December 2024 - Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2600/2600] arch/arm64/include/asm/cmpxchg.h:88:1: sparse: sparse: cast truncates bits from constant value (3fff becomes ff)
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 053a6b6f8e4c86200cdb20bc80c063c3bb119859 commit: 2cef14dac00fca28ba2c0492e70bb537cba83f4d [2600/2600] mm/pin_mem: add PG_hotreplace to mark pages need hotreplaced config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412280149.2dV0pFCu-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412280149.2dV0pFCu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412280149.2dV0pFCu-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/memory.c:5306:22: sparse: sparse: cast removes address space '__user' of expression mm/memory.c:273:46: sparse: sparse: self-comparison always evaluates to false mm/memory.c:307:46: sparse: sparse: self-comparison always evaluates to false mm/memory.c:943:17: sparse: sparse: context imbalance in 'copy_pte_range' - different lock contexts for basic block mm/memory.c:1099:61: sparse: sparse: self-comparison always evaluates to false mm/memory.c:1123:61: sparse: sparse: self-comparison always evaluates to false mm/memory.c:1635:16: sparse: sparse: context imbalance in '__get_locked_pte' - different lock contexts for basic block mm/memory.c:1684:9: sparse: sparse: context imbalance in 'insert_page' - different lock contexts for basic block mm/memory.c:2186:17: sparse: sparse: context imbalance in 'remap_pte_range' - different lock contexts for basic block mm/memory.c:2243:46: sparse: sparse: self-comparison always evaluates to false mm/memory.c:2265:46: sparse: sparse: self-comparison always evaluates to false mm/memory.c:2431:17: sparse: sparse: context imbalance in 'apply_to_pte_range' - unexpected unlock mm/memory.c:2504:46: sparse: sparse: self-comparison always evaluates to false mm/memory.c:2540:46: sparse: sparse: self-comparison always evaluates to false mm/memory.c:2719:17: sparse: sparse: context imbalance in 'wp_page_copy' - unexpected unlock mm/memory.c: note: in included file (through arch/arm64/include/asm/atomic.h, include/linux/atomic.h, include/asm-generic/bitops/atomic.h, ...): >> arch/arm64/include/asm/cmpxchg.h:88:1: sparse: sparse: cast truncates bits from constant value (3fff becomes ff) >> arch/arm64/include/asm/cmpxchg.h:88:1: sparse: