91fbfb1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2B23 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 8aeaffef8c6eceab0e1498486fdd4f3dc3b7066c ] When picking a CPU on task wakeup, select_idle_smt() has to take into account the scheduling domain of @target. This is because the "isolcpus" kernel command line option can remove CPUs from the domain to isolate them from other SMT siblings. This fix checks if the candidate CPU is in the target scheduling domain. Commit: df3cb4ea1fb6 ("sched/fair: Fix wrong cpu selecting from isolated domain") ... originally introduced this fix by adding the check of the scheduling domain in the loop. However, commit: 3e6efe87cd5cc ("sched/fair: Remove redundant check in select_idle_smt()") ... accidentally removed the check. Bring it back. Fixes: 3e6efe87cd5c ("sched/fair: Remove redundant check in select_idle_smt()") Signed-off-by: Keisuke Nishimura <keisuke.nishimura(a)inria.fr> Signed-off-by: Julia Lawall <julia.lawall(a)inria.fr> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Vincent Guittot <vincent.guittot(a)linaro.org> Link: https://lore.kernel.org/r/20240110131707.437301-1-keisuke.nishimura@inria.fr Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- kernel/sched/fair.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 4ef95b2210b5e..d5ae744deb39d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8070,7 +8070,7 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu /* * Scan the local SMT mask for idle CPUs. */ -static int select_idle_smt(struct task_struct *p, int target) +static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) { int cpu; @@ -8081,6 +8081,12 @@ static int select_idle_smt(struct task_struct *p, int target) #endif if (cpu == target) continue; + /* + * Check if the CPU is in the LLC scheduling domain of @target. + * Due to isolcpus, there is no guarantee that all the siblings are in the domain. + */ + if (!cpumask_test_cpu(cpu, sched_domain_span(sd))) + continue; if (available_idle_cpu(cpu) || sched_idle_cpu(cpu)) return cpu; } @@ -8104,7 +8110,7 @@ static inline int select_idle_core(struct task_struct *p, int core, struct cpuma return __select_idle_cpu(core, p); } -static inline int select_idle_smt(struct task_struct *p, int target) +static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) { return -1; } @@ -8441,7 +8447,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target) has_idle_core = test_idle_cores(target); if (!has_idle_core && cpus_share_cache(prev, target)) { - i = select_idle_smt(p, prev); + i = select_idle_smt(p, sd, prev); if ((unsigned int)i < nr_cpumask_bits) return i; } -- 2.34.1

2 1

[PATCH OLK-5.10] serial: core: Fix atomicity violation in uart_tiocmget
by Yi Yang 06 Nov '24

06 Nov '24

From: Gui-Dong Han <2045gemini(a)gmail.com> mainline inclusion from mainline-v6.8-rc3 commit 30926783a46841c2d1bbf3f74067ba85d304fd0d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MRY CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In uart_tiocmget(): result = uport->mctrl; uart_port_lock_irq(uport); result |= uport->ops->get_mctrl(uport); uart_port_unlock_irq(uport); ... return result; In uart_update_mctrl(): uart_port_lock_irqsave(port, &flags); ... port->mctrl = (old & ~clear) | set; ... port->ops->set_mctrl(port, port->mctrl); ... uart_port_unlock_irqrestore(port, flags); An atomicity violation is identified due to the concurrent execution of uart_tiocmget() and uart_update_mctrl(). After assigning result = uport->mctrl, the mctrl value may change in uart_update_mctrl(), leading to a mismatch between the value returned by uport->ops->get_mctrl(uport) and the mctrl value previously read. This can result in uart_tiocmget() returning an incorrect value. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To address this issue, it is suggested to move the line result = uport->mctrl inside the uart_port_lock block to ensure atomicity and prevent the mctrl value from being altered during the execution of uart_tiocmget(). With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the absence of the requisite hardware, we are unable to conduct runtime testing of the patch. Therefore, our verification is solely based on code logic analysis. [1] https://sites.google.com/view/basscheck/ Fixes: c5f4644e6c8b ("[PATCH] Serial: Adjust serial locking") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Link: https://lore.kernel.org/r/20240112113624.17048-1-2045gemini@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/serial_core.c [Commit 559c7ff4e324("serial: core: Use port lock wrappers") not merged, no functional change.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index c7adcf97e2a3..f86bef623953 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -1092,8 +1092,8 @@ static int uart_tiocmget(struct tty_struct *tty) goto out; if (!tty_io_error(tty)) { - result = uport->mctrl; spin_lock_irq(&uport->lock); + result = uport->mctrl; result |= uport->ops->get_mctrl(uport); spin_unlock_irq(&uport->lock); } -- 2.25.1

2 1

[PATCH OLK-6.6] serial: core: Fix atomicity violation in uart_tiocmget
by Yi Yang 06 Nov '24

06 Nov '24

From: Gui-Dong Han <2045gemini(a)gmail.com> mainline inclusion from mainline-v6.8-rc3 commit 30926783a46841c2d1bbf3f74067ba85d304fd0d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MRY CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In uart_tiocmget(): result = uport->mctrl; uart_port_lock_irq(uport); result |= uport->ops->get_mctrl(uport); uart_port_unlock_irq(uport); ... return result; In uart_update_mctrl(): uart_port_lock_irqsave(port, &flags); ... port->mctrl = (old & ~clear) | set; ... port->ops->set_mctrl(port, port->mctrl); ... uart_port_unlock_irqrestore(port, flags); An atomicity violation is identified due to the concurrent execution of uart_tiocmget() and uart_update_mctrl(). After assigning result = uport->mctrl, the mctrl value may change in uart_update_mctrl(), leading to a mismatch between the value returned by uport->ops->get_mctrl(uport) and the mctrl value previously read. This can result in uart_tiocmget() returning an incorrect value. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To address this issue, it is suggested to move the line result = uport->mctrl inside the uart_port_lock block to ensure atomicity and prevent the mctrl value from being altered during the execution of uart_tiocmget(). With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the absence of the requisite hardware, we are unable to conduct runtime testing of the patch. Therefore, our verification is solely based on code logic analysis. [1] https://sites.google.com/view/basscheck/ Fixes: c5f4644e6c8b ("[PATCH] Serial: Adjust serial locking") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Link: https://lore.kernel.org/r/20240112113624.17048-1-2045gemini@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/serial_core.c [Commit 559c7ff4e324("serial: core: Use port lock wrappers") not merged, no functional change.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 5d5570bebfeb..938e36b6cd4f 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -1105,8 +1105,8 @@ static int uart_tiocmget(struct tty_struct *tty) goto out; if (!tty_io_error(tty)) { - result = uport->mctrl; spin_lock_irq(&uport->lock); + result = uport->mctrl; result |= uport->ops->get_mctrl(uport); spin_unlock_irq(&uport->lock); } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1225/1225] mm/memory.o: warning: objtool: __apply_to_page_range()+0x67c: unreachable instruction
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: dd365884b743523ae70dbbf469bca8168f40ba93 [1225/1225] mm/memory.c: add apply_to_existing_page_range() helper config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411061528.694k8VkC-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411061528.694k8VkC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411061528.694k8VkC-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory.c:47: In file included from include/linux/hugetlb.h:44: In file included from include/linux/mempolicy.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/memory.c:4707:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct cgp_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] 4707 | DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 4708 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. >> mm/memory.o: warning: objtool: __apply_to_page_range()+0x67c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v3 OLK-5.10 0/6] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Changelog since v1: - fix incorrect patch format Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 7

[PATCH v2 OLK-5.10 0/6] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Changelog since v1: - fix incorrect patch format Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 7

[openeuler:openEuler-1.0-LTS 1218/1218] drivers/pci/pcie/dpc.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 58d584102f06f870f118644f1022c751e015e7bb [1218/1218] PCI: portdrv: Initialize service drivers directly config: x86_64-buildonly-randconfig-006-20241024 (https://download.01.org/0day-ci/archive/20241106/202411061521.R0Vz05vu-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411061521.R0Vz05vu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411061521.R0Vz05vu-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/pci/pcie/dpc.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION e33ed48bc600febcdca9e71e43cf224934dadc4f
by kernel test robot 06 Nov '24

06 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: e33ed48bc600febcdca9e71e43cf224934dadc4f !13007 CVE-2024-49950 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411060227.oM4HzgsK-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060503.rYM2XmVn-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060705.6jumqar7-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060729.yZ0sshJi-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411060820.ye1y82tJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411061140.gNjqbgZ7-lkp@intel.com arch/arm64/kernel/mpam/mpam_mon.c:48: warning: Cannot understand * @rmid_mon_exclusive_all List of allocated RMIDs with arch/arm64/kernel/mpam/mpam_mon.c:54: warning: Cannot understand * @rmid_mon_wait_all List of allocated RMIDs with default arch/arm64/kernel/mpam/mpam_mon.c:62: warning: Cannot understand * @rmid_entry - The entry in the mon list. Unverified Error/Warning (likely false positive, kindly check if interested): drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c:1024:20: warning: 'new_state' may be used uninitialized [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241029 | |-- arch-arm64-kernel-mpam-mpam_mon.c:warning:Cannot-understand-rmid_entry-The-entry-in-the-mon-list. | |-- arch-arm64-kernel-mpam-mpam_mon.c:warning:Cannot-understand-rmid_mon_exclusive_all-List-of-allocated-RMIDs-with | `-- arch-arm64-kernel-mpam-mpam_mon.c:warning:Cannot-understand-rmid_mon_wait_all-List-of-allocated-RMIDs-with-default |-- arm64-randconfig-001-20241106 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-002-20241106 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-randconfig-003-20241106 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- arch-arm64-kvm-..-..-..-virt-kvm-arm-arm.c:error:struct-sched_info-has-no-member-named-run_delay | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-004-20241106 | |-- arch-arm64-kernel-smp.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-allyesconfig | |-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241025 | `-- drivers-crypto-hisilicon-sec-sec_drv.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241030 | `-- drivers-usb-dwc3-.tmp_dwc3-qcom.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-001-20241106 | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-002-20241028 | |-- drivers-hwtracing-intel_th-msu-sink.o:warning:objtool:missing-symbol-for-section-.init.text | `-- kernel-kprobes.o:warning:objtool:register_kprobe:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20241029 | `-- drivers-spi-spi-uniphier.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-002-20241106 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-buildonly-randconfig-003-20241029 | |-- drivers-media-i2c-.tmp_ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-net-can-usb-kvaser_usb-kvaser_usb_hydra.c:warning:new_state-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-003-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-buildonly-randconfig-004-20241106 | |-- drivers-gpu-drm-nouveau-nvkm-subdev-bios-dp.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-iommu-amd_iommu_debugfs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-pci-controller-dwc-pci-exynos.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-usb-dwc3-debugfs.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-core-sound_oss.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-006-20241024 | `-- drivers-media-usb-dvb-usb-v2-anysee.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-006-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-002-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-003-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-004-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-006-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-011-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-012-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-015-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-016-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-071-20241106 | `-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init |-- x86_64-randconfig-072-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-073-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-074-20241106 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-075-20241106 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-076-20241106 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 744m configs tested: 35 configs skipped: 118 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241106 gcc-14.1.0 arm64 randconfig-002-20241106 gcc-14.1.0 arm64 randconfig-003-20241106 gcc-14.1.0 arm64 randconfig-004-20241106 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241106 clang-19 x86_64 buildonly-randconfig-002-20241106 clang-19 x86_64 buildonly-randconfig-003-20241106 clang-19 x86_64 buildonly-randconfig-004-20241106 gcc-12 x86_64 buildonly-randconfig-005-20241106 gcc-12 x86_64 buildonly-randconfig-006-20241106 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241106 clang-19 x86_64 randconfig-002-20241106 gcc-11 x86_64 randconfig-003-20241106 gcc-12 x86_64 randconfig-004-20241106 gcc-12 x86_64 randconfig-005-20241106 clang-19 x86_64 randconfig-006-20241106 gcc-11 x86_64 randconfig-011-20241106 gcc-11 x86_64 randconfig-012-20241106 gcc-12 x86_64 randconfig-013-20241106 clang-19 x86_64 randconfig-014-20241106 gcc-12 x86_64 randconfig-015-20241106 gcc-12 x86_64 randconfig-016-20241106 gcc-12 x86_64 randconfig-071-20241106 gcc-12 x86_64 randconfig-072-20241106 gcc-12 x86_64 randconfig-073-20241106 clang-19 x86_64 randconfig-074-20241106 gcc-12 x86_64 randconfig-075-20241106 clang-19 x86_64 randconfig-076-20241106 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/6] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 7

[openeuler:OLK-5.10] BUILD REGRESSION f705e909a01ee9ae75542457ca95b055dae177a0
by kernel test robot 06 Nov '24

06 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: f705e909a01ee9ae75542457ca95b055dae177a0 !13009 CVE-2024-49950 Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/ast/ast_mm.c:116 ast_pci_host_is_5c01() error: we previously assumed 'child' could be null (see line 109) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PCI_IOV-when-selected-by-CRYPTO_DEV_HISI_MIGRATION | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- arm64-randconfig-003-20241106 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- x86_64-allyesconfig | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-buildonly-randconfig-001-20241106 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | `-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE |-- x86_64-buildonly-randconfig-002-20241028 | `-- fs-crypto-fname.o:warning:objtool:fscrypt_fname_encrypt:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20241106 | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init-Werror-Wimplicit-function-declaration | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20241106 | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-buildonly-randconfig-005-20241106 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-003-20241106 | |-- security-integrity-ima-ima.h:warning:struct-ima_digest-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement |-- x86_64-randconfig-006-20241106 | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used |-- x86_64-randconfig-013-20241106 | `-- drivers-gpu-drm-nouveau-nvkm-subdev-clk-pllnv04.o:warning:objtool:nv04_pll_calc-falls-through-to-next-function-asanmodule_ctor() |-- x86_64-randconfig-014-20241106 | `-- drivers-usb-cdns3-debug.h:warning:sprintf-argument-may-overlap-destination-object-field |-- x86_64-randconfig-015-20241106 | |-- arch-x86-events-zhaoxin-uncore.c:warning:cluster_id-is-used-uninitialized | |-- arch-x86-events-zhaoxin-uncore.c:warning:subnode_id-is-used-uninitialized | |-- security-integrity-ima-ima.h:warning:struct-ima_digest-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement |-- x86_64-randconfig-074-20241106 | `-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used `-- x86_64-randconfig-161-20241029 `-- drivers-gpu-drm-ast-ast_mm.c-ast_pci_host_is_5c01()-error:we-previously-assumed-child-could-be-null-(see-line-) elapsed time: 754m configs tested: 35 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241106 gcc-14.1.0 arm64 randconfig-002-20241106 gcc-14.1.0 arm64 randconfig-003-20241106 clang-20 arm64 randconfig-004-20241106 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241106 clang-19 x86_64 buildonly-randconfig-002-20241106 clang-19 x86_64 buildonly-randconfig-003-20241106 clang-19 x86_64 buildonly-randconfig-004-20241106 gcc-12 x86_64 buildonly-randconfig-005-20241106 gcc-12 x86_64 buildonly-randconfig-006-20241106 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241106 clang-19 x86_64 randconfig-002-20241106 gcc-11 x86_64 randconfig-003-20241106 gcc-12 x86_64 randconfig-004-20241106 gcc-12 x86_64 randconfig-005-20241106 clang-19 x86_64 randconfig-006-20241106 gcc-11 x86_64 randconfig-011-20241106 gcc-11 x86_64 randconfig-012-20241106 gcc-12 x86_64 randconfig-013-20241106 clang-19 x86_64 randconfig-014-20241106 gcc-12 x86_64 randconfig-015-20241106 gcc-12 x86_64 randconfig-016-20241106 gcc-12 x86_64 randconfig-071-20241106 gcc-12 x86_64 randconfig-072-20241106 gcc-12 x86_64 randconfig-073-20241106 clang-19 x86_64 randconfig-074-20241106 gcc-12 x86_64 randconfig-075-20241106 clang-19 x86_64 randconfig-076-20241106 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] selinux: clarify return code in filename_trans_read_helper_compat()
by Yi Yang 06 Nov '24

