Re: [RFC PATCH v12 04/20] ipe: add LSM hooks on execution and kernel read

[kernel test robot <lkp@intel.com>]

Hi Fan,

[This is a private test report for your RFC patch.]
kernel test robot noticed the following build warnings:

[auto build test WARNING on axboe-block/for-next]
[also build test WARNING on lwn/docs-next linus/master v6.8-rc2 next-20240202]
[cannot apply to device-mapper-dm/for-next]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Fan-Wu/security-add-ipe-lsm/20240131-064224
base:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-next
patch link:    https://lore.kernel.org/r/1706654228-17180-5-git-send-email-wufan%40linux.microsoft.com
patch subject: [RFC PATCH v12 04/20] ipe: add LSM hooks on execution and kernel read
config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20240202/202402022217.BvClYUqt-lkp@intel.com/config)
compiler: loongarch64-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240202/202402022217.BvClYUqt-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202402022217.BvClYUqt-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> security/ipe/hooks.c:51: warning: Function parameter or struct member '__always_unused' not described in 'ipe_mmap_file'
   security/ipe/hooks.c:51: warning: Excess function parameter 'reqprot' description in 'ipe_mmap_file'
>> security/ipe/hooks.c:79: warning: Function parameter or struct member '__always_unused' not described in 'ipe_file_mprotect'
   security/ipe/hooks.c:79: warning: Excess function parameter 'reqprot' description in 'ipe_file_mprotect'


vim +51 security/ipe/hooks.c

    33	
    34	/**
    35	 * ipe_mmap_file - ipe security hook function for mmap check.
    36	 * @f: File being mmap'd. Can be NULL in the case of anonymous memory.
    37	 * @reqprot: The requested protection on the mmap, passed from usermode.
    38	 * @prot: The effective protection on the mmap, resolved from reqprot and
    39	 *	  system configuration.
    40	 * @flags: Unused.
    41	 *
    42	 * This hook is called when a file is loaded through the mmap
    43	 * family of system calls.
    44	 *
    45	 * Return:
    46	 * * 0	- OK
    47	 * * !0	- Error
    48	 */
    49	int ipe_mmap_file(struct file *f, unsigned long reqprot __always_unused,
    50			  unsigned long prot, unsigned long flags)
  > 51	{
    52		struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
    53	
    54		if (prot & PROT_EXEC) {
    55			build_eval_ctx(&ctx, f, IPE_OP_EXEC);
    56			return ipe_evaluate_event(&ctx);
    57		}
    58	
    59		return 0;
    60	}
    61	
    62	/**
    63	 * ipe_file_mprotect - ipe security hook function for mprotect check.
    64	 * @vma: Existing virtual memory area created by mmap or similar.
    65	 * @reqprot: The requested protection on the mmap, passed from usermode.
    66	 * @prot: The effective protection on the mmap, resolved from reqprot and
    67	 *	  system configuration.
    68	 *
    69	 * This LSM hook is called when a mmap'd region of memory is changing
    70	 * its protections via mprotect.
    71	 *
    72	 * Return:
    73	 * * 0	- OK
    74	 * * !0	- Error
    75	 */
    76	int ipe_file_mprotect(struct vm_area_struct *vma,
    77			      unsigned long reqprot __always_unused,
    78			      unsigned long prot)
  > 79	{
    80		struct ipe_eval_ctx ctx = IPE_EVAL_CTX_INIT;
    81	
    82		/* Already Executable */
    83		if (vma->vm_flags & VM_EXEC)
    84			return 0;
    85	
    86		if (prot & PROT_EXEC) {
    87			build_eval_ctx(&ctx, vma->vm_file, IPE_OP_EXEC);
    88			return ipe_evaluate_event(&ctx);
    89		}
    90	
    91		return 0;
    92	}
    93	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki