Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

odroidgoA: Patches to build with GCC 10 #410

Open
wants to merge 13 commits into
base: odroidgoA-4.4.y
Choose a base branch
from
Open

odroidgoA: Patches to build with GCC 10 #410

wants to merge 13 commits into from

Conversation

glebm
Copy link

@glebm glebm commented Jan 25, 2021 •
edited
Loading

Patches to make OGA Linux build with gcc-10

Requires #404 and #406 (gcc-9 patches)

glebm and others added 11 commits January 25, 2021 00:41
@glebm
perf: cs-etm: fix duplicate def of traceid_list
7cdd201 
Backport of 168200b upstream

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm
perf bench: Share some global variables to fix build with gcc 10
62b75df 
Based on https://git.yoctoproject.org/cgit/cgit.cgi/meta-arm/tree/meta-arm-bsp/recipes-kernel/linux/linux-yocto-5.3/0003-perf-bench-Share-some-global-variables-to-fix-build-.patch

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm
perf: Make perf able to build with latest libbfd
89b28cc 
Based on http://lore.kernel.org/lkml/[email protected]

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@zandrey @glebm
tools lib api fs: Fix gcc9 stringop-truncation compilation error
186f5ff 
GCC9 introduced string hardening mechanisms, which exhibits the error
during fs api compilation:

error: '__builtin_strncpy' specified bound 4096 equals destination size
[-Werror=stringop-truncation]

This comes when the length of copy passed to strncpy is is equal to
destination size, which could potentially lead to buffer overflow.

There is a need to mitigate this potential issue by limiting the size of
destination by 1 and explicitly terminate the destination with NULL.

Signed-off-by: Andrey Zhizhikin <[email protected]>
Reviewed-by: Petr Mladek <[email protected]>
Acked-by: Jiri Olsa <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Andrii Nakryiko <[email protected]>
Cc: Daniel Borkmann <[email protected]>
Cc: Kefeng Wang <[email protected]>
Cc: Martin KaFai Lau <[email protected]>
Cc: Petr Mladek <[email protected]>
Cc: Sergey Senozhatsky <[email protected]>
Cc: Song Liu <[email protected]>
Cc: Yonghong Song <[email protected]>
Cc: [email protected]
Cc: [email protected]
Link: http://lore.kernel.org/lkml/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
@glebm
Clean the new GCC 9 -Wmissing-attributes warnings
29d83af 
Backport https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b999ae3614d09d97a1575936bcee884f912b10e

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm
nf_conntrack_core: Fix gcc-10 compilation
0ce5411 
gcc-10 emits the following error:

> warning: array subscript 0 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[0]'} [-Wzero-length-bounds]

Based on https://lkml.org/lkml/2020/4/30/1476

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm
wlcore: debugfs: Remove unused variable 'res'
4e2bc2d 
Fixes the following W=1 kernel build warning(s):

Cc: Kalle Valo <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Luciano Coelho <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Lee Jones <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
@glebm
usb: ehci: avoid gcc-10 zero-length-bounds warning
7eae4ba 
Backport of https://lkml.org/lkml/2020/4/30/1475

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@torvalds @glebm
gcc-10 warnings: fix low-hanging fruit
6fb2704 
Backport of 9d82973

Original description below
---

Due to a bug-report that was compiler-dependent, I updated one of my
machines to gcc-10.  That shows a lot of new warnings.  Happily they
seem to be mostly the valid kind, but it's going to cause a round of
churn for getting rid of them..

This is the really low-hanging fruit of removing a couple of zero-sized
arrays in some core code.  We have had a round of these patches before,
and we'll have many more coming, and there is nothing special about
these except that they were particularly trivial, and triggered more
warnings than most.

Signed-off-by: Linus Torvalds <[email protected]>
@glebm
Fix joystick/analog.c GCC-10 -Wrestrict warning
e76f457 
drivers/input/joystick/analog.c: In function 'analog_connect':
drivers/input/joystick/analog.c:444:3: warning: 'snprintf' argument 4 overlaps destination object '<unknown>' [-Wrestrict]
error, forbidden warning:analog.c:444
  444 |   snprintf(analog->name, sizeof(analog->name), "%s %d-hat",
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  445 |     analog->name, hweight16(analog->mask & ANALOG_HATS_ALL));
      |     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm
drivers/net/phy/mdio_bus: Fix gcc-10 -Wrestrict
c7c2392 
Fixes

drivers/net/phy/mdio_bus.c: In function 'phy_registers_show':
drivers/net/phy/mdio_bus.c:665:3: warning: 'sprintf' argument 3 overlaps destination object 'buf' [-Wrestrict]
error, forbidden warning:mdio_bus.c:665
  665 |   sprintf(buf, "%s%2d: 0x%x\n", buf, index,
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  666 |    phy_read(phydev, index));
      |    ~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/phy/mdio_bus.c:659:77: note: destination object referenced by 'restrict'-qualified argument 1 was declared here
  659 | phy_registers_show(struct device *dev, struct device_attribute *attr, char *buf)
      |                                                                       ~~~~~~^~~

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm glebm changed the title odroidgoA: Patches to make perf build with gcc 9 and 10 odroidgoA: Patches to build with GCC 10 Jan 25, 2021
@JeonghwaCho
Copy link
Collaborator

@glebm,
Thank you for the PR.
I will check the patches.

@glebm glebm force-pushed the odroidgoA-4.4.y-perf-fix branch 2 times, most recently from 2460194 to ebedd1f Compare January 25, 2021 04:18
@glebm
Copy link
Author

glebm commented Jan 25, 2021

@JeonghwaCho I'm still working on this, will let you know once it builds

@glebm
drivers/net/wireless: Fix gcc-10 -Wrestrict
e14af2d 
Fixes errors such as:

drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c: In function 'rtw_mp_txpower_index':
drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c:573:4: warning: 'sprintf' argument 3 overlaps destination object 'extra' [-Wrestrict]
error, forbidden warning:ioctl_mp.c:573
  573 |    sprintf(extra, "%s,pathb=%d", extra, txpower_inx);
      |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/rtl8821cu/os_dep/linux/ioctl_mp.c:546:34: note: destination object referenced by 'restrict'-qualified argument 1 was declared here
  546 |     struct iw_point *wrqu, char *extra)
      |                            ~~~~~~^~~~~

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm
Copy link
Author

glebm commented Jan 25, 2021

@JeonghwaCho It builds 🎉

@glebm glebm mentioned this pull request Jan 25, 2021
Merged
@glebm
Copy link
Author

glebm commented Jan 25, 2021

Does not boot for me, not sure why (don't have a UART hooked up)

#404 and #406 gcc-9 patches are good, they've been used in batocera.linux for ages

@glebm
Copy link
Author

glebm commented Jan 25, 2021 •
edited
Loading

If someone has access to UART, I'd appreciate help debugging the boot

@glebm
Copy link
Author

glebm commented Jan 26, 2021 •
edited
Loading

Confirmed that it boots and works! Simply had to change the dtb address because I also switched to aarch64 mode (0x1000000 instead of 0x01f00000)

glebm added a commit to glebm/batocera.linux that referenced this pull request Jan 26, 2021
@glebm
odroidgoa kernel gcc-10 patches
a542f25 
Also sent upstream hardkernel/linux#410

The kernel builds with these patches and aarch64
linux-tools perf also builds

Signed-off-by: Gleb Mazovetskiy <[email protected]>
@glebm
Copy link
Author

glebm commented Feb 2, 2021 •
edited
Loading

These PRs were merged as patches into Batocera.Linux a week ago.

I've been using this with no problems on a device similar to OGA, a few other people on the batocera discord have been using it on the OGS.

mdrjr pushed a commit that referenced this pull request Aug 28, 2023
@zhengchaoshao @gregkh
ip6_vti: fix slab-use-after-free in decode_session6
55ad230 
[ Upstream commit 9fd41f1 ]

When ipv6_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.