06 Nov '24

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v6.10-rc1 commit 4e551db0426472ca305a2f3284b25af763bfe57d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MNX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For the "conflicting/duplicate rules" branch in filename_trans_read_helper_compat() the Smatch static checker reports: security/selinux/ss/policydb.c:1953 filename_trans_read_helper_compat() warn: missing error code 'rc' While the value of rc will already always be zero here, it is not obvious that it's the case and that it's the intended return value (Smatch expects rc to be assigned within 5 lines from the goto). Therefore, add an explicit assignment just before the goto to make the intent more clear and the code less error-prone. Fixes: c3a276111ea2 ("selinux: optimize storage of filename transitions") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/selinux/722b90c4-1f4b-42ff-a6c2-108ea262bd10@moroto… Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/selinux/ss/policydb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 2d528f699a22..f70399373588 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -1921,6 +1921,7 @@ static int filename_trans_read_helper_compat(struct policydb *p, void *fp) if (unlikely(ebitmap_get_bit(&datum->stypes, stype - 1))) { /* conflicting/duplicate rules are ignored */ datum = NULL; + rc = 0; goto out; } if (likely(datum->otype == otype)) -- 2.25.1

2 1

[PATCH OLK-5.10] selinux: clarify return code in filename_trans_read_helper_compat()
by Yi Yang 06 Nov '24

06 Nov '24

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v6.10-rc1 commit 4e551db0426472ca305a2f3284b25af763bfe57d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MNX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For the "conflicting/duplicate rules" branch in filename_trans_read_helper_compat() the Smatch static checker reports: security/selinux/ss/policydb.c:1953 filename_trans_read_helper_compat() warn: missing error code 'rc' While the value of rc will already always be zero here, it is not obvious that it's the case and that it's the intended return value (Smatch expects rc to be assigned within 5 lines from the goto). Therefore, add an explicit assignment just before the goto to make the intent more clear and the code less error-prone. Fixes: c3a276111ea2 ("selinux: optimize storage of filename transitions") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/selinux/722b90c4-1f4b-42ff-a6c2-108ea262bd10@moroto… Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/selinux/ss/policydb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index 82cfeab16217..2f15ab8534b2 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -1923,6 +1923,7 @@ static int filename_trans_read_helper_compat(struct policydb *p, void *fp) if (unlikely(ebitmap_get_bit(&datum->stypes, stype - 1))) { /* conflicting/duplicate rules are ignored */ datum = NULL; + rc = 0; goto out; } if (likely(datum->otype == otype)) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_mon.c:48: warning: Cannot understand * @rmid_mon_exclusive_all List of allocated RMIDs with
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 0f728d63ce7a19f1dd0dbde79197248e7c4accf6 [1231/1231] arm64/mpam: Add wait queue for monitor alloc and free config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241106/202411061140.gNjqbgZ7-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411061140.gNjqbgZ7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411061140.gNjqbgZ7-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/mpam/mpam_mon.c:48: warning: Cannot understand * @rmid_mon_exclusive_all List of allocated RMIDs with on line 48 - I thought it was a doc line >> arch/arm64/kernel/mpam/mpam_mon.c:54: warning: Cannot understand * @rmid_mon_wait_all List of allocated RMIDs with default on line 54 - I thought it was a doc line >> arch/arm64/kernel/mpam/mpam_mon.c:62: warning: Cannot understand * @rmid_entry - The entry in the mon list. on line 62 - I thought it was a doc line vim +48 arch/arm64/kernel/mpam/mpam_mon.c 46 47 /** > 48 * @rmid_mon_exclusive_all List of allocated RMIDs with 49 * exclusive available mon. 50 */ 51 static LIST_HEAD(rmid_mon_exclusive_all); 52 53 /** > 54 * @rmid_mon_wait_all List of allocated RMIDs with default 55 * 0 mon and wait for exclusive available mon. 56 */ 57 static LIST_HEAD(rmid_mon_wait_all); 58 59 static u32 rmid_ptrs_len; 60 61 /** > 62 * @rmid_entry - The entry in the mon list. 63 */ 64 static struct rmid_entry *rmid_ptrs; 65 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] static_call: Handle module init failure correctly in static_call_del_module()
by Gu Bowen 06 Nov '24

06 Nov '24

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v6.1.113 commit b566c7d8a2de403ccc9d8a06195e19bbb386d0e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8E CVE: CVE-2024-50002 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4b30051c4864234ec57290c3d142db7c88f10d8a ] Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain. If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod. The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and dereferences the pointer to the list of built-in call sites, which is obviously bogus. Cure it by checking whether the key has a sites or a mods pointer. If it's a sites pointer then the key is not to be touched. As the sites are walked in the same order as in __static_call_init() the site walk can be terminated because all subsequent sites have not been touched by the init code due to the error exit. If it was converted before the allocation fail, then the inner loop which searches for a module match will find nothing. A fail in the second allocation in __static_call_init() is harmless and does not require special treatment. The first allocation succeeded and converted the key to a module chain. That first entry has mod::mod == NULL and mod::next == NULL, so the inner loop of static_call_del_module() will neither find a module match nor a module chain. The next site in the walk was either already converted, but can't match the module, or it will exit the outer loop because it has a static_call_site pointer and not a static_call_mod pointer. Fixes: 9183c3f9ed71 ("static_call: Add inline static call infrastructure") Closes: https://lore.kernel.org/all/20230915082126.4187913-1-ruanjinjie@huawei.com Reported-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Jinjie Ruan <ruanjinjie(a)huawei.com> Link: https://lore.kernel.org/r/87zfon6b0s.ffs@tglx Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/static_call.c kernel/static_call_inline.c [Commit 8fd4ddda2f49(static_call: Don't make __static_call_return0 static) rename kernel/static_call.c to kernel/static_call_inline.c which not merge] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- kernel/static_call.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kernel/static_call.c b/kernel/static_call.c index a5df28b2bc1b..63e7c2efc5cd 100644 --- a/kernel/static_call.c +++ b/kernel/static_call.c @@ -406,6 +406,17 @@ static void static_call_del_module(struct module *mod) for (site = start; site < stop; site++) { key = static_call_key(site); + + /* + * If the key was not updated due to a memory allocation + * failure in __static_call_init() then treating key::sites + * as key::mods in the code below would cause random memory + * access and #GP. In that case all subsequent sites have + * not been touched either, so stop iterating. + */ + if (!static_call_key_has_mods(key)) + break; + if (key == prev_key) continue; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] f2fs: fix to check atomic_file in f2fs ioctl interfaces
by Gu Bowen 06 Nov '24

