tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: cd76a7555127aa134a2a1113685da60b70553e6f
commit: 15796d41b1a74a45dcc01d7b62e800b4cd8b0436 [1484/1484] arm64: dts: rockchip: Add DTS for FriendlyARM NanoPi R2S Plus
config: arm64-randconfig-051-20241119 (https://download.01.org/0day-ci/archive/20241119/202411192024.25esZpo8-lkp@…)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 592c0fe55f6d9a811028b5f3507be91458ab2713)
dtschema version: 2024.12.dev1+gcabb5b9
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241119/202411192024.25esZpo8-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411192024.25esZpo8-lkp@intel.com/
dtcheck warnings: (new ones prefixed by >>)
arch/arm64/boot/dts/rockchip/rk3328.dtsi:704.17-712.5: Warning (graph_child_address): /vop@ff370000/port: graph node has single child node 'endpoint@0', #address-cells/#size-cells are not necessary
>> arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: /: compatible: 'oneOf' conditional failed, one must be fixed:
['friendlyarm,nanopi-r2s-plus', 'rockchip,rk3328'] is too short
'vamrs,ficus' was expected
'vamrs,rock960' was expected
'amarula,vyasa-rk3288' was expected
'anbernic,rg351m' was expected
'anbernic,rg353p' was expected
'anbernic,rg353ps' was expected
'anbernic,rg353v' was expected
'anbernic,rg353vs' was expected
'anbernic,rg503' was expected
--
'vamrs,rk3288-vmarc-som' was expected
'vamrs,rk3399pro-vmarc-som' was expected
'rockchip,rk3036' was expected
'rockchip,px3' was expected
'rockchip,px30' was expected
'rockchip,px5' was expected
'rockchip,rk3128' was expected
'rockchip,rk3228' was expected
'rockchip,rk3318' was expected
from schema $id: http://devicetree.org/schemas/arm/rockchip.yaml#
>> arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: /: failed to match any schema with compatible: ['friendlyarm,nanopi-r2s-plus', 'rockchip,rk3328']
>> arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: pwm@ff1b0030: 'interrupts' does not match any of the regexes: 'pinctrl-[0-9]+'
from schema $id: http://devicetree.org/schemas/pwm/pwm-rockchip.yaml#
arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: /phy@ff430000: failed to match any schema with compatible: ['rockchip,rk3328-hdmi-phy']
arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: /clock-controller@ff440000: failed to match any schema with compatible: ['rockchip,rk3328-cru', 'rockchip,cru', 'syscon']
arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: /clock-controller@ff440000: failed to match any schema with compatible: ['rockchip,rk3328-cru', 'rockchip,cru', 'syscon']
arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: mmc@ff520000: Unevaluated properties are not allowed ('num-slots', 'supports-emmc' were unexpected)
from schema $id: http://devicetree.org/schemas/mmc/rockchip-dw-mshc.yaml#
>> arch/arm64/boot/dts/rockchip/rk3328-nanopi-r2s-plus.dtb: ethernet@ff540000: Unevaluated properties are not allowed ('snps,txpbl' was unexpected)
from schema $id: http://devicetree.org/schemas/net/rockchip-dwmac.yaml#
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: cd76a7555127aa134a2a1113685da60b70553e6f
commit: dc5b97374ba722156acbdfc4e3adbc69e2dbe7f4 [1474/1474] perf/x86/zhaoxin/uncore: Add KX-7000 support
config: x86_64-randconfig-121-20241118 (https://download.01.org/0day-ci/archive/20241119/202411192009.C5J9m2a8-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241119/202411192009.C5J9m2a8-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411192009.C5J9m2a8-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
arch/x86/events/zhaoxin/uncore.c:2387:28: sparse: sparse: symbol 'uncore_msr_cluster_uncores' was not declared. Should it be static?
arch/x86/events/zhaoxin/uncore.c:2392:28: sparse: sparse: symbol 'uncore_msr_subnode_uncores' was not declared. Should it be static?
arch/x86/events/zhaoxin/uncore.c:2398:28: sparse: sparse: symbol 'uncore_pci_subnode_uncores' was not declared. Should it be static?
>> arch/x86/events/zhaoxin/uncore.c:2761:6: sparse: sparse: symbol 'kx5000_uncore_cpu_init' was not declared. Should it be static?