The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xd9/0x150
print_address_description.constprop.0+0x2c/0x3c0
kasan_report+0x11d/0x130
decode_session6+0x103f/0x1890
__xfrm_decode_session+0x54/0xb0
vti6_tnl_xmit+0x3e6/0x1ee0
dev_hard_start_xmit+0x187/0x700
sch_direct_xmit+0x1a3/0xc30
__qdisc_run+0x510/0x17a0
__dev_queue_xmit+0x2215/0x3b10
neigh_connected_output+0x3c2/0x550
ip6_finish_output2+0x55a/0x1550
ip6_finish_output+0x6b9/0x1270
ip6_output+0x1f1/0x540
ndisc_send_skb+0xa63/0x1890
ndisc_send_rs+0x132/0x6f0
addrconf_rs_timer+0x3f1/0x870
call_timer_fn+0x1a0/0x580
expire_timers+0x29b/0x4b0
run_timer_softirq+0x326/0x910
__do_softirq+0x1d4/0x905
irq_exit_rcu+0xb7/0x120
sysvec_apic_timer_interrupt+0x97/0xc0
</IRQ>
Allocated by task 9176:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
__kasan_slab_alloc+0x7f/0x90
kmem_cache_alloc_node+0x1cd/0x410
kmalloc_reserve+0x165/0x270
__alloc_skb+0x129/0x330
netlink_sendmsg+0x9b1/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x739/0x920
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9176:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
kasan_save_free_info+0x2b/0x40
____kasan_slab_free+0x160/0x1c0
slab_free_freelist_hook+0x11b/0x220
kmem_cache_free+0xf0/0x490
skb_free_head+0x17f/0x1b0
skb_release_data+0x59c/0x850
consume_skb+0xd2/0x170
netlink_unicast+0x54f/0x7f0
netlink_sendmsg+0x926/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x739/0x920
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88802e08ed00
which belongs to the cache skbuff_small_head of size 640
The buggy address is located 194 bytes inside of
freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)

As commit f855691 ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.

Fixes: f855691 ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: Zhengchao Shao <[email protected]>
Signed-off-by: Steffen Klassert <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
mdrjr pushed a commit that referenced this pull request Sep 11, 2023
@zhengchaoshao @gregkh
ip6_vti: fix slab-use-after-free in decode_session6
eb47e61 
[ Upstream commit 9fd41f1 ]

When ipv6_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.

The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890
Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xd9/0x150
print_address_description.constprop.0+0x2c/0x3c0
kasan_report+0x11d/0x130
decode_session6+0x103f/0x1890
__xfrm_decode_session+0x54/0xb0
vti6_tnl_xmit+0x3e6/0x1ee0
dev_hard_start_xmit+0x187/0x700
sch_direct_xmit+0x1a3/0xc30
__qdisc_run+0x510/0x17a0
__dev_queue_xmit+0x2215/0x3b10
neigh_connected_output+0x3c2/0x550
ip6_finish_output2+0x55a/0x1550
ip6_finish_output+0x6b9/0x1270
ip6_output+0x1f1/0x540
ndisc_send_skb+0xa63/0x1890
ndisc_send_rs+0x132/0x6f0
addrconf_rs_timer+0x3f1/0x870
call_timer_fn+0x1a0/0x580
expire_timers+0x29b/0x4b0
run_timer_softirq+0x326/0x910
__do_softirq+0x1d4/0x905
irq_exit_rcu+0xb7/0x120
sysvec_apic_timer_interrupt+0x97/0xc0
</IRQ>
Allocated by task 9176:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
__kasan_slab_alloc+0x7f/0x90
kmem_cache_alloc_node+0x1cd/0x410
kmalloc_reserve+0x165/0x270
__alloc_skb+0x129/0x330
netlink_sendmsg+0x9b1/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x739/0x920
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 9176:
kasan_save_stack+0x22/0x40
kasan_set_track+0x25/0x30
kasan_save_free_info+0x2b/0x40
____kasan_slab_free+0x160/0x1c0
slab_free_freelist_hook+0x11b/0x220
kmem_cache_free+0xf0/0x490
skb_free_head+0x17f/0x1b0
skb_release_data+0x59c/0x850
consume_skb+0xd2/0x170
netlink_unicast+0x54f/0x7f0
netlink_sendmsg+0x926/0xe30
sock_sendmsg+0xde/0x190
____sys_sendmsg+0x739/0x920
___sys_sendmsg+0x110/0x1b0
__sys_sendmsg+0xf7/0x1c0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88802e08ed00
which belongs to the cache skbuff_small_head of size 640
The buggy address is located 194 bytes inside of
freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)

As commit f855691 ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.

Fixes: f855691 ("xfrm6: Fix the nexthdr offset in _decode_session6.")
Signed-off-by: Zhengchao Shao <[email protected]>
Signed-off-by: Steffen Klassert <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@glebm @JeonghwaCho @zandrey @torvalds