06 Nov '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.1.113 commit 26b07bd2e1f124b0e430c8d250023f7205c549c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSF CVE: CVE-2024-49859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bfe5c02654261bfb8bd9cb174a67f3279ea99e58 upstream. Some f2fs ioctl interfaces like f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range() missed to check atomic_write status, which may cause potential race issue, fix it. Cc: stable(a)vger.kernel.org Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/f2fs/file.c [There is context conflicts due to commit d6dd477436957(f2fs: do not allow to defragment files have FI_COMPRESS_RELEASED) not merge in f2fs_defragment_range().] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- fs/f2fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index 0b355f00225b..12351851cb2e 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -2614,6 +2614,11 @@ static int f2fs_defragment_range(struct f2fs_sb_info *sbi, inode_lock(inode); + if (f2fs_is_atomic_file(inode)) { + err = -EINVAL; + goto out; + } + /* writeback all dirty pages in the range */ err = filemap_write_and_wait_range(inode->i_mapping, range->start, range->start + range->len - 1); @@ -2821,6 +2826,11 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in, goto out; } + if (f2fs_is_atomic_file(src) || f2fs_is_atomic_file(dst)) { + ret = -EINVAL; + goto out_unlock; + } + ret = -EINVAL; if (pos_in + len > src->i_size || pos_in + len < pos_in) goto out_unlock; @@ -3267,6 +3277,11 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg) goto out; } + if (f2fs_is_atomic_file(inode)) { + ret = -EINVAL; + goto out; + } + if (!pin) { clear_inode_flag(inode, FI_PIN_FILE); f2fs_i_gc_failures_write(inode, 0); -- 2.25.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 06 Nov '24

06 Nov '24

您好！ Kernel 邀请您参加 2024-11-08 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 征集中（可回复本邮件申请，也可直接填写至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/983782327 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-11-08 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 征集中（可回复本邮件申请，也可直接填写至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/983782327. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] NFSD: Mark filecache "down" if init fails
by Li Lingfeng 06 Nov '24

06 Nov '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v6.6.57 commit 4ab072325c621e0e4fadff991c7a00379a16a037 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB22IQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dc0d0f885aa422f621bc1c2124133eff566b0bc8 ] NeilBrown says: > The handling of NFSD_FILE_CACHE_UP is strange. nfsd_file_cache_init() > sets it, but doesn't clear it on failure. So if nfsd_file_cache_init() > fails for some reason, nfsd_file_cache_shutdown() would still try to > clean up if it was called. Reported-by: NeilBrown <neilb(a)suse.de> Fixes: c7b824c3d06c ("NFSD: Replace the "init once" mechanism") Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/filecache.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c index 5c9f8f8404d5..6f2bcbfde45e 100644 --- a/fs/nfsd/filecache.c +++ b/fs/nfsd/filecache.c @@ -718,7 +718,7 @@ nfsd_file_cache_init(void) ret = rhltable_init(&nfsd_file_rhltable, &nfsd_file_rhash_params); if (ret) - return ret; + goto out; ret = -ENOMEM; nfsd_filecache_wq = alloc_workqueue("nfsd_filecache", 0, 0); @@ -770,6 +770,8 @@ nfsd_file_cache_init(void) INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_gc_worker); out: + if (ret) + clear_bit(NFSD_FILE_CACHE_UP, &nfsd_file_flags); return ret; out_notifier: lease_unregister_notifier(&nfsd_file_lease_notifier); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] nfs: fix rpc_task use-after-free when open and close different files concurrently
by Li Lingfeng 06 Nov '24

06 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB20ED CVE: NA -------------------------------- Commit b5e9ee1ed8bb("[Huawei] NFSv4: release seqid when open failed for nfs4.0") describes a scenario where a file system is forcibly unmounted when different files are opened concurrently. There is another similar issue where performing concurrent operations of opening file B, closing file A, and unmounting while file A is open which can trigger a UAF of rpc_task. T1: OPEN fileB T2: CLOSE fileA nfs4_do_open ... .rpc_call_prepare nfs_wait_on_sequence // insert to sequence list(T1) // This is the first entry, // and continue. nfs4_do_close .rpc_call_prepare nfs_wait_on_sequence // insert to sequence list(T2) // This is the second entry, // and wait. [T3 wake up T2 here] ... rpc_put_task // finish rpc_task and free it .rpc_call_done nfs_release_seqid list_first_entry // get T1 from list rpc_wake_up_queued_task // wake up T1, UAF _nfs4_open_and_get_state _nfs4_open_and_get_state _nfs4_opendata_to_nfs4_state nfs_release_seqid // remove T1 from list T3: UMOUNT nfs_umount_begin rpc_killall_tasks rpc_signal_task // get T2 from clnt->cl_tasks rpc_wake_up_queued_task_set_status rpc_wake_up_task_queue_set_status_locked rpc_wake_up_task_on_wq_queue_action_locked __rpc_do_wake_up_task_on_wq rpc_make_runnable wake_up_bit // wake up T2 Although the rpc_task corresponding to T1 has been freed, its seqid has not been removed from the sequence list. Additionally, even though T2 is the last task in the list, the current logic of nfs_release_seqid allows T2 to access tasks inserted before it, which can trigger UAF. Fix it by using nfs_release_seqid_inorder instead of nfs_release_seqid in nfs4_close_done. Fixes: 72211dbe727f ("NFSv4: Release the sequence id before restarting a CLOSE rpc call") Link: https://lore.kernel.org/all/b9924cd2-253a-6c44-3331-56310f13df0b@huawei.com/ Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index b19a738dd2e1..94f73294b8d6 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -3403,7 +3403,7 @@ static void nfs4_close_done(struct rpc_task *task, void *data) res_stateid, calldata->arg.fmode); out_release: task->tk_status = 0; - nfs_release_seqid(calldata->arg.seqid); + nfs_release_seqid_inorder(calldata->arg.seqid); nfs_refresh_inode(calldata->inode, &calldata->fattr); dprintk("%s: done, ret = %d!\n", __func__, task->tk_status); return; -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] Fix UAF of rpc_task
by Li Lingfeng 06 Nov '24

06 Nov '24

Li Lingfeng (1): nfs: fix rpc_task use-after-free when open and close different files concurrently Yang Erkun (1): NFSv4: release seqid when open failed for nfs4.0 fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4proc.c | 4 +++- fs/nfs/nfs4state.c | 18 ++++++++++++++++++ 3 files changed, 22 insertions(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH OLK-6.6 0/2] Fix UAF of rpc_task
by Li Lingfeng 06 Nov '24

06 Nov '24

Li Lingfeng (1): nfs: fix rpc_task use-after-free when open and close different files concurrently Yang Erkun (1): NFSv4: release seqid when open failed for nfs4.0 fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4proc.c | 4 +++- fs/nfs/nfs4state.c | 18 ++++++++++++++++++ 3 files changed, 22 insertions(+), 1 deletion(-) -- 2.31.1

2 3

[openeuler:openEuler-1.0-LTS 1225/1225] drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

Hi Alexander, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 4d516770f81434cde260d33430626e3880b9902e [1225/1225] intel_th: msu-sink: An example msu buffer "sink" config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411060820.ye1y82tJ-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060820.ye1y82tJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060820.ye1y82tJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

Hi Mark, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: c1acb21b32a3bb601453764c9eac9fc8fbb3a81d [1231/1231] Merge branch 'spi-4.19' into spi-next config: x86_64-buildonly-randconfig-002-20241029 (https://download.01.org/0day-ci/archive/20241106/202411060705.6jumqar7-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060705.6jumqar7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060705.6jumqar7-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/spi/spi-uniphier.c:12: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1558:1: note: in expansion of macro 'module_exit' 1558 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/platform_device.h:14, from drivers/spi/spi-uniphier.c:13: drivers/spi/spi-uniphier.c:518:24: note: 'cleanup_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1554:20: note: in definition of macro 'module_driver' 1554 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1553:1: note: in expansion of macro 'module_init' 1553 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:24: note: 'init_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1549:19: note: in definition of macro 'module_driver' 1549 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1218/1218] drivers/media/usb/dvb-usb-v2/anysee.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 56bc1719652e7a937bc9856f76f0c0fbf8ce1b23 [1218/1218] objtool: Support GCC 9 cold subfunction naming scheme config: x86_64-buildonly-randconfig-006-20241024 (https://download.01.org/0day-ci/archive/20241106/202411060729.yZ0sshJi-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060729.yZ0sshJi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060729.yZ0sshJi-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/media/usb/dvb-usb-v2/anysee.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1219/1219] drivers/crypto/hisilicon/sec/sec_drv.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 915e4e8413dacc086efcef4de04fdfdca57e8b1c [1219/1219] crypto: hisilicon - SEC security accelerator driver config: x86_64-buildonly-randconfig-001-20241025 (https://download.01.org/0day-ci/archive/20241106/202411060503.rYM2XmVn-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060503.rYM2XmVn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060503.rYM2XmVn-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/crypto/hisilicon/sec/sec_drv.c:843: warning: Function parameter or member 'queue' not described in 'sec_queue_empty' >> drivers/crypto/hisilicon/sec/sec_drv.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1225/1225] kernel/kprobes.o: warning: objtool: register_kprobe()+0x6ee: unreachable instruction
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 388c9a84a807812e7226e0e1ca606563e14a7f5a [1225/1225] kprobes: Warn if the kprobe is reregistered config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411060227.oM4HzgsK-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060227.oM4HzgsK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060227.oM4HzgsK-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/kprobes.c:120:14: warning: no previous prototype for function 'alloc_insn_page' [-Wmissing-prototypes] 120 | void __weak *alloc_insn_page(void) | ^ kernel/kprobes.c:120:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 120 | void __weak *alloc_insn_page(void) | ^ | static kernel/kprobes.c:125:13: warning: no previous prototype for function 'free_insn_page' [-Wmissing-prototypes] 125 | void __weak free_insn_page(void *page) | ^ kernel/kprobes.c:125:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 125 | void __weak free_insn_page(void *page) | ^ | static 2 warnings generated. kernel/kprobes.c:145: warning: Function parameter or member 'c' not described in '__get_insn_slot' >> kernel/kprobes.o: warning: objtool: register_kprobe()+0x6ee: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_resctrl.c:566: warning: Function parameter or member 'cols' not described in 'rmid_transform'
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5e5fe4767eb1c2cdaeeddcd731adf35da6453c12 commit: 75008419705983d9d2027127568111f88a26a67c [1231/1231] arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241106/202411060122.PBQDO81j-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411060122.PBQDO81j-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411060122.PBQDO81j-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_resctrl.c:178:1: warning: conflicting types for 'mpam_get_raw_resctrl_resource' due to enum/integer mismatch; have 'struct raw_resctrl_resource *(enum resctrl_resource_level)' [-Wenum-int-mismatch] 178 | mpam_get_raw_resctrl_resource(enum resctrl_resource_level level) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/kernel/mpam/mpam_resctrl.c:47: arch/arm64/kernel/mpam/mpam_internal.h:192:1: note: previous declaration of 'mpam_get_raw_resctrl_resource' with type 'struct raw_resctrl_resource *(u32)' {aka 'struct raw_resctrl_resource *(unsigned int)'} 192 | mpam_get_raw_resctrl_resource(u32 level); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:521:5: warning: no previous prototype for 'closid_bitmap_init' [-Wmissing-prototypes] 521 | int closid_bitmap_init(void) | ^~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:1306:5: warning: no previous prototype for 'cpus_ctrl_write' [-Wmissing-prototypes] 1306 | int cpus_ctrl_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask, | ^~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c:1403:5: warning: no previous prototype for 'cpus_mon_write' [-Wmissing-prototypes] 1403 | int cpus_mon_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask, | ^~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_resctrl.c: In function 'rdt_last_cmd_printf': arch/arm64/kernel/mpam/mpam_resctrl.c:1583:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 1583 | seq_buf_vprintf(&last_cmd_status, fmt, ap); | ^~~~~~~~~~~~~~~ >> arch/arm64/kernel/mpam/mpam_resctrl.c:566: warning: Function parameter or member 'cols' not described in 'rmid_transform' vim +566 arch/arm64/kernel/mpam/mpam_resctrl.c 549 550 /** 551 * struct rmid_transform - Matrix for transforming rmid to partid and pmg 552 * @rows: Number of bits for remap_body[:] bitmap 553 * @clos: Number of bitmaps 554 * @nr_usage: Number rmid we have 555 * @stride: Step stride from transforming rmid to partid and pmg 556 * @remap_body: Storing bitmaps' entry and itself 557 * @remap_enabled: Does remap_body init done 558 */ 559 struct rmid_transform { 560 u32 rows; 561 u32 cols; 562 u32 nr_usage; 563 int stride; 564 unsigned long **remap_body; 565 bool remap_enabled; > 566 }; 567 static struct rmid_transform rmid_remap_matrix; 568 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-47702
by Chen Zhongjin 05 Nov '24

05 Nov '24

CVE-2024-47702 Chen Zhongjin (1): bpf: Fix kabi breakage in struct bpf_insn_access_aux Yonghong Song (1): bpf: Fail verification for sign-extension of packet data/data_end/data_meta include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-47702
by Chen Zhongjin 05 Nov '24

05 Nov '24

CVE-2024-47702 Chen Zhongjin (1): bpf: Fix kabi breakage in struct bpf_insn_access_aux Yonghong Song (1): bpf: Fail verification for sign-extension of packet data/data_end/data_meta include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 1257/1257] net/can/j1939/.tmp_main.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 05 Nov '24

05 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0c1156b86933300fc91692f839a7f6e0676f55d7 commit: e0c2ee9edcacfdda0e806166eaec1310cdf9e324 [1257/1257] can: add support of SAE J1939 protocol config: x86_64-buildonly-randconfig-002-20241102 (https://download.01.org/0day-ci/archive/20241105/202411051936.7BMR1oXT-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411051936.7BMR1oXT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411051936.7BMR1oXT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/can/j1939/.tmp_main.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: add more sanity checks to qdisc_pkt_len_init()
by Liu Jian 05 Nov '24

05 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.55 commit 9b0ee571d20a238a22722126abdfde61f1b2bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8W CVE: CVE-2024-49948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ] One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes. - 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8 virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size. We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len. Fixes: 1def9238d4aa ("net_sched: more precise pkt_len computation") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 4935ff1eecc7..facf8e3f41d0 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3754,10 +3754,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len += sizeof(struct udphdr); } - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, - shinfo->gso_size); + if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { + int payload = skb->len - hdr_len; + /* Malicious packet. */ + if (payload <= 0) + return; + gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); + } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } } -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1] net: add more sanity checks to qdisc_pkt_len_init()
by Liu Jian 05 Nov '24

05 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit 566a931a1436d0e0ad13708ea55479b95426213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8W CVE: CVE-2024-49948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ] One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes. - 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8 virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size. We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len. Fixes: 1def9238d4aa ("net_sched: more precise pkt_len computation") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 1cac2557f1b9..2b8e1f314ef2 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3756,10 +3756,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len += sizeof(struct udphdr); } - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, - shinfo->gso_size); + if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { + int payload = skb->len - hdr_len; + /* Malicious packet. */ + if (payload <= 0) + return; + gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); + } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } } -- 2.34.1

2 3

[PATCH OLK-5.10] net: add more sanity checks to qdisc_pkt_len_init()
by Liu Jian 05 Nov '24

05 Nov '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.227 commit 566a931a1436d0e0ad13708ea55479b95426213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8W CVE: CVE-2024-49948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ] One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes. It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes. - 20 bytes of IPv4 header - 60 bytes TCP header - a small gso_size like 8 virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size. We need to make detect this case to not underflow qdisc_skb_cb(skb)->pkt_len. Fixes: 1def9238d4aa ("net_sched: more precise pkt_len computation") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index ed4d42965bcb..7c7994d86a94 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3771,10 +3771,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len += sizeof(struct udphdr); } - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, - shinfo->gso_size); + if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { + int payload = skb->len - hdr_len; + /* Malicious packet. */ + if (payload <= 0) + return; + gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); + } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } } -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1225/1225] drivers/cpuidle/cpuidle-haltpoll.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 05 Nov '24

05 Nov '24

Hi Marcelo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0c1156b86933300fc91692f839a7f6e0676f55d7 commit: 8104395ba98a81c8cb1ddd245482baca0d57d163 [1225/1225] add cpuidle-haltpoll driver config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241105/202411051849.OUFvUDzd-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411051849.OUFvUDzd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411051849.OUFvUDzd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpuidle/cpuidle-haltpoll.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-47702
by Chen Zhongjin 05 Nov '24

05 Nov '24

CVE-2024-47702 Chen Zhongjin (1): bpf: Fix kabi breakage in struct bpf_insn_access_aux Yonghong Song (1): bpf: Fail verification for sign-extension of packet data/data_end/data_meta include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 1/2] bpf: Fail verification for sign-extension of packet data/data_end/data_meta
by Chen Zhongjin 05 Nov '24

05 Nov '24

From: Yonghong Song <yonghong.song(a)linux.dev> mainline inclusion from mainline-v6.12-rc1 commit 92de36080c93296ef9005690705cba260b9bd68a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJQ CVE: CVE-2024-47702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a kernel crash due to commit 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses"). The reason is due to sign-extension of 32-bit load for packet data/data_end/data_meta uapi field. The original code looks like: r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ r3 = *(u32 *)(r1 + 80) /* load __sk_buff->data_end */ r0 = r2 r0 += 8 if r3 > r0 goto +1 ... Note that __sk_buff->data load has 32-bit sign extension. After verification and convert_ctx_accesses(), the final asm code looks like: r2 = *(u64 *)(r1 +208) r2 = (s32)r2 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 ... Note that 'r2 = (s32)r2' may make the kernel __sk_buff->data address invalid which may cause runtime failure. Currently, in C code, typically we have void *data = (void *)(long)skb->data; void *data_end = (void *)(long)skb->data_end; ... and it will generate r2 = *(u64 *)(r1 +208) r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 If we allow sign-extension, void *data = (void *)(long)(int)skb->data; void *data_end = (void *)(long)skb->data_end; ... the generated code looks like r2 = *(u64 *)(r1 +208) r2 <<= 32 r2 s>>= 32 r3 = *(u64 *)(r1 +80) r0 = r2 r0 += 8 if r3 > r0 goto pc+1 and this will cause verification failure since "r2 <<= 32" is not allowed as "r2" is a packet pointer. To fix this issue for case r2 = *(s32 *)(r1 + 76) /* load __sk_buff->data */ this patch added additional checking in is_valid_access() callback function for packet data/data_end/data_meta access. If those accesses are with sign-extenstion, the verification will fail. [1] https://lore.kernel.org/bpf/000000000000c90eee061d236d37@google.com/ Reported-by: syzbot+ad9ec60c8eaf69e6f99c(a)syzkaller.appspotmail.com Fixes: 1f1e864b6555 ("bpf: Handle sign-extenstin ctx member accesses") Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20240723153439.2429035-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Conflicts: include/linux/bpf.h [fix context change in struct bpf_insn_access_aux] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 5 +++-- net/core/filter.c | 21 ++++++++++++++++----- 3 files changed, 20 insertions(+), 7 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index beec79b4d74b..e1447c33f8e2 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -914,6 +914,7 @@ static_assert(__BPF_REG_TYPE_MAX <= BPF_BASE_TYPE_LIMIT); struct bpf_insn_access_aux { enum bpf_reg_type reg_type; KABI_FILL_HOLE(bool is_retval) /* is accessing function return value ? */ + bool is_ldsx; union { int ctx_field_size; struct { diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e11daa9fccee..915ff766ec3d 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5576,12 +5576,13 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, /* check access to 'struct bpf_context' fields. Supports fixed offsets only */ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size, enum bpf_access_type t, enum bpf_reg_type *reg_type, - struct btf **btf, u32 *btf_id, bool *is_retval) + struct btf **btf, u32 *btf_id, bool *is_retval, bool is_ldsx) { struct bpf_insn_access_aux info = { .reg_type = *reg_type, .log = &env->log, .is_retval = false, + .is_ldsx = is_ldsx, }; if (env->ops->is_valid_access && @@ -6844,7 +6845,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn return err; err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf, - &btf_id, &is_retval); + &btf_id, &is_retval, is_ldsx); if (err) verbose_linfo(env, insn_idx, "; "); if (!err && t == BPF_READ && value_regno >= 0) { diff --git a/net/core/filter.c b/net/core/filter.c index e16d746c23da..e4f1dc9f222b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -8601,13 +8601,16 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type if (off + size > offsetofend(struct __sk_buff, cb[4])) return false; break; + case bpf_ctx_range(struct __sk_buff, data): + case bpf_ctx_range(struct __sk_buff, data_meta): + case bpf_ctx_range(struct __sk_buff, data_end): + if (info->is_ldsx || size != size_default) + return false; + break; case bpf_ctx_range_till(struct __sk_buff, remote_ip6[0], remote_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, local_ip6[0], local_ip6[3]): case bpf_ctx_range_till(struct __sk_buff, remote_ip4, remote_ip4): case bpf_ctx_range_till(struct __sk_buff, local_ip4, local_ip4): - case bpf_ctx_range(struct __sk_buff, data): - case bpf_ctx_range(struct __sk_buff, data_meta): - case bpf_ctx_range(struct __sk_buff, data_end): if (size != size_default) return false; break; @@ -9051,6 +9054,14 @@ static bool xdp_is_valid_access(int off, int size, } } return false; + } else { + switch (off) { + case offsetof(struct xdp_md, data_meta): + case offsetof(struct xdp_md, data): + case offsetof(struct xdp_md, data_end): + if (info->is_ldsx) + return false; + } } switch (off) { @@ -9381,12 +9392,12 @@ static bool flow_dissector_is_valid_access(int off, int size, switch (off) { case bpf_ctx_range(struct __sk_buff, data): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET; return true; case bpf_ctx_range(struct __sk_buff, data_end): - if (size != size_default) + if (info->is_ldsx || size != size_default) return false; info->reg_type = PTR_TO_PACKET_END; return true; -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS 0/5] ext4: fix CVE-2024-47701
by Baokun Li 05 Nov '24

05 Nov '24

Eric Whitney (1): ext4: fix RENAME_WHITEOUT handling for inline directories Thadeu Lima de Souza Cascardo (4): ext4: ext4_search_dir should return a proper error ext4: return error on ext4_find_inline_entry ext4: explicitly exit when ext4_find_inline_entry returns an error ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- fs/ext4/namei.c | 25 ++++++++++++++----------- 2 files changed, 39 insertions(+), 21 deletions(-) -- 2.46.1

2 6

[PATCH OLK-5.10 0/4] ext4: fix CVE-2024-47701
by Baokun Li 05 Nov '24

05 Nov '24

Thadeu Lima de Souza Cascardo (4): ext4: ext4_search_dir should return a proper error ext4: return error on ext4_find_inline_entry ext4: explicitly exit when ext4_find_inline_entry returns an error ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- fs/ext4/namei.c | 14 ++++++++------ 2 files changed, 33 insertions(+), 16 deletions(-) -- 2.46.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/5] ext4: fix CVE-2024-47701
by Baokun Li 05 Nov '24

