- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] ksmbd: no response from compound read
by Cai Xinchen 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.5-rc4 commit e202a1e8634b186da38cbbff85382ea2b9e297cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA5YWA CVE: CVE-2023-39179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd doesn't support compound read. If client send read-read in compound to ksmbd, there can be memory leak from read buffer. Windows and linux clients doesn't send it to server yet. For now, No response from compound read. compound read will be supported soon. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [smb2_read function is not move to fs/smb/server/smb2pdu.c.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..215ea7f83d09 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6249,6 +6249,11 @@ int smb2_read(struct ksmbd_work *work) int err = 0; WORK_BUFFERS(work, req, rsp); + if (work->next_smb2_rcv_hdr_off) { + work->send_no_response = 1; + err = -EOPNOTSUPP; + goto out; + } if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] IB/qib: Protect from buffer overflow
by Zeng Heng 17 Jun '24

17 Jun '24

José Expósito (1): IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() Mike Marciniszyn (1): IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields drivers/infiniband/hw/qib/qib_user_sdma.c | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-sp1] ksmbd: no response from compound read
by Cai Xinchen 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.5-rc4 commit e202a1e8634b186da38cbbff85382ea2b9e297cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA5YWA CVE: CVE-2023-39179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd doesn't support compound read. If client send read-read in compound to ksmbd, there can be memory leak from read buffer. Windows and linux clients doesn't send it to server yet. For now, No response from compound read. compound read will be supported soon. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [smb2_read function is not move to fs/smb/server/smb2pdu.c.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..215ea7f83d09 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6249,6 +6249,11 @@ int smb2_read(struct ksmbd_work *work) int err = 0; WORK_BUFFERS(work, req, rsp); + if (work->next_smb2_rcv_hdr_off) { + work->send_no_response = 1; + err = -EOPNOTSUPP; + goto out; + } if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: no response from compound read
by Cai Xinchen 17 Jun '24

17 Jun '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.5-rc4 commit e202a1e8634b186da38cbbff85382ea2b9e297cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA5YWA CVE: CVE-2023-39179 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd doesn't support compound read. If client send read-read in compound to ksmbd, there can be memory leak from read buffer. Windows and linux clients doesn't send it to server yet. For now, No response from compound read. compound read will be supported soon. Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [smb2_read function is not move to fs/smb/server/smb2pdu.c.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 4df7108a886f..215ea7f83d09 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -6249,6 +6249,11 @@ int smb2_read(struct ksmbd_work *work) int err = 0; WORK_BUFFERS(work, req, rsp); + if (work->next_smb2_rcv_hdr_off) { + work->send_no_response = 1; + err = -EOPNOTSUPP; + goto out; + } if (test_share_config_flag(work->tcon->share_conf, KSMBD_SHARE_FLAG_PIPE)) { -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 11564/22941] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:53:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static?
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: efc3f2d315da751c5630099aab8580248002c483 commit: 9e1cec03a3abb934592272fc19603d00bb62f7cb [11564/22941] net: hns3: place cae entrance procedure implementations in a separate file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240617/202406171449.ubzd3IZW-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240617/202406171449.ubzd3IZW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406171449.ubzd3IZW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:53:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:54:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:57:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:58:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:96:43: sparse: got void *in_buff >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:139:32: sparse: got void *out_buf >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c:318:38: sparse: got void * vim +/g_hns3_cae_class +53 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_init.c 52 > 53 struct class *g_hns3_cae_class; > 54 struct cdev g_hns3_cae_cdev; 55 static const char hns3_driver_name[] = "hns3"; 56 > 57 int g_hns3_cae_init_flag; > 58 int g_hns3_cae_ref_cnt; 59 60 typedef int (*driv_module) (struct hns3_nic_priv *nic_dev, void *buf_in, 61 u32 in_size, void *buf_out, u32 out_size); 62 63 struct drv_module_handle { 64 enum driver_cmd_type driv_cmd_name; 65 driv_module driv_func; 66 }; 67 68 static void free_buff_in(void *buf_in) 69 { 70 if (!buf_in) 71 return; 72 73 kfree(buf_in); 74 } 75 76 static int alloc_buff_in(struct msg_module *nt_msg, u32 in_size, void **buf_in) 77 { 78 void *msg_buf; 79 80 if (!in_size) 81 return 0; 82 83 if (in_size > MAX_MSG_IN_SIZE) { 84 pr_err("msg in size(%u) more than %u\n", 85 in_size, MAX_MSG_IN_SIZE); 86 return -ENOMEM; 87 } 88 89 msg_buf = kzalloc((unsigned long)in_size, GFP_KERNEL); 90 *buf_in = msg_buf; 91 if (ZERO_OR_NULL_PTR(*buf_in)) { 92 pr_err("alloc buf_in failed\n"); 93 return -ENOMEM; 94 } 95 > 96 if (copy_from_user(msg_buf, nt_msg->in_buff, (unsigned long)in_size)) { 97 pr_err("Copy from user failed in %s function\n", __func__); 98 kfree(msg_buf); 99 return -EFAULT; 100 } 101 102 return 0; 103 } 104 105 static void free_buff_out(void *buf_out) 106 { 107 if (!buf_out) 108 return; 109 110 kfree(buf_out); 111 } 112 113 static int alloc_buff_out(u32 out_size, void **buf_out) 114 { 115 if (!out_size) 116 return 0; 117 118 if (out_size > MAX_MSG_OUT_SIZE) { 119 pr_err("msg out size(%u) more than %u\n", 120 out_size, MAX_MSG_OUT_SIZE); 121 return -ENOMEM; 122 } 123 124 *buf_out = kzalloc((unsigned long)out_size, GFP_KERNEL); 125 if (ZERO_OR_NULL_PTR(*buf_out)) { 126 pr_err("alloc buf_out failed\n"); 127 return -ENOMEM; 128 } 129 130 return 0; 131 } 132 133 static int copy_buf_out_to_user(struct msg_module *nt_msg, u32 out_size, 134 void **buf_out) 135 { 136 int ret = 0; 137 void *msg_out = buf_out; 138 > 139 if (copy_to_user(nt_msg->out_buf, msg_out, out_size)) 140 ret = -EFAULT; 141 142 return ret; 143 } 144 145 static int hns3_cae_netdev_match_check(struct net_device *netdev) 146 { 147 struct ethtool_drvinfo drv_info; 148 149 if (netdev->ethtool_ops->get_drvinfo) 150 netdev->ethtool_ops->get_drvinfo(netdev, &drv_info); 151 152 if (!strncmp(drv_info.driver, hns3_driver_name, 153 strlen(hns3_driver_name))) 154 return 0; 155 156 netdev_err(netdev, "match hns3 driver name(%s) failed\n", 157 drv_info.driver); 158 return -1; 159 } 160 161 #if (KERNEL_VERSION(4, 16, 0) < LINUX_VERSION_CODE) 162 static int kernel_sock_ioctl(struct socket *sock, int cmd, unsigned long arg) 163 { 164 mm_segment_t oldfs = get_fs(); 165 int err; 166 167 set_fs(KERNEL_DS); 168 err = sock->ops->ioctl(sock, cmd, arg); 169 set_fs(oldfs); 170 171 return err; 172 } 173 #endif 174 175 static struct net_device *get_netdev_by_ifname(char *ifname) 176 { 177 struct socket *temp_sock = NULL; 178 struct net_device *netdev = NULL; 179 struct ifreq ifr; 180 int err; 181 182 err = sock_create(PF_INET, SOCK_DGRAM, 0, &temp_sock); 183 if (err < 0) { 184 pr_err("fail to enter sock_create, err = %d\n", err); 185 return NULL; 186 } 187 188 strncpy(ifr.ifr_ifrn.ifrn_name, ifname, (unsigned long)IFNAMSIZ); 189 kernel_sock_ioctl(temp_sock, SIOCSIFNAME, (unsigned long)&ifr); 190 netdev = dev_get_by_name(sock_net(temp_sock->sk), ifname); 191 if (!netdev) 192 goto out; 193 194 dev_put(netdev); 195 196 out: 197 sock_release(temp_sock); 198 return netdev; 199 } 200 201 static int hns3_cae_k_get_netdev_by_ifname(char *ifname, 202 struct hns3_nic_priv **nic_dev) 203 { 204 struct net_device *netdev = NULL; 205 206 netdev = get_netdev_by_ifname(ifname); 207 if (!netdev) { 208 pr_err("not find the netdevice(%s)!\n", ifname); 209 return -EFAULT; 210 } 211 212 if (hns3_cae_netdev_match_check(netdev)) { 213 netdev_err(netdev, "netdevice is not hns device.\n"); 214 return -EFAULT; 215 } 216 217 *nic_dev = (struct hns3_nic_priv *)netdev_priv(netdev); 218 if (!(*nic_dev)) { 219 netdev_err(netdev, "no private data\n"); 220 return -EFAULT; 221 } 222 223 return 0; 224 } 225 > 226 struct drv_module_handle driv_module_cmd_handle[] = { 227 {FW_VER, hns3_cae_get_fw_ver}, 228 {DRIVER_VER, hns3_cae_get_driver_ver}, 229 {CHECKSUM_CFG, hns3_cae_chs_cfg}, 230 {TM_QUEUE_CFG, hns3_cae_queue_cfg}, 231 {TM_QSET_CFG, hns3_cae_qs_cfg}, 232 {TM_PRI_CFG, hns3_cae_pri_cfg}, 233 {TM_PG_CFG, hns3_cae_pg_cfg}, 234 {TM_PORT_CFG, hns3_cae_port_cfg}, 235 {TM_ETS_CFG, hns3_cae_ets_cfg}, 236 {DCB_MODE_CFG, hns3_cae_dcb_cfg}, 237 {ETS_MODE_CFG, hns3_cae_dcb_ets_cfg}, 238 {PFC_MODE_CFG, hns3_cae_dcb_pfc_cfg}, 239 {MAC_LOOP_CFG, hns3_cae_mac_loop_cfg}, 240 {DFX_INFO_CMD, hns3_cae_get_dfx_info}, 241 {DFX_READ_CMD, hns3_cae_read_dfx_info}, 242 {EVENT_INJECTION_CMD, hns3_cae_event_injection}, 243 {SEND_PKT, hns3_cae_send_pkt}, 244 {RX_PRIV_BUFF_WL_CFG, hns3_cae_rx_priv_buff_wl_cfg}, 245 {RX_COMMON_THRD_CFG, hns3_cae_common_thrd_cfg}, 246 {RX_COMMON_WL_CFG, hns3_cae_common_wl_cfg}, 247 {SHOW_RX_PRIV_WL, hns3_cae_show_rx_priv_wl}, 248 {SHOW_RX_COMM_THRES, hns3_cae_show_comm_thres}, 249 {QCN_EN_CFG, hns3_cae_qcn_cfg}, 250 {RX_BUFF_CFG, hns3_cae_rx_buff_cfg}, 251 {TX_BUFF_CFG, hns3_cae_tx_buff_cfg}, 252 {RESET_CFG, hns3_cae_nic_reset}, 253 {TIMEOUT_CFG, hns3_cae_nic_timeout_cfg}, 254 {PROMISC_MODE_CFG, hns3_promisc_mode_cfg}, 255 {QINFO_CFG, hns3_cae_qinfo_cfg}, 256 #ifdef CONFIG_IT_VALIDATION 257 {MACTABLE_CFG, hns3_cae_opt_mactbl}, 258 #endif 259 {CLEAN_STATS, hns3_cae_clean_stats}, 260 {FD_CFG, hns3_cae_fd_cfg}, 261 {RSS_GENERIC_CFG, hns3_cae_rss_cfg}, 262 {REG_CFG, hns3_cae_reg_cfg}, 263 {COM_REG_CFG, hns3_cae_common_cmd_send}, 264 {GRO_CFG, hns3_gro_age_handle}, 265 {M7_CMD_MODE_CFG, hns3_m7_cmd_handle}, 266 {QRES_CFG, hns3_cae_qres_cfg}, 267 {STAT_CFG, hns3_stat_mode_cfg}, 268 {IRQ_CFG, hns3_irq_lli_cfg}, 269 {VLAN_UPMAPPING, hns3_cae_upmapping_cfg}, 270 #ifdef CONFIG_EXT_TEST 271 {LAMP_CFG, hns3_lamp_cfg}, 272 {EXTERN_INTERFACE_CFG, hns3_ext_interface_test}, 273 #endif 274 {XSFP_CFG, hns3_xsfp_cfg}, 275 {SHOW_PORT_INFO, hns3_get_port_info}, 276 {SHOW_HILINK_PARAM, hns3_get_hilink_param}, 277 {DCQCN_PARM_CFG, hns3_nic_dcqcn}, 278 {DCQCN_GET_MSG_CNT_CMD, hns3_dcqcn_get_msg_cnt} 279 }; 280 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/9] sync hulk-5.10 patches
by Yu Kuai 17 Jun '24

