- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
by Yongjian Sun 04 Jul '25

04 Jul '25

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJLYW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We can trigger a slab-out-of-bounds with the following commands: mkfs.ext4 -F /dev/$disk 10G mount /dev/$disk /tmp/test echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc echo test > /tmp/test/file && sync ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11 CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521 Call Trace: dump_stack_lvl+0x2c/0x50 kasan_report+0xb6/0xf0 ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] ext4_mb_regular_allocator+0x19e9/0x2370 [ext4] ext4_mb_new_blocks+0x88a/0x1370 [ext4] ext4_ext_map_blocks+0x14f7/0x2390 [ext4] ext4_map_blocks+0x569/0xea0 [ext4] ext4_do_writepages+0x10f6/0x1bc0 [ext4] [...] ================================================================== The flow of issue triggering is as follows: // Set s_mb_group_prealloc to 2147483647 via sysfs ext4_mb_new_blocks ext4_mb_normalize_request ext4_mb_normalize_group_request ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc ext4_mb_regular_allocator ext4_mb_choose_next_group ext4_mb_choose_next_group_best_avail mb_avg_fragment_size_order order = fls(len) - 2 = 29 ext4_mb_find_good_group_avg_frag_lists frag_list = &sbi->s_mb_avg_fragment_size[order] if (list_empty(frag_list)) // Trigger SOOB! At 4k block size, the length of the s_mb_avg_fragment_size list is 14, but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds to be triggered by an attempt to access an element at index 29. Add a new attr_id attr_clusters_in_group with values in the range [0, sbi->s_clusters_per_group] and declare mb_group_prealloc as that type to fix the issue. In addition avoid returning an order from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb) and reduce some useless loops. Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)") CC: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240319113325.3110393-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/sysfs.c fs/ext4/mballoc.c [This patch not only fixes the issue introduced by the commit "7e170922f06b", but also addresses the BUG_ON problem caused by the sign flip in the assignment of s_mb_group_prealloc. Since we did not merge the commit "7e170922f06b", this patch has been adapted accordingly.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/sysfs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index b0bb4a92c9c9..4d690ce19dd4 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -29,6 +29,7 @@ typedef enum { attr_trigger_test_error, attr_first_error_time, attr_last_error_time, + attr_clusters_in_group, attr_feature, attr_pointer_ui, attr_pointer_ul, @@ -213,13 +214,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444); EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead, ext4_sb_info, s_inode_readahead_blks); +EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group, + ext4_sb_info, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal); EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats); EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan); EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan); EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs); EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request); -EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(mb_max_inode_prealloc, s_mb_max_inode_prealloc); EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); @@ -388,6 +390,7 @@ static ssize_t ext4_attr_show(struct kobject *kobj, (unsigned long long) percpu_counter_sum(&sbi->s_sra_exceeded_retry_limit)); case attr_inode_readahead: + case attr_clusters_in_group: case attr_pointer_ui: if (!ptr) return 0; @@ -448,6 +451,7 @@ static ssize_t ext4_attr_store(struct kobject *kobj, struct ext4_attr *a = container_of(attr, struct ext4_attr, attr); void *ptr = calc_ptr(a, sbi); unsigned long t; + unsigned int ut; int ret; switch (a->attr_id) { @@ -464,6 +468,14 @@ static ssize_t ext4_attr_store(struct kobject *kobj, else *((unsigned int *) ptr) = t; return len; + case attr_clusters_in_group: + ret = kstrtouint(skip_spaces(buf), 0, &ut); + if (ret) + return ret; + if (ut > sbi->s_clusters_per_group) + return -EINVAL; + *((unsigned int *) ptr) = ut; + return len; case attr_pointer_ul: if (!ptr) return 0; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2] dm: fix unconditional IO throttle caused by REQ_PREFLUSH
by Zheng Qixing 04 Jul '25

04 Jul '25

From: Jinliang Zheng <alexjlzheng(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit 88f7f56d16f568f19e1a695af34a7f4a6ce537a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEX CVE: CVE-2025-38063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait(). An example from v5.4, similar problem also exists in upstream: crash> bt 2091206 PID: 2091206 TASK: ffff2050df92a300 CPU: 109 COMMAND: "kworker/u260:0" #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8 #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4 #2 [ffff800084a2f880] schedule at ffff800040bfa4b4 #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4 #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0 #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254 #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38 #8 [ffff800084a2fa60] generic_make_request at ffff800040570138 #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4 #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs] #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs] #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs] #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs] #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs] #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs] #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08 #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc #18 [ffff800084a2fe70] kthread at ffff800040118de4 After commit 2def2845cc33 ("xfs: don't allow log IO to be throttled"), the metadata submitted by xlog_write_iclog() should not be throttled. But due to the existence of the dm layer, throttling flush_bio indirectly causes the metadata bio to be throttled. Fix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes wbt_should_throttle() return false to avoid wbt_wait(). Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Reviewed-by: Tianxiang Peng <txpeng(a)tencent.com> Reviewed-by: Hao Peng <flyingpeng(a)tencent.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Conflicts: drivers/md/dm.c [Due to not merging commit dbe3ece1287d ("dm: don't reuse bio for flushes").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/dm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 469aefecfe0b..5c73d4f44082 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1472,6 +1472,10 @@ static int __send_empty_flush(struct clone_info *ci) unsigned target_nr = 0; struct dm_target *ti; + if ((ci->io->orig_bio->bi_opf & (REQ_IDLE | REQ_SYNC)) == + (REQ_IDLE | REQ_SYNC)) + ci->bio->bi_opf |= REQ_IDLE; + BUG_ON(bio_has_data(ci->bio)); while ((ti = dm_table_get_target(ci->map, target_nr++))) __send_duplicate_bios(ci, ti, ti->num_flush_bios, NULL); -- 2.39.2

2 1

[PATCH OLK-5.10 v2] dm: fix unconditional IO throttle caused by REQ_PREFLUSH
by Zheng Qixing 04 Jul '25

04 Jul '25

From: Jinliang Zheng <alexjlzheng(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit 88f7f56d16f568f19e1a695af34a7f4a6ce537a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEX CVE: CVE-2025-38063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait(). An example from v5.4, similar problem also exists in upstream: crash> bt 2091206 PID: 2091206 TASK: ffff2050df92a300 CPU: 109 COMMAND: "kworker/u260:0" #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8 #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4 #2 [ffff800084a2f880] schedule at ffff800040bfa4b4 #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4 #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0 #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254 #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38 #8 [ffff800084a2fa60] generic_make_request at ffff800040570138 #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4 #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs] #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs] #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs] #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs] #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs] #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs] #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08 #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc #18 [ffff800084a2fe70] kthread at ffff800040118de4 After commit 2def2845cc33 ("xfs: don't allow log IO to be throttled"), the metadata submitted by xlog_write_iclog() should not be throttled. But due to the existence of the dm layer, throttling flush_bio indirectly causes the metadata bio to be throttled. Fix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes wbt_should_throttle() return false to avoid wbt_wait(). Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Reviewed-by: Tianxiang Peng <txpeng(a)tencent.com> Reviewed-by: Hao Peng <flyingpeng(a)tencent.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Conflicts: drivers/md/dm.c [Due to not merging commit 49add4966d79 ("block: pass a block_device and opf to bio_init").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/dm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 9048cfc0d000..43cbfe359527 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1459,6 +1459,11 @@ static int __send_empty_flush(struct clone_info *ci) unsigned target_nr = 0; struct dm_target *ti; struct bio flush_bio; + unsigned int opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC; + + if ((ci->io->orig_bio->bi_opf & (REQ_IDLE | REQ_SYNC)) == + (REQ_IDLE | REQ_SYNC)) + opf |= REQ_IDLE; /* * Use an on-stack bio for this, it's safe since we don't @@ -1466,7 +1471,7 @@ static int __send_empty_flush(struct clone_info *ci) * the basis for the clone(s). */ bio_init(&flush_bio, NULL, 0); - flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC; + flush_bio.bi_opf = opf; ci->bio = &flush_bio; ci->sector_count = 0; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 04 Jul '25