05 Nov '24

Eric Whitney (1): ext4: fix RENAME_WHITEOUT handling for inline directories Thadeu Lima de Souza Cascardo (4): ext4: ext4_search_dir should return a proper error ext4: return error on ext4_find_inline_entry ext4: explicitly exit when ext4_find_inline_entry returns an error ext4: avoid OOB when system.data xattr changes underneath the filesystem fs/ext4/inline.c | 35 +++++++++++++++++++++++++---------- fs/ext4/namei.c | 25 ++++++++++++++----------- 2 files changed, 39 insertions(+), 21 deletions(-) -- 2.46.1

2 6

[PATCH OLK-6.6 0/2] ext4: some dependencies of CVE-2024-47701
by Baokun Li 05 Nov '24

05 Nov '24

Thadeu Lima de Souza Cascardo (2): ext4: ext4_search_dir should return a proper error ext4: explicitly exit when ext4_find_inline_entry returns an error fs/ext4/namei.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) -- 2.46.1

2 3

[openeuler:openEuler-1.0-LTS 1257/1257] net/9p/.tmp_client.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 05 Nov '24

05 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0c1156b86933300fc91692f839a7f6e0676f55d7 commit: a6fb923f7803f40a567445dfe1ff3a539c8adc1f [1257/1257] 9p: Use a slab for allocating requests config: x86_64-buildonly-randconfig-002-20241102 (https://download.01.org/0day-ci/archive/20241105/202411051635.WyTNB2ku-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411051635.WyTNB2ku-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411051635.WyTNB2ku-lkp@intel.com/ All warnings (new ones prefixed by >>): net/9p/client.c:376: warning: Function parameter or member 'c' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'req' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'status' not described in 'p9_client_cb' net/9p/client.c:523: warning: Function parameter or member 'uidata' not described in 'p9_check_zc_errors' net/9p/client.c:774: warning: Function parameter or member 'in_hdrlen' not described in 'p9_client_zc_rpc' net/9p/client.c:774: warning: Excess function parameter 'hdrlen' description in 'p9_client_zc_rpc' net/9p/.tmp_client.o: warning: objtool: parse_opts()+0x2c3: sibling call from callable instruction with modified stack frame net/9p/.tmp_client.o: warning: objtool: p9_client_destroy()+0x6f: sibling call from callable instruction with modified stack frame net/9p/.tmp_client.o: warning: objtool: p9_client_readdir()+0x179: sibling call from callable instruction with modified stack frame net/9p/.tmp_client.o: warning: objtool: p9_client_write()+0x10d: sibling call from callable instruction with modified stack frame net/9p/.tmp_client.o: warning: objtool: p9_client_read()+0x1f8: sibling call from callable instruction with modified stack frame net/9p/.tmp_client.o: warning: objtool: p9_client_clunk()+0x13: sibling call from callable instruction with modified stack frame >> net/9p/.tmp_client.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drivers/perf: hisi: Enable HiSilicon Erratum 162700402 quirk for HIP09
by Yushan Wang 05 Nov '24

05 Nov '24

From: Junhao He <hejunhao3(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit e10b6976f6b9afdf3564f88c851e42d139bb19c0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB23U8 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- HiSilicon UC PMU v2 suffers the erratum 162700402 that the PMU counter cannot be set due to the lack of clock under power saving mode. This will lead to error or inaccurate counts. The clock can be enabled by the PMU global enabling control. This patch tries to fix this by set the UC PMU enable before set event period to turn on the clock, and then restore the UC PMU configuration. The counter register can hold its value without a clock. Fixes: 312eca95e28d ("drivers/perf: hisi: Add support for HiSilicon UC PMU driver") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Reviewed-by: Yicong Yang <yangyicong(a)hisilicon.com> Link: https://lore.kernel.org/r/20240227125231.53127-1-hejunhao3@huawei.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: zhangqz <14294317+zwx1160575(a)user.noreply.gitee.com> --- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 42 ++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c index 636fb79647c8..481dcc9e8fbf 100644 --- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c @@ -287,12 +287,52 @@ static u64 hisi_uc_pmu_read_counter(struct hisi_pmu *uc_pmu, return readq(uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx)); } -static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu, +static bool hisi_uc_pmu_get_glb_en_state(struct hisi_pmu *uc_pmu) +{ + u32 val; + + val = readl(uc_pmu->base + HISI_UC_EVENT_CTRL_REG); + return !!FIELD_GET(HISI_UC_EVENT_GLB_EN, val); +} + +static void hisi_uc_pmu_write_counter_normal(struct hisi_pmu *uc_pmu, struct hw_perf_event *hwc, u64 val) { writeq(val, uc_pmu->base + HISI_UC_CNTR_REGn(hwc->idx)); } +static void hisi_uc_pmu_write_counter_quirk_v2(struct hisi_pmu *uc_pmu, + struct hw_perf_event *hwc, u64 val) +{ + hisi_uc_pmu_start_counters(uc_pmu); + hisi_uc_pmu_write_counter_normal(uc_pmu, hwc, val); + hisi_uc_pmu_stop_counters(uc_pmu); +} + +static void hisi_uc_pmu_write_counter(struct hisi_pmu *uc_pmu, + struct hw_perf_event *hwc, u64 val) +{ + bool enable = hisi_uc_pmu_get_glb_en_state(uc_pmu); + bool erratum = uc_pmu->identifier == HISI_PMU_V2; + + /* + * HiSilicon UC PMU v2 suffers the erratum 162700402 that the + * PMU counter cannot be set due to the lack of clock under power + * saving mode. This will lead to error or inaccurate counts. + * The clock can be enabled by the PMU global enabling control. + * The irq handler and pmu_start() will call the function to set + * period. If the function under irq context, the PMU has been + * enabled therefore we set counter directly. Other situations + * the PMU is disabled, we need to enable it to turn on the + * counter clock to set period, and then restore PMU enable + * status, the counter can hold its value without a clock. + */ + if (enable || !erratum) + hisi_uc_pmu_write_counter_normal(uc_pmu, hwc, val); + else + hisi_uc_pmu_write_counter_quirk_v2(uc_pmu, hwc, val); +} + static void hisi_uc_pmu_enable_counter_int(struct hisi_pmu *uc_pmu, struct hw_perf_event *hwc) { -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_ctrlmon.c:403: warning: Function parameter or member 'type' not described in 'show_doms'
by kernel test robot 05 Nov '24

