- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v3 0/2] CVE-2023-52435
by Ziyang Xuan 26 Feb '24

26 Feb '24

v3: - Add fixes tag for patch 2. v2: - Fix comment head of patch 1. - Fix compile warning of patch 1. Eric Dumazet (1): net: prevent mss overflow in skb_segment() Ziyang Xuan (1): net: Fix compile warning in skb_segment() net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] kvm: kabi: KABI reservation for RME
by Guangwei Zhou 26 Feb '24

26 Feb '24

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I92TT5 CVE: NA ---------------------------------------------------------------------- Reserve KABI for struct kvm_arch and struct kvm_vcpu_arch for ARMv9 RME feature. Signed-off-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index 993b60d7219d..7c34e0b0b875 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -27,6 +27,7 @@ #include <asm/fpsimd.h> #include <asm/kvm.h> #include <asm/kvm_asm.h> +#include <linux/kabi.h> #define __KVM_HAVE_ARCH_INTC_INITIALIZED @@ -286,6 +287,15 @@ struct kvm_arch { cpumask_var_t sched_cpus; /* Union of all vcpu's cpus_ptr */ u64 tlbi_dvmbm; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) }; struct kvm_vcpu_fault_info { @@ -604,6 +614,26 @@ struct kvm_vcpu_arch { cpumask_var_t sched_cpus; cpumask_var_t pre_sched_cpus; #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) + KABI_RESERVE(9) + KABI_RESERVE(10) + KABI_RESERVE(11) + KABI_RESERVE(12) + KABI_RESERVE(13) + KABI_RESERVE(14) + KABI_RESERVE(15) + KABI_RESERVE(16) + KABI_RESERVE(17) + KABI_RESERVE(18) + KABI_RESERVE(19) }; /* -- 2.33.0

2 1

[PATCH OLK-6.6] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.14 commit d3c0b49aaa12a61d560528f5d605029ab57f0728 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 193b22a2d6bf..02d9c47797be 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1106,7 +1106,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v5.10.209 commit 6f866885e147d33efc497f1095f35b2ee5ec7310 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 72b109685db4..99e4ec48d2a4 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -1066,7 +1066,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

2 1

[openEuler-1.0-LTS] f2fs: fix to avoid dirent corruption
by Zizhi Wo 26 Feb '24

26 Feb '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v4.19.306 commit 02160112e6d45c2610b049df6eb693d7a2e57b46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I932VP CVE: CVE-2023-52444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ] As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0); You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place. [1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/ With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory. - mkdir -p dir/foo - renameat2 -w dir/foo bar [ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3] [FSCK] other corrupted bugs [Fail] Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT") Cc: Jan Kara <jack(a)suse.cz> Reported-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Chao Yu <chao(a)kernel.org> Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c index 0ace2c2e3de9..98afafe633a2 100644 --- a/fs/f2fs/namei.c +++ b/fs/f2fs/namei.c @@ -968,7 +968,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, } if (old_dir_entry) { - if (old_dir != new_dir && !whiteout) + if (old_dir != new_dir) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else -- 2.39.2