04 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[PATCH OLK-6.6 v2] mucse: rnpm: fix UAF in rnpm_remove()
by Ding Hui 04 Jul '25

04 Jul '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJVFM CVE: NA ------------------------------------ KASAN report a use-after-free case in rnpm_remove(). The pf_adapter is already be freed in rnpm_rm_pf_adapter(), but using pf_adapter->hw.mbx after that. Fix it by moving the dma_free_coherent() into rnpm_rm_pf_adapter() just before releasing pf_adapter, that also fix reply_dma leaking on rnpm_probe() error path. Fixes: 5deaf74c4b3e ("drivers: initial support for rnpm drivers from Mucse Technology") Signed-off-by: Ding Hui <dinghui(a)sangfor.com.cn> --- drivers/net/ethernet/mucse/rnpm/rnpm_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- v2: add Fixes: tag diff --git a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c index 8c920f2fd9bc..3b1a3d872e22 100644 --- a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c +++ b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c @@ -8296,6 +8296,11 @@ static int rnpm_rm_pf_adapter(struct pci_dev *pdev, if (pf_adapter->hw_addr4) pcim_iounmap(pdev, pf_adapter->hw_addr4); + if (pf_adapter->hw.mbx.reply_dma) + dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, + pf_adapter->hw.mbx.reply_dma, + pf_adapter->hw.mbx.reply_dma_phy); + if (pf_adapter) devm_kfree(&pdev->dev, pf_adapter); @@ -8977,9 +8982,6 @@ static void rnpm_remove(struct pci_dev *pdev) rnpm_rm_pf_adapter(pdev, &pf_adapter); // pci_release_selected_regions(pdev, pci_select_bars(pdev, // IORESOURCE_MEM)); - dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, - pf_adapter->hw.mbx.reply_dma, - pf_adapter->hw.mbx.reply_dma_phy); pci_release_mem_regions(pdev); pci_disable_device(pdev); } -- 2.17.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5536700e483b14a193ce40d6be90b95fb2d7532e
by kernel test robot 04 Jul '25

04 Jul '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5536700e483b14a193ce40d6be90b95fb2d7532e !16920 net: atlantic: fix aq_vec index out of range error Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202506061449.nBm6oAvj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506061633.Zsp5yfyi-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506061637.CVNqsEqf-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506061755.yar1Fr9d-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506182031.ldH7VynO-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202507030343.E83xAhC0-lkp@intel.com kernel/sched/core.c:5989:22: error: 'root_task_group' undeclared (first use in this function); did you mean 'task_group'? kernel/sched/core.c:5989:29: error: 'root_task_group' undeclared (first use in this function); did you mean 'task_group'? mm/memcontrol.c:5000:6: warning: no previous prototype for function 'dhugetlb_pool_is_free' [-Wmissing-prototypes] mm/memory.c:4803:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct cgp_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] mm/memory_hotplug.c:970:13: warning: 'rollback_node_hotadd' defined but not used [-Wunused-function] mm/mmu_gather.o: warning: objtool: missing symbol for section .text mm/page_alloc.c:3123: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' mm/vmalloc.c:231:16: warning: variable 'start' set but not used [-Wunused-but-set-variable] mm/vmalloc.c:231:23: warning: variable 'start' set but not used [-Wunused-but-set-variable] Unverified Error/Warning (likely false positive, kindly check if interested): include/asm-generic/bug.h:70:12: warning: 'mcu_ctrl' may be used uninitialized in this function [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ces32' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'colormap' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ctl' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'data' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'data_arg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'drive_command' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'epds' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'idx' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'inbuf' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'info64' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'iocb' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'irq_req' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'load' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'm' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'master' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'pkg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'r' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'reg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'req_task' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'rs' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'slave' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'st_loc' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'tmplut' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ubuf' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'version' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'vw' may be used uninitialized [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-asm-generic-bitops-non-atomic.h:error:array-subscript-long-unsigned-int-is-partly-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddr_change-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddrinfo-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddrparams-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_prim-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_setpeerprim-is-less-than | |-- include-uapi-linux-sctp.h:error:spinfo_address-offset-in-struct-sctp_paddrinfo-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:spp_address-offset-in-struct-sctp_paddrparams-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:ssp_addr-offset-in-struct-sctp_prim-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:sspp_addr-offset-in-struct-sctp_setpeerprim-isn-t-aligned-to | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250703 | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250627 | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ciov-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:colormap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ctl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:drive_command-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:epds-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:idx-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:inbuf-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:info64-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:iocb-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:irq_req-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:load-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:m-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:master-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:pkg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:r-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:reg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:req_task-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:slave-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:st_loc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:tmplut-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ubuf-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:version-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:vw-may-be-used-uninitialized |-- arm64-randconfig-003-20250703 | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250626 | |-- include-linux-uaccess.h:warning:acc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:b32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:buts-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:c32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:cgc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:cmap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:compat_event-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:compat_kdfcopy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:con2fb-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:d32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:desc32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:event-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fa-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fdq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:flags-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:getb-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:handle-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:head-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:hreq32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:idq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:input-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:io-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kdfcopy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:log_addrs-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:m32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mask-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:me-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mfetch-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:n_blocks_count-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:new_serial-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:parms-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:pcopy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:phys_addr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ptr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:range-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:recv32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:req32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:res32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ret-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:retval-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs485-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rsp-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:set_buffer-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:sp32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:tnew-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uq32-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:var-may-be-used-uninitialized |-- arm64-randconfig-004-20250703 | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-mmu_gather.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250703 | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250703 | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250703 | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-dhugetlb_pool_is_free | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-rhel-9.4-rust |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-dhugetlb_pool_is_free |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 722m configs tested: 16 configs skipped: 115 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 randconfig-001-20250703 gcc-5.5.0 arm64 randconfig-002-20250703 gcc-14.3.0 arm64 randconfig-003-20250703 gcc-12.3.0 arm64 randconfig-004-20250703 gcc-8.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250703 gcc-11 x86_64 buildonly-randconfig-002-20250703 gcc-12 x86_64 buildonly-randconfig-003-20250703 clang-20 x86_64 buildonly-randconfig-004-20250703 clang-20 x86_64 buildonly-randconfig-005-20250703 gcc-12 x86_64 buildonly-randconfig-006-20250703 gcc-12 x86_64 defconfig gcc-11 x86_64 rhel-9.4-rust clang-21 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] mucse: rnpm: fix UAF in rnpm_remove()
by Ding Hui 04 Jul '25

04 Jul '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJVFM CVE: NA ------------------------------------ KASAN report a use-after-free case in rnpm_remove(). The pf_adapter is already be freed in rnpm_rm_pf_adapter(), but using pf_adapter->hw.mbx after that. Fix it by moving the dma_free_coherent() into rnpm_rm_pf_adapter() just before releasing pf_adapter, that also fix reply_dma leaking on rnpm_probe() error path. Signed-off-by: Ding Hui <dinghui(a)sangfor.com.cn> --- drivers/net/ethernet/mucse/rnpm/rnpm_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c index 8c920f2fd9bc..3b1a3d872e22 100644 --- a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c +++ b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c @@ -8296,6 +8296,11 @@ static int rnpm_rm_pf_adapter(struct pci_dev *pdev, if (pf_adapter->hw_addr4) pcim_iounmap(pdev, pf_adapter->hw_addr4); + if (pf_adapter->hw.mbx.reply_dma) + dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, + pf_adapter->hw.mbx.reply_dma, + pf_adapter->hw.mbx.reply_dma_phy); + if (pf_adapter) devm_kfree(&pdev->dev, pf_adapter); @@ -8977,9 +8982,6 @@ static void rnpm_remove(struct pci_dev *pdev) rnpm_rm_pf_adapter(pdev, &pf_adapter); // pci_release_selected_regions(pdev, pci_select_bars(pdev, // IORESOURCE_MEM)); - dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, - pf_adapter->hw.mbx.reply_dma, - pf_adapter->hw.mbx.reply_dma_phy); pci_release_mem_regions(pdev); pci_disable_device(pdev); } -- 2.17.1