>> arch/x86/events/zhaoxin/uncore.c:2770:6: sparse: sparse: symbol 'kh40000_uncore_cpu_init' was not declared. Should it be static?
>> arch/x86/events/zhaoxin/uncore.c:2775:5: sparse: sparse: symbol 'kh40000_uncore_pci_init' was not declared. Should it be static?
arch/x86/events/zhaoxin/uncore.c:2791:6: sparse: sparse: symbol 'kx8000_uncore_cpu_init' was not declared. Should it be static?
arch/x86/events/zhaoxin/uncore.c:2796:5: sparse: sparse: symbol 'kx8000_uncore_pci_init' was not declared. Should it be static?
arch/x86/events/zhaoxin/uncore.c:2804:6: sparse: sparse: symbol 'kx8000_uncore_mmio_init' was not declared. Should it be static?
arch/x86/events/zhaoxin/uncore.c: note: in included file (through include/linux/preempt.h, include/linux/spinlock.h, include/linux/mmzone.h, ...):
include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true
include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true
vim +/kx5000_uncore_cpu_init +2761 arch/x86/events/zhaoxin/uncore.c
2760
> 2761 void kx5000_uncore_cpu_init(void)
2762 {
2763 uncore_msr_uncores = kx5000_msr_uncores;
2764 }
2765
2766 static const struct zhaoxin_uncore_init_fun kx5000_uncore_init __initconst = {
2767 .cpu_init = kx5000_uncore_cpu_init,
2768 };
2769
> 2770 void kh40000_uncore_cpu_init(void)
2771 {
2772 uncore_msr_uncores = kh40000_msr_uncores;
2773 }
2774
> 2775 int kh40000_uncore_pci_init(void)
2776 {
2777 int ret = kh40000_pci2node_map_init();/*pci_bus to package mapping, do nothing*/
2778
2779 if (ret)
2780 return ret;
2781 uncore_pci_uncores = kh40000_pci_uncores;
2782 uncore_pci_driver = &kh40000_uncore_pci_driver;
2783 return 0;
2784 }
2785
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: 1a2048c794842eea41d3b91eda4b74e1e9386ae9
commit: 30107fa6908b6c2747ee9100b40af813f99483c3 [1297/1297] mfd: bd71837: Core driver for ROHM BD71837 PMIC
config: x86_64-buildonly-randconfig-005-20241117 (https://download.01.org/0day-ci/archive/20241119/202411191808.VeBluHiB-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241119/202411191808.VeBluHiB-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411191808.VeBluHiB-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from drivers/mfd/rohm-bd718x7.c:15:
include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'bd71837_i2c_exit': 'cold' [-Wmissing-attributes]
138 | void cleanup_module(void) __attribute__((alias(#exitfn)));
| ^~~~~~~~~~~~~~
drivers/mfd/rohm-bd718x7.c:207:1: note: in expansion of macro 'module_exit'
207 | module_exit(bd71837_i2c_exit);
| ^~~~~~~~~~~
drivers/mfd/rohm-bd718x7.c:203:20: note: 'cleanup_module' target declared here
203 | static void __exit bd71837_i2c_exit(void)
| ^~~~~~~~~~~~~~~~
include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'bd71837_i2c_init': 'cold' [-Wmissing-attributes]
132 | int init_module(void) __attribute__((alias(#initfn)));
| ^~~~~~~~~~~
include/linux/module.h:115:41: note: in expansion of macro 'module_init'
115 | #define subsys_initcall(fn) module_init(fn)
| ^~~~~~~~~~~
drivers/mfd/rohm-bd718x7.c:201:1: note: in expansion of macro 'subsys_initcall'
201 | subsys_initcall(bd71837_i2c_init);
| ^~~~~~~~~~~~~~~
drivers/mfd/rohm-bd718x7.c:195:19: note: 'init_module' target declared here
195 | static int __init bd71837_i2c_init(void)
| ^~~~~~~~~~~~~~~~
>> drivers/mfd/rohm-bd718x7.o: warning: objtool: missing symbol for section .exit.text
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
From: Paulo Alcantara <pc(a)manguebit.com>
stable inclusion
from stable-v5.10.229
commit ed31aba8ce93472d9e16f5cff844ae7c94e9601d
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB3D6J
CVE: CVE-2024-50151
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 1ab60323c5201bef25f2a3dc0ccc404d9aca77f1 ]
When using encryption, either enforced by the server or when using
'seal' mount option, the client will squash all compound request buffers
down for encryption into a single iov in smb2_set_next_command().
SMB2_ioctl_init() allocates a small buffer (448 bytes) to hold the
SMB2_IOCTL request in the first iov, and if the user passes an input
buffer that is greater than 328 bytes, smb2_set_next_command() will
end up writing off the end of @rqst->iov[0].iov_base as shown below:
mount.cifs //srv/share /mnt -o ...,seal
ln -s $(perl -e "print('a')for 1..1024") /mnt/link
BUG: KASAN: slab-out-of-bounds in
smb2_set_next_command.cold+0x1d6/0x24c [cifs]
Write of size 4116 at addr ffff8881148fcab8 by task ln/859
CPU: 1 UID: 0 PID: 859 Comm: ln Not tainted 6.12.0-rc3 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-2.fc40 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
print_report+0x156/0x4d9
? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
? __virt_addr_valid+0x145/0x310
? __phys_addr+0x46/0x90
? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
kasan_report+0xda/0x110
? smb2_set_next_command.cold+0x1d6/0x24c [cifs]
kasan_check_range+0x10f/0x1f0
__asan_memcpy+0x3c/0x60
smb2_set_next_command.cold+0x1d6/0x24c [cifs]
smb2_compound_op+0x238c/0x3840 [cifs]
? kasan_save_track+0x14/0x30
? kasan_save_free_info+0x3b/0x70
? vfs_symlink+0x1a1/0x2c0
? do_symlinkat+0x108/0x1c0
? __pfx_smb2_compound_op+0x10/0x10 [cifs]
? kmem_cache_free+0x118/0x3e0
? cifs_get_writable_path+0xeb/0x1a0 [cifs]
smb2_get_reparse_inode+0x423/0x540 [cifs]
? __pfx_smb2_get_reparse_inode+0x10/0x10 [cifs]
? rcu_is_watching+0x20/0x50
? __kmalloc_noprof+0x37c/0x480
? smb2_create_reparse_symlink+0x257/0x490 [cifs]
? smb2_create_reparse_symlink+0x38f/0x490 [cifs]
smb2_create_reparse_symlink+0x38f/0x490 [cifs]
? __pfx_smb2_create_reparse_symlink+0x10/0x10 [cifs]
? find_held_lock+0x8a/0xa0
? hlock_class+0x32/0xb0
? __build_path_from_dentry_optional_prefix+0x19d/0x2e0 [cifs]
cifs_symlink+0x24f/0x960 [cifs]
? __pfx_make_vfsuid+0x10/0x10
? __pfx_cifs_symlink+0x10/0x10 [cifs]
? make_vfsgid+0x6b/0xc0
? generic_permission+0x96/0x2d0
vfs_symlink+0x1a1/0x2c0
do_symlinkat+0x108/0x1c0
? __pfx_do_symlinkat+0x10/0x10
? strncpy_from_user+0xaa/0x160
__x64_sys_symlinkat+0xb9/0xf0
do_syscall_64+0xbb/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f08d75c13bb
Reported-by: David Howells <dhowells(a)redhat.com>
Fixes: e77fe73c7e38 ("cifs: we can not use small padding iovs together with encryption")
Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com>
Signed-off-by: Steve French <stfrench(a)microsoft.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Baokun Li <libaokun1(a)huawei.com>
---
fs/cifs/smb2pdu.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index b1b0d26c8486..ea82cd9e5512 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2944,6 +2944,15 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server,
return rc;
if (indatalen) {
+ unsigned int len;
+
+ if (WARN_ON_ONCE(smb3_encryption_required(tcon) &&
+ (check_add_overflow(total_len - 1,
+ ALIGN(indatalen, 8), &len) ||
+ len > MAX_CIFS_SMALL_BUFFER_SIZE))) {
+ cifs_small_buf_release(req);
+ return -EIO;
+ }
/*
* indatalen is usually small at a couple of bytes max, so
* just allocate through generic pool
--
2.46.1