17 Jun '24

Changes in v5: - rebase Changes in v4: - just resend Changes in v3: - modify openeuler_defconfig for disabled new config in patch 1,2 Changes in v2: - fix head in commit message Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (7): block: add a switch to enable hungtask check for io blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (7): block: add a switch to enable hungtask check for io blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 37 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 97 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 11 +++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 +++++++++++++++++--- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 7 +- kernel/trace/blktrace.c | 3 - 18 files changed, 264 insertions(+), 41 deletions(-) -- 2.39.2

2 10

[PATCH OLK-6.6] ext4: Skip moving extents if page writeback failed
by Zhihao Cheng 17 Jun '24

17 Jun '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5XLM CVE: NA -------------------------------- Ext4 should check the return value of ext4_disable_buffered_iomap_aops() before moving extents, otherwise the EXT4_STATE_BUFFERED_IOMAP state is not cleared from the inode, which could trigger the WARNON in function _ext4_get_block(). Fixes: 2a158d544250 ("ext4: fall back to buffer_head path for defrag") Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/move_extent.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c index f58c0cb4dd76..afd7869cae9a 100644 --- a/fs/ext4/move_extent.c +++ b/fs/ext4/move_extent.c @@ -640,10 +640,16 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, inode_dio_wait(donor_inode); /* Fallback to buffer_head aops for inodes with buffered iomap aops */ - if (ext4_test_inode_state(orig_inode, EXT4_STATE_BUFFERED_IOMAP)) - ext4_disable_buffered_iomap_aops(orig_inode); - if (ext4_test_inode_state(donor_inode, EXT4_STATE_BUFFERED_IOMAP)) - ext4_disable_buffered_iomap_aops(donor_inode); + if (ext4_test_inode_state(orig_inode, EXT4_STATE_BUFFERED_IOMAP)) { + ret = ext4_disable_buffered_iomap_aops(orig_inode); + if (ret) + goto out_unlock; + } + if (ext4_test_inode_state(donor_inode, EXT4_STATE_BUFFERED_IOMAP)) { + ret = ext4_disable_buffered_iomap_aops(donor_inode); + if (ret) + goto out_unlock; + } /* Protect extent tree against block allocations via delalloc */ ext4_double_down_write_data_sem(orig_inode, donor_inode); @@ -728,6 +734,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp, __u64 orig_blk, ext4_free_ext_path(path); ext4_double_up_write_data_sem(orig_inode, donor_inode); +out_unlock: unlock_two_nondirectories(orig_inode, donor_inode); return ret; -- 2.31.1

2 1

[openeuler:openEuler-1.0-LTS 11561/22937] drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 17 Jun '24

17 Jun '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 745a3c567e1c329d131a8896642475f3916d020a commit: fb55aa477dfa7f488f112a8b87116962d623ff63 [11561/22937] net: hns3: place cae regconfig-related implementations in an independent file config: arm64-randconfig-r111-20240615 (https://download.01.org/0day-ci/archive/20240617/202406171104.ZG6iVFTd-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240617/202406171104.ZG6iVFTd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202406171104.ZG6iVFTd-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:51:14: sparse: sparse: symbol 'g_hns3_cae_class' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:52:13: sparse: sparse: symbol 'g_hns3_cae_cdev' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:55:5: sparse: sparse: symbol 'g_hns3_cae_init_flag' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:56:5: sparse: sparse: symbol 'g_hns3_cae_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void *in_buff @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:94:43: sparse: got void *in_buff drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] <asn:1> *to @@ got void *out_buf @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: expected void [noderef] <asn:1> *to drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:137:32: sparse: got void *out_buf drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: sparse: sparse: symbol 'hns3_cae_get_commit_id' was not declared. Should it be static? drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] <asn:1> *from @@ got void * @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: expected void const [noderef] <asn:1> *from drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:343:38: sparse: got void * drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 @@ got unsigned int @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: expected restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:579:30: sparse: got unsigned int >> drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int @@ got restricted __le32 @@ drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: expected unsigned int drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:597:53: sparse: got restricted __le32 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c:224:5: warning: no previous prototype for 'hns3_cae_get_commit_id' [-Wmissing-prototypes] 224 | int hns3_cae_get_commit_id(struct hnae3_handle *handle, u8 *commit_id, | ^~~~~~~~~~~~~~~~~~~~~~ vim +597 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lib.c 558 559 int hns3_cae_common_cmd_send(struct hns3_nic_priv *net_priv, void *buf_in, 560 u32 in_size, void *buf_out, u32 out_size) 561 { 562 #define MAX_DESC_DATA_LEN 6 563 struct cmd_desc_param *param_in; 564 struct hclge_vport *vport; 565 struct hclge_dev *hdev; 566 struct hclge_desc desc; 567 bool check; 568 int ret; 569 int i; 570 571 check = !buf_in || in_size < sizeof(struct cmd_desc_param); 572 vport = hns3_cae_get_vport(net_priv->ae_handle); 573 hdev = vport->back; 574 575 param_in = (struct cmd_desc_param *)buf_in; 576 hns3_cae_cmd_setup_basic_desc(&desc, param_in->fw_dw_opcode, 577 param_in->is_read); 578 for (i = 0; i < MAX_DESC_DATA_LEN; i++) 579 desc.data[i] = param_in->reg_desc.data[i]; 580 ret = hns3_cae_cmd_send(hdev, &desc, 1); 581 if (ret) { 582 dev_err(&hdev->pdev->dev, "%s, ret is %d.\n", __func__, 583 ret); 584 return ret; 585 } 586 if (param_in->is_read) { 587 struct cmd_desc_param *param_out = 588 (struct cmd_desc_param *)buf_out; 589 590 check = !buf_out || out_size < sizeof(struct cmd_desc_param); 591 if (check) { 592 pr_err("input param buf_out error in %s function\n", 593 __func__); 594 return -EFAULT; 595 } 596 for (i = 0; i < MAX_DESC_DATA_LEN; i++) > 597 param_out->reg_desc.data[i] = desc.data[i]; -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v5 0/9] sync hulk-5.10 patches
by Yu Kuai 17 Jun '24

17 Jun '24

Changes in v5: - rebase Changes in v4: - just resend Changes in v3: - modify openeuler_defconfig for disabled new config in patch 1,2 Changes in v2: - fix head in commit message Christoph Hellwig (2): block: serialize all debugfs operations using q->debugfs_mutex block: remove per-disk debugfs files in blk_unregister_queue Yu Kuai (7): block: add a switch to enable hungtask check for io blk-throttle: add a config to control hierarchical throttle in cgroup v1 blk-throttle: fix missing prefix "CONFIG_" block: protect blk_mq_debugfs_register/unregister_hctx() with 'debugfs_mutex' block: shutdown blktrace in blk_release_queue() block: support enable/disable blk-mq debugfs dynamically block: fix kabi broken in struct request_queue arch/arm64/configs/openeuler_defconfig | 3 + arch/powerpc/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 3 + block/Kconfig | 37 +++++++++ block/bio.c | 2 +- block/blk-core.c | 13 +++- block/blk-exec.c | 2 +- block/blk-mq-debugfs.c | 97 +++++++++++++++++++++--- block/blk-mq-debugfs.h | 5 -- block/blk-mq-sched.c | 11 +++ block/blk-mq.c | 11 +++ block/blk-rq-qos.c | 2 - block/blk-rq-qos.h | 7 +- block/blk-sysfs.c | 82 +++++++++++++++++--- block/blk-throttle.c | 17 ++++- block/blk.h | 1 + include/linux/blkdev.h | 7 +- kernel/trace/blktrace.c | 3 - 18 files changed, 264 insertions(+), 41 deletions(-) -- 2.39.2

2 10

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
by Zhengchao Shao 17 Jun '24