2 1

[openeuler:OLK-6.6 2455/2455] drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:1268:29: warning: 'speed ' directive output may be truncated writing 6 bytes into a region of size between 1 and 128
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b85bcf0e6357841885264f42859bec05c9073f4 commit: 0bf0c942a09ba92e1d22e6960464b628dd4408fa [2455/2455] net/hinic3: Synchronize new NIC features and bug fixes config: x86_64-buildonly-randconfig-006-20250704 (https://download.01.org/0day-ci/archive/20250704/202507040829.NhLVmauM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507040829.NhLVmauM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507040829.NhLVmauM-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:356:5: warning: no previous prototype for 'hinic3_rx_queue_stat_pack' [-Wmissing-prototypes] 356 | int hinic3_rx_queue_stat_pack(struct hinic3_show_item *item, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:369:5: warning: no previous prototype for 'hinic3_tx_queue_stat_pack' [-Wmissing-prototypes] 369 | int hinic3_tx_queue_stat_pack(struct hinic3_show_item *item, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c: In function 'hinic3_set_settings_to_hw': >> drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:1268:29: warning: 'speed ' directive output may be truncated writing 6 bytes into a region of size between 1 and 128 [-Wformat-truncation=] 1268 | "%sspeed %u ", link_info, speed); | ^~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:1267:17: note: 'snprintf' output between 9 and 145 bytes into a destination of size 128 1267 | snprintf(set_link_str, sizeof(set_link_str), | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1268 | "%sspeed %u ", link_info, speed); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:621:6: warning: no previous prototype for 'print_port_info' [-Wmissing-prototypes] 621 | void print_port_info(struct hinic3_nic_io *nic_io, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:803:6: warning: no previous prototype for 'hinic3_notify_vf_bond_status' [-Wmissing-prototypes] 803 | void hinic3_notify_vf_bond_status(struct hinic3_nic_io *nic_io, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:833:6: warning: no previous prototype for 'hinic3_notify_all_vfs_bond_changed' [-Wmissing-prototypes] 833 | void hinic3_notify_all_vfs_bond_changed(void *hwdev, u8 bond_status) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1671:5: warning: no previous prototype for 'set_fecparam' [-Wmissing-prototypes] 1671 | int set_fecparam(void *hwdev, u8 fecparam) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1699:5: warning: no previous prototype for 'get_fecparam' [-Wmissing-prototypes] 1699 | int get_fecparam(void *hwdev, u8 *advertised_fec, u8 *supported_fec) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c: In function 'get_port_temperature_power': >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:548:52: warning: ', rx power: ' directive output may be truncated writing 12 bytes into a region of size between 1 and 512 [-Wformat-truncation=] 548 | snprintf(str, CAP_INFO_MAX_LEN, "%s, rx power: %uuW, tx power: %uuW", | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:548:17: note: 'snprintf' output between 31 and 560 bytes into a destination of size 512 548 | snprintf(str, CAP_INFO_MAX_LEN, "%s, rx power: %uuW, tx power: %uuW", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 549 | cap_info, info->power[0x0], info->power[0x1]); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:544:53: warning: ', rx power: ' directive output may be truncated writing 12 bytes into a region of size between 1 and 512 [-Wformat-truncation=] 544 | snprintf(str, CAP_INFO_MAX_LEN, "%s, rx power: %uuw %uuW %uuW %uuW", | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:544:17: note: 'snprintf' output between 28 and 575 bytes into a destination of size 512 544 | snprintf(str, CAP_INFO_MAX_LEN, "%s, rx power: %uuw %uuW %uuW %uuW", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 545 | cap_info, info->power[0x0], info->power[0x1], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 546 | info->power[0x2], info->power[0x3]); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +1268 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c 1250 1251 static int hinic3_set_settings_to_hw(struct hinic3_nic_dev *nic_dev, 1252 u32 set_settings, u8 autoneg, u32 speed) 1253 { 1254 struct net_device *netdev = nic_dev->netdev; 1255 struct hinic3_link_ksettings settings = { 0 }; 1256 int speed_level = 0; 1257 char set_link_str[HINIC_SET_LINK_STR_LEN] = {0}; 1258 char link_info[HINIC_SET_LINK_STR_LEN] = {0}; 1259 int err = 0; 1260 1261 snprintf(link_info, sizeof(link_info), "%s", 1262 (bool)(set_settings & HILINK_LINK_SET_AUTONEG) ? 1263 ((bool)autoneg ? "autong enable " : "autong disable ") : ""); 1264 1265 if (set_settings & HILINK_LINK_SET_SPEED) { 1266 speed_level = hinic3_ethtool_to_hw_speed_level(speed); 1267 snprintf(set_link_str, sizeof(set_link_str), > 1268 "%sspeed %u ", link_info, speed); 1269 } 1270 1271 settings.valid_bitmap = set_settings; 1272 settings.autoneg = (bool)autoneg ? PORT_CFG_AN_ON : PORT_CFG_AN_OFF; 1273 settings.speed = (u8)speed_level; 1274 1275 err = hinic3_set_link_settings(nic_dev->hwdev, &settings); 1276 if (err) 1277 nicif_err(nic_dev, drv, netdev, "Set %sfailed\n", set_link_str); 1278 else 1279 nicif_info(nic_dev, drv, netdev, "Set %ssuccess\n", 1280 set_link_str); 1281 1282 return err; 1283 } 1284 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2455/2455] drivers/net/ethernet/huawei/hinic3/hinic3_tx.c:395:5: warning: no previous prototype for 'hinic3_tx_offload'
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b85bcf0e6357841885264f42859bec05c9073f4 commit: 74e3846262704452212a3245dccb10c2cd185ac3 [2455/2455] net/hinic3: Support new TX feature config: x86_64-buildonly-randconfig-006-20250704 (https://download.01.org/0day-ci/archive/20250704/202507040654.Wl8xfk0X-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507040654.Wl8xfk0X-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507040654.Wl8xfk0X-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/huawei/hinic3/hinic3_tx.c:395:5: warning: no previous prototype for 'hinic3_tx_offload' [-Wmissing-prototypes] 395 | u32 hinic3_tx_offload(struct sk_buff *skb, struct hinic3_offload_info *offload_info, | ^~~~~~~~~~~~~~~~~ vim +/hinic3_tx_offload +395 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c 394 > 395 u32 hinic3_tx_offload(struct sk_buff *skb, struct hinic3_offload_info *offload_info, 396 struct hinic3_queue_info *queue_info, struct hinic3_txq *txq) 397 { 398 u32 offload = 0; 399 int tso_cs_en; 400 401 tso_cs_en = hinic3_tso(offload_info, queue_info, skb); 402 if (tso_cs_en < 0) { 403 offload = TX_OFFLOAD_INVALID; 404 return offload; 405 } else if (tso_cs_en) { 406 offload |= TX_OFFLOAD_TSO; 407 } else { 408 tso_cs_en = hinic3_tx_csum(txq, skb, offload_info, queue_info); 409 if (tso_cs_en) 410 offload |= TX_OFFLOAD_CSUM; 411 } 412 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2454/2454] drivers/coda/coda.c:264: warning: Function parameter or member 's_smmu_id' not described in 'is_cc_vmid'