1 0

[openeuler:openEuler-1.0-LTS 13425/21632] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types)
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 90f09a01314abe26de1a722d1b51c351d84e1f5b [13425/21632] net/hinic: Add support for X86 Arch config: x86_64-randconfig-122-20240218 (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402252031.ls64imy6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402252031.ls64imy6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: expected unsigned int val drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:575:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:576:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:579:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:649:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:970:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:979:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'intr_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base_phy' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'db_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:564: warning: Function parameter or member 'dwqe_mapping' not described in 'hinic_init_hwif' vim +649 drivers/net/ethernet/huawei/hinic/hinic_hwif.c 746ea35981b1f7 Xue 2019-01-30 640 746ea35981b1f7 Xue 2019-01-30 641 int hinic_dma_zalloc_coherent_align(void *dev_hdl, u64 size, u64 align, 746ea35981b1f7 Xue 2019-01-30 642 unsigned int flag, 746ea35981b1f7 Xue 2019-01-30 643 struct hinic_dma_addr_align *mem_align) 746ea35981b1f7 Xue 2019-01-30 644 { 746ea35981b1f7 Xue 2019-01-30 645 void *vaddr, *align_vaddr; 746ea35981b1f7 Xue 2019-01-30 646 dma_addr_t paddr, align_paddr; 746ea35981b1f7 Xue 2019-01-30 647 u64 real_size = size; 746ea35981b1f7 Xue 2019-01-30 648 746ea35981b1f7 Xue 2019-01-30 @649 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 650 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 651 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 652 746ea35981b1f7 Xue 2019-01-30 653 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 654 /* align */ 746ea35981b1f7 Xue 2019-01-30 655 if (align_paddr == paddr) { 746ea35981b1f7 Xue 2019-01-30 656 align_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 657 goto out; 746ea35981b1f7 Xue 2019-01-30 658 } 746ea35981b1f7 Xue 2019-01-30 659 746ea35981b1f7 Xue 2019-01-30 660 dma_free_coherent(dev_hdl, real_size, vaddr, paddr); 746ea35981b1f7 Xue 2019-01-30 661 746ea35981b1f7 Xue 2019-01-30 662 /* realloc memory for align */ 746ea35981b1f7 Xue 2019-01-30 663 real_size = size + align; 746ea35981b1f7 Xue 2019-01-30 664 vaddr = dma_zalloc_coherent(dev_hdl, real_size, &paddr, flag); 746ea35981b1f7 Xue 2019-01-30 665 if (!vaddr) 746ea35981b1f7 Xue 2019-01-30 666 return -ENOMEM; 746ea35981b1f7 Xue 2019-01-30 667 746ea35981b1f7 Xue 2019-01-30 668 align_paddr = ALIGN(paddr, align); 746ea35981b1f7 Xue 2019-01-30 669 align_vaddr = (void *)((u64)vaddr + (align_paddr - paddr)); 746ea35981b1f7 Xue 2019-01-30 670 746ea35981b1f7 Xue 2019-01-30 671 out: 746ea35981b1f7 Xue 2019-01-30 672 mem_align->real_size = (u32)real_size; 746ea35981b1f7 Xue 2019-01-30 673 mem_align->ori_vaddr = vaddr; 746ea35981b1f7 Xue 2019-01-30 674 mem_align->ori_paddr = paddr; 746ea35981b1f7 Xue 2019-01-30 675 mem_align->align_vaddr = align_vaddr; 746ea35981b1f7 Xue 2019-01-30 676 mem_align->align_paddr = align_paddr; 746ea35981b1f7 Xue 2019-01-30 677 746ea35981b1f7 Xue 2019-01-30 678 return 0; 746ea35981b1f7 Xue 2019-01-30 679 } 746ea35981b1f7 Xue 2019-01-30 680 :::::: The code at line 649 was first introduced by commit :::::: 746ea35981b1f77e988d48642409d73f0470b3eb net: hinic: Add Hardware Abstract Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 10454/21632] sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer
by kernel test robot 25 Feb '24

25 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: c6a3607c78f8035db0efc67cb41374fe49e4709d [10454/21632] ALSA: usb-audio: More validations of descriptor units config: x86_64-randconfig-121-20240224 (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240225/202402250716.ZS5etOKl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402250716.ZS5etOKl-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer >> sound/usb/validate.c:113:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:128:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer sound/usb/validate.c:145:26: sparse: sparse: restricted __le16 degrades to integer vim +113 sound/usb/validate.c 67 68 /* both for processing and extension units; covering all UACs */ 69 static bool validate_processing_unit(const void *p, 70 const struct usb_desc_validator *v) 71 { 72 const struct uac_processing_unit_descriptor *d = p; 73 const unsigned char *hdr = p; 74 size_t len, m; 75 76 if (d->bLength < sizeof(*d)) 77 return false; 78 len = d->bLength < sizeof(*d) + d->bNrInPins; 79 if (d->bLength < len) 80 return false; 81 switch (v->protocol) { 82 case UAC_VERSION_1: 83 default: 84 /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */ 85 len += 1 + 2 + 1 + 1; 86 if (d->bLength < len) /* bControlSize */ 87 return false; 88 m = hdr[len]; 89 len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */ 90 break; 91 case UAC_VERSION_2: 92 /* bNrChannels, bmChannelConfig, iChannelNames */ 93 len += 1 + 4 + 1; 94 if (v->type == UAC2_PROCESSING_UNIT_V2) 95 len += 2; /* bmControls -- 2 bytes for PU */ 96 else 97 len += 1; /* bmControls -- 1 byte for EU */ 98 len += 1; /* iProcessing */ 99 break; 100 case UAC_VERSION_3: 101 /* wProcessingDescrStr, bmControls */ 102 len += 2 + 4; 103 break; 104 } 105 if (d->bLength < len) 106 return false; 107 108 switch (v->protocol) { 109 case UAC_VERSION_1: 110 default: 111 if (v->type == UAC1_EXTENSION_UNIT) 112 return true; /* OK */ > 113 switch (d->wProcessType) { 114 case UAC_PROCESS_UP_DOWNMIX: 115 case UAC_PROCESS_DOLBY_PROLOGIC: 116 if (d->bLength < len + 1) /* bNrModes */ 117 return false; 118 m = hdr[len]; 119 len += 1 + m * 2; /* bNrModes, waModes(n) */ 120 break; 121 default: 122 break; 123 } 124 break; 125 case UAC_VERSION_2: 126 if (v->type == UAC2_EXTENSION_UNIT_V2) 127 return true; /* OK */ 128 switch (d->wProcessType) { 129 case UAC2_PROCESS_UP_DOWNMIX: 130 case UAC2_PROCESS_DOLBY_PROLOCIC: /* SiC! */ 131 if (d->bLength < len + 1) /* bNrModes */ 132 return false; 133 m = hdr[len]; 134 len += 1 + m * 4; /* bNrModes, daModes(n) */ 135 break; 136 default: 137 break; 138 } 139 break; 140 case UAC_VERSION_3: 141 if (v->type == UAC3_EXTENSION_UNIT) { 142 len += 2; /* wClusterDescrID */ 143 break; 144 } 145 switch (d->wProcessType) { 146 case UAC3_PROCESS_UP_DOWNMIX: 147 if (d->bLength < len + 1) /* bNrModes */ 148 return false; 149 m = hdr[len]; 150 len += 1 + m * 2; /* bNrModes, waClusterDescrID(n) */ 151 break; 152 case UAC3_PROCESS_MULTI_FUNCTION: 153 len += 2 + 4; /* wClusterDescrID, bmAlgorighms */ 154 break; 155 default: 156 break; 157 } 158 break; 159 } 160 if (d->bLength < len) 161 return false; 162 163 return true; 164 } 165 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 13350/21632] ld.lld: error: undefined symbol: kfree_skb
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b97b63500af297c36f80416fd1f1193d227cf51a commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [13350/21632] ext4: report error to userspace by netlink config: x86_64-buildonly-randconfig-001-20240224 (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242133.TAc5acto-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402242133.TAc5acto-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: __alloc_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: __nlmsg_put >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: kfree_skb >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_broadcast >>> referenced by super.c >>> fs/ext4/super.o:(ext4_netlink_send_info) in archive built-in.a -- >> ld.lld: error: undefined symbol: init_net >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: __netlink_kernel_create >>> referenced by super.c >>> fs/ext4/super.o:(ext4_init_fs) in archive built-in.a -- >> ld.lld: error: undefined symbol: netlink_kernel_release >>> referenced by super.c >>> fs/ext4/super.o:(ext4_exit_fs) in archive built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 29649/30000] drivers/ub/urma/ubcore/ubcore_device.c:393:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy'
by kernel test robot 24 Feb '24

24 Feb '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fee6fdef7d687d6ce43289fd7e7f96fde039af0 commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [29649/30000] ubcore: fix the bug of tp negotiation concurrency config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240224/202402242102.SLiva8Ut-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202402242102.SLiva8Ut-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_device.c:306:6: warning: no previous prototype for function 'ubcore_destroy_upi_list' [-Wmissing-prototypes] 306 | void ubcore_destroy_upi_list(void) | ^ drivers/ub/urma/ubcore/ubcore_device.c:306:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 306 | void ubcore_destroy_upi_list(void) | ^ | static >> drivers/ub/urma/ubcore/ubcore_device.c:393:23: warning: no previous prototype for function 'ubcore_find_tpf_device_legacy' [-Wmissing-prototypes] 393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ drivers/ub/urma/ubcore/ubcore_device.c:393:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 393 | struct ubcore_device *ubcore_find_tpf_device_legacy(void) | ^ | static 2 warnings generated. -- drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for function 'ubcore_get_mtu' [-Wmissing-prototypes] 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^ drivers/ub/urma/ubcore/ubcore_tp.c:66:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^ | static >> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for function 'ubcore_modify_tp_state' [-Wmissing-prototypes] 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^ drivers/ub/urma/ubcore/ubcore_tp.c:392:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^ | static drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for function 'ubcore_create_vtp' [-Wmissing-prototypes] 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^ drivers/ub/urma/ubcore/ubcore_tp.c:894:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^ | static drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for function 'ubcore_destroy_vtp' [-Wmissing-prototypes] 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^ drivers/ub/urma/ubcore/ubcore_tp.c:920:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^ | static 4 warnings generated. -- >> drivers/ub/urma/uburma/uburma_main.c:640:6: warning: no previous prototype for function 'uburma_dev_accessible_by_ns' [-Wmissing-prototypes] 640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net) | ^ drivers/ub/urma/uburma/uburma_main.c:640:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 640 | bool uburma_dev_accessible_by_ns(struct uburma_device *ubu_dev, struct net *net) | ^ | static >> drivers/ub/urma/uburma/uburma_main.c:665:5: warning: no previous prototype for function 'uburma_set_dev_ns' [-Wmissing-prototypes] 665 | int uburma_set_dev_ns(char *device_name, int ns_fd) | ^ drivers/ub/urma/uburma/uburma_main.c:665:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 665 | int uburma_set_dev_ns(char *device_name, int ns_fd) | ^ | static >> drivers/ub/urma/uburma/uburma_main.c:723:5: warning: no previous prototype for function 'uburma_set_ns_mode' [-Wmissing-prototypes] 723 | int uburma_set_ns_mode(bool shared) | ^ drivers/ub/urma/uburma/uburma_main.c:723:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 723 | int uburma_set_ns_mode(bool shared) | ^ | static 3 warnings generated. vim +/ubcore_find_tpf_device_legacy +393 drivers/ub/urma/ubcore/ubcore_device.c 392 > 393 struct ubcore_device *ubcore_find_tpf_device_legacy(void) 394 { 395 if (g_tpf == NULL) 396 ubcore_log_err("tpf is not registered yet"); 397 398 ubcore_get_device(g_tpf); 399 return g_tpf; 400 } 401 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0