05 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0d426553bb97ebfcb4ea34e8fd63477a44316644 commit: 58e843d94efe3f7085dfaac06cb1d011ecb898b1 [1231/1231] arm64/mpam: resctrl: Support priority and hardlimit(Memory bandwidth) configuration config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241105/202411051527.GvGiUwZk-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411051527.GvGiUwZk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411051527.GvGiUwZk-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'add_schema': arch/arm64/kernel/mpam/mpam_ctrlmon.c:53:37: warning: variable 'sc_hdl' set but not used [-Wunused-but-set-variable] 53 | struct resctrl_schema_ctrl *sc_hdl = NULL; | ^~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c:52:37: warning: variable 'sc_pri' set but not used [-Wunused-but-set-variable] 52 | struct resctrl_schema_ctrl *sc_pri = NULL; | ^~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_mkdir_mondata_all_subdir': arch/arm64/kernel/mpam/mpam_ctrlmon.c:676:54: warning: variable 'rr' set but not used [-Wunused-but-set-variable] 676 | struct raw_resctrl_resource *rr; | ^~ arch/arm64/kernel/mpam/mpam_ctrlmon.c:403: warning: Function parameter or member 's' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:403: warning: Function parameter or member 'r' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:403: warning: Function parameter or member 'schema_name' not described in 'show_doms' >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:403: warning: Function parameter or member 'type' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:403: warning: Function parameter or member 'closid' not described in 'show_doms' vim +403 arch/arm64/kernel/mpam/mpam_ctrlmon.c 1abcabe9dab59ec arch/arm64/kernel/mpam_ctrlmon.c Yang Yingliang 2019-01-30 389 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 390 /** 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 391 * MPAM resources such as L2 may have too many domains for arm64, 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 392 * at this time we should rearrange this display for brevity and 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 393 * harmonious interaction. 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 394 * 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 395 * Before rearrangement: L2:0=ff;1=ff;2=fc;3=ff;4=f;....;255=ff 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 396 * After rearrangement: L2:S;2=fc;S;4=f;S 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 397 * Those continuous fully sharable domains will be combined into 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 398 * a single "S" simply. 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 399 */ 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 400 static void show_doms(struct seq_file *s, struct resctrl_resource *r, 58e843d94efe3f7 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 401 char *schema_name, enum resctrl_ctrl_type type, 58e843d94efe3f7 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 402 struct sd_closid *closid) be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 @403 { 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 404 struct raw_resctrl_resource *rr = r->res; be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 405 struct rdt_domain *dom; 857e8d34273e190 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 406 struct msr_param para; be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 407 bool sep = false; 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 408 bool rg = false; 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 409 bool prev_auto_fill = false; 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 410 u32 reg_val; 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 411 857e8d34273e190 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 412 para.closid = closid; 58e843d94efe3f7 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 413 para.type = type; 857e8d34273e190 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 414 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 415 if (r->dom_num > RESCTRL_SHOW_DOM_MAX_NUM) 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 416 rg = true; be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 417 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 418 seq_printf(s, "%*s:", max_name_width, schema_name); be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 419 list_for_each_entry(dom, &r->domains, list) { 857e8d34273e190 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 420 reg_val = rr->msr_read(dom, &para); 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 421 58e843d94efe3f7 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 422 if (rg && reg_val == r->default_ctrl[SCHEMA_COMM] && 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 423 prev_auto_fill == true) 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 424 continue; 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 425 be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 426 if (sep) be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 427 seq_puts(s, ";"); 58e843d94efe3f7 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 428 if (rg && reg_val == r->default_ctrl[SCHEMA_COMM]) { 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 429 prev_auto_fill = true; 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 430 seq_puts(s, "S"); 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 431 } else { 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 432 seq_printf(s, rr->format_str, dom->id, 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 433 max_data_width, reg_val); 7243df9bf3ab413 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 434 } be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 435 sep = true; be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 436 } be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 437 seq_puts(s, "\n"); be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 438 } be2167d2a188dc2 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 439 :::::: The code at line 403 was first introduced by commit :::::: be2167d2a188dc20648fa10c2c5ccd56ba579533 arm64/mpam: support resctrl_group_schemata_show :::::: TO: Xie XiuQi <xiexiuqi(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/7] Some patches of RDMA/hns from Linux to OLK-6.6
by Chengchang Tang 05 Nov '24

05 Nov '24

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some patches of RDMA/hns from Linux to OLK-6.6 Junxian Huang (1): RDMA/hns: Use dev_* printings in hem code instead of ibdev_* Xinghai Cen (2): Revert "RDMA/hns: Fix missing spin_lock_init() for qp flush lock" Revert "RDMA/hns: Fix flush cqe error when racing with destroy qp" Yuyu Li (1): RDMA/hns: Modify debugfs name wenglianfa (3): RDMA/hns: Fix an AEQE overflow error caused by untimely update of eq_db_ci RDMA/hns: Fix flush cqe error when racing with destroy qp RDMA/hns: Fix cpu stuck caused by printings during reset drivers/infiniband/hw/hns/hns_roce_cq.c | 4 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 3 +- drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/hns/hns_roce_hem.c | 44 ++++---- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 100 +++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 5 + drivers/infiniband/hw/hns/hns_roce_qp.c | 56 +++++++---- 7 files changed, 125 insertions(+), 88 deletions(-) -- 2.33.0

2 8

[PATCH OLK-6.6] tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
by Yi Yang 05 Nov '24

05 Nov '24

From: Longlong Xia <xialonglong(a)kylinos.cn> stable inclusion from stable-v6.6.58 commit c29f192e0d44cc1cbaf698fa1ff198f63556691a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB0EQM CVE: CVE-2024-50073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 upstream. BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock. Signed-off-by: Longlong Xia <xialonglong(a)kylinos.cn> Cc: stable <stable(a)kernel.org> Suggested-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 5fc8540a83e3..8559ba1361c6 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -3156,6 +3156,8 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) mutex_unlock(&gsm->mutex); /* Now wipe the queues */ tty_ldisc_flush(gsm->tty); + + guard(spinlock_irqsave)(&gsm->tx_lock); list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_ctrl_list); -- 2.25.1

2 1

[PATCH OLK-5.10] tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
by Yi Yang 05 Nov '24

05 Nov '24

From: Longlong Xia <xialonglong(a)kylinos.cn> mainline inclusion from mainline-v6.12-rc4 commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB0EQM CVE: CVE-2024-50073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock. Signed-off-by: Longlong Xia <xialonglong(a)kylinos.cn> Cc: stable <stable(a)kernel.org> Suggested-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/n_gsm.c [Commit 54da6a092431("locking: Introduce __cleanup() based infrastructure") not merged, The guard() function is not introduced.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 0a367fa23c27..b8d77f3d924d 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2228,6 +2228,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) int i; struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; + unsigned long flags; gsm->dead = true; mutex_lock(&gsm->mutex); @@ -2255,9 +2256,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) mutex_unlock(&gsm->mutex); /* Now wipe the queues */ tty_ldisc_flush(gsm->tty); + + spin_lock_irqsave(&gsm->tx_lock, flags); list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_list); + spin_unlock_irqrestore(&gsm->tx_lock, flags); } /** -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
by Yi Yang 05 Nov '24

05 Nov '24

From: Longlong Xia <xialonglong(a)kylinos.cn> mainline inclusion from mainline-v6.12-rc4 commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB0EQM CVE: CVE-2024-50073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257 Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818 [Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock. Signed-off-by: Longlong Xia <xialonglong(a)kylinos.cn> Cc: stable <stable(a)kernel.org> Suggested-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/n_gsm.c [Commit 54da6a092431("locking: Introduce __cleanup() based infrastructure") not merged, The guard() function is not introduced.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 4b25e011967c..6a41ea82fe47 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2043,6 +2043,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) int i; struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; + unsigned long flags; gsm->dead = 1; mutex_lock(&gsm->mutex); @@ -2077,9 +2078,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) gsm_dlci_release(gsm->dlci[i]); mutex_unlock(&gsm->mutex); /* Now wipe the queues */ + + spin_lock_irqsave(&gsm->tx_lock, flags); list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_list); + spin_unlock_irqrestore(&gsm->tx_lock, flags); } /** -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1257/1257] fs/ubifs/.tmp_master.o: warning: objtool: missing symbol for section .text
by kernel test robot 05 Nov '24

05 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0d426553bb97ebfcb4ea34e8fd63477a44316644 commit: 2e52eb74463f15c745d64948cedfaee722d6268c [1257/1257] ubifs: Rework ubifs_assert() config: x86_64-buildonly-randconfig-002-20241102 (https://download.01.org/0day-ci/archive/20241105/202411051232.roOpwrLm-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241105/202411051232.roOpwrLm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411051232.roOpwrLm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ubifs/.tmp_master.o: warning: objtool: missing symbol for section .text -- >> fs/ubifs/.tmp_lpt_commit.o: warning: objtool: missing symbol for section .text.unlikely -- >> fs/ubifs/.tmp_budget.o: warning: objtool: missing symbol for section .text -- >> fs/ubifs/.tmp_recovery.o: warning: objtool: missing symbol for section .text -- >> fs/ubifs/.tmp_log.o: warning: objtool: missing symbol for section .text -- >> fs/ubifs/.tmp_commit.o: warning: objtool: missing symbol for section .text -- >> fs/ubifs/.tmp_scan.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0