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b85bcf0e6357841885264f42859bec05c9073f4 commit: c5161d7e11a7e30755b2ec55aaebfd500193cbbc [2454/2454] virtCCA supports SR-IOV in CoDA scenarios. config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250704/202507040646.2QNfCtsv-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507040646.2QNfCtsv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507040646.2QNfCtsv-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/coda/coda.c:264: warning: Function parameter or member 's_smmu_id' not described in 'is_cc_vmid' >> drivers/coda/coda.c:660: warning: Function parameter or member 'pci_dev' not described in 'virtcca_create_ste_entry' >> drivers/coda/coda.c:660: warning: Excess function parameter 'smmu' description in 'virtcca_create_ste_entry' >> drivers/coda/coda.c:660: warning: Excess function parameter 'master' description in 'virtcca_create_ste_entry' >> drivers/coda/coda.c:660: warning: Excess function parameter 'sid' description in 'virtcca_create_ste_entry' -- >> drivers/iommu/arm/arm-smmu-v3/arm-s-smmu-v3.c:56: warning: Function parameter or member 's_smmu_id' not described in 'virtcca_smmu_cmdq_need_forward' vim +264 drivers/coda/coda.c ad540a13eb8292 yangxiangkai 2024-09-20 254 ad540a13eb8292 yangxiangkai 2024-09-20 255 /** c5161d7e11a7e3 yxk 2025-05-07 256 * is_cc_vmid - Whether the VM is confidential VM c5161d7e11a7e3 yxk 2025-05-07 257 * @vmid: VM id ad540a13eb8292 yangxiangkai 2024-09-20 258 * ad540a13eb8292 yangxiangkai 2024-09-20 259 * Returns: c5161d7e11a7e3 yxk 2025-05-07 260 * %true if the VM is confidential c5161d7e11a7e3 yxk 2025-05-07 261 * %false if the VM is not confidential ad540a13eb8292 yangxiangkai 2024-09-20 262 */ c5161d7e11a7e3 yxk 2025-05-07 263 bool is_cc_vmid(u32 vmid, u64 s_smmu_id) ad540a13eb8292 yangxiangkai 2024-09-20 @264 { ad540a13eb8292 yangxiangkai 2024-09-20 265 int bkt; c5161d7e11a7e3 yxk 2025-05-07 266 struct coda_dev_hash_node *obj; c5161d7e11a7e3 yxk 2025-05-07 267 bool secure = false; ad540a13eb8292 yangxiangkai 2024-09-20 268 c5161d7e11a7e3 yxk 2025-05-07 269 spin_lock(&coda_dev_lock); c5161d7e11a7e3 yxk 2025-05-07 270 hash_for_each(g_coda_dev_htable, bkt, obj, node) { c5161d7e11a7e3 yxk 2025-05-07 271 if (vmid > 0 && obj->vmid == vmid && obj->s_smmu_id == s_smmu_id) { c5161d7e11a7e3 yxk 2025-05-07 272 secure = obj->secure; c5161d7e11a7e3 yxk 2025-05-07 273 spin_unlock(&coda_dev_lock); c5161d7e11a7e3 yxk 2025-05-07 274 return secure; c5161d7e11a7e3 yxk 2025-05-07 275 } ad540a13eb8292 yangxiangkai 2024-09-20 276 } ad540a13eb8292 yangxiangkai 2024-09-20 277 c5161d7e11a7e3 yxk 2025-05-07 278 spin_unlock(&coda_dev_lock); c5161d7e11a7e3 yxk 2025-05-07 279 return secure; ad540a13eb8292 yangxiangkai 2024-09-20 280 } ad540a13eb8292 yangxiangkai 2024-09-20 281 EXPORT_SYMBOL_GPL(is_cc_vmid); ad540a13eb8292 yangxiangkai 2024-09-20 282 :::::: The code at line 264 was first introduced by commit :::::: ad540a13eb8292fc92651b3bf281088a502a85f9 virtcca feature: fix msi iova map :::::: TO: yangxiangkai <yangxiangkai(a)huawei.com> :::::: CC: yangxiangkai <yangxiangkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0