17 Jun '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.10-rc1 commit a5b862c6a221459d54e494e88965b48dcfa6cc44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA3COJ CVE: CVE-2024-36968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Fixes: 6ed58ec520ad ("Bluetooth: Use LE buffers for LE traffic") Suggested-by: Luiz Augusto von Dentz <luiz.dentz(a)gmail.com> Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_conn.c net/bluetooth/hci_event.c net/bluetooth/l2cap_core.c net/bluetooth/sco.c net/bluetooth/iso.c [The conflict occurs because the commit eca0ae4aea66("Bluetooth: Add initial implementation of BIS connections") and 26afbd826ee3("Bluetooth: Add initial implementation of CIS connections") and 181a42edddf5(" Bluetooth: Make handle of hci_conn be unique") and c8992cffbe74(" Bluetooth: hci_event: Use of a function table to handle Command Complete") and e7b02296fb40 ("Bluetooth: Remove BT_HS") and ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") are not merged. In the hci_conn_add function, if the MTU is abnormal, NULL is returned. No adaptation is required in subsequent interfaces] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/net/bluetooth/hci.h | 9 +++++++++ include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_conn.c | 26 ++++++++++++++++++++++++++ net/bluetooth/hci_event.c | 8 ++++++++ net/bluetooth/l2cap_core.c | 17 +++-------------- net/bluetooth/sco.c | 6 +++--- 6 files changed, 50 insertions(+), 17 deletions(-) diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h index ede7a153c69a..e6dfbeb4f663 100644 --- a/include/net/bluetooth/hci.h +++ b/include/net/bluetooth/hci.h @@ -1430,6 +1430,15 @@ struct hci_cp_le_set_event_mask { __u8 mask[8]; } __packed; +/* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E + * 7.8.2 LE Read Buffer Size command + * MAX_LE_MTU is 0xffff. + * 0 is also valid. It means that no dedicated LE Buffer exists. + * It should use the HCI_Read_Buffer_Size command and mtu is shared + * between BR/EDR and LE. + */ +#define HCI_MIN_LE_MTU 0x001b + #define HCI_OP_LE_READ_BUFFER_SIZE 0x2002 struct hci_rp_le_read_buffer_size { __u8 status; diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 33873266b2bc..202367e98eea 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -607,6 +607,7 @@ struct hci_conn { __u8 resp_addr_type; __u16 handle; __u16 state; + __u16 mtu; __u8 mode; __u8 type; __u8 role; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 52e512f41da3..de1e47b70d0e 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -520,6 +520,27 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, { struct hci_conn *conn; + switch (type) { + case ACL_LINK: + if (!hdev->acl_mtu) + return NULL; + break; + case LE_LINK: + if (hdev->le_mtu && hdev->le_mtu < HCI_MIN_LE_MTU) + return NULL; + if (!hdev->le_mtu && hdev->acl_mtu < HCI_MIN_LE_MTU) + return NULL; + break; + case SCO_LINK: + case ESCO_LINK: + if (!hdev->sco_pkts) + /* Controller does not support SCO or eSCO over HCI */ + return NULL; + break; + default: + return NULL; + } + BT_DBG("%s dst %pMR", hdev->name, dst); conn = kzalloc(sizeof(*conn), GFP_KERNEL); @@ -553,10 +574,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, switch (type) { case ACL_LINK: conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK; + conn->mtu = hdev->acl_mtu; break; case LE_LINK: /* conn->src should reflect the local identity address */ hci_copy_identity_address(hdev, &conn->src, &conn->src_type); + conn->mtu = hdev->le_mtu ? hdev->le_mtu : hdev->acl_mtu; break; case SCO_LINK: if (lmp_esco_capable(hdev)) @@ -564,9 +587,12 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst, (hdev->esco_type & EDR_ESCO_MASK); else conn->pkt_type = hdev->pkt_type & SCO_PTYPE_MASK; + + conn->mtu = hdev->sco_mtu; break; case ESCO_LINK: conn->pkt_type = hdev->esco_type & ~EDR_ESCO_MASK; + conn->mtu = hdev->sco_mtu; break; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 4027c79786fd..e01159d8fabf 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -731,6 +731,10 @@ static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb) if (rp->status) return; + if (!__le16_to_cpu(rp->acl_mtu) || + !__le16_to_cpu(rp->acl_max_pkt)) + return; + hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu); hdev->sco_mtu = rp->sco_mtu; hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt); @@ -1020,6 +1024,10 @@ static void hci_cc_le_read_buffer_size(struct hci_dev *hdev, if (rp->status) return; + if (__le16_to_cpu(rp->le_mtu) && + __le16_to_cpu(rp->le_mtu) < HCI_MIN_LE_MTU) + return; + hdev->le_mtu = __le16_to_cpu(rp->le_mtu); hdev->le_pkts = rp->le_max_pkt; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 8ac9adb2b28b..6f93e2a7bf91 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -7241,7 +7241,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan) if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; return l2cap_resegment(chan); } @@ -7312,7 +7312,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, if (chan->hs_hcon) chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; else - chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; + chan->conn->mtu = chan->conn->hcon->mtu; err = l2cap_resegment(chan); @@ -7863,18 +7863,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); - switch (hcon->type) { - case LE_LINK: - if (hcon->hdev->le_mtu) { - conn->mtu = hcon->hdev->le_mtu; - break; - } - fallthrough; - default: - conn->mtu = hcon->hdev->acl_mtu; - break; - } - + conn->mtu = hcon->mtu; conn->feat_mask = 0; conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index f9a2993fd452..1e5daa03155f 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -127,7 +127,6 @@ static void sco_sock_clear_timer(struct sock *sk) /* ---- SCO connections ---- */ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) { - struct hci_dev *hdev = hcon->hdev; struct sco_conn *conn = hcon->sco_data; if (conn) @@ -142,9 +141,10 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon) hcon->sco_data = conn; conn->hcon = hcon; + conn->mtu = hcon->mtu; - if (hdev->sco_mtu > 0) - conn->mtu = hdev->sco_mtu; + if (hcon->mtu > 0) + conn->mtu = hcon->mtu; else conn->mtu = 60; -- 2.34.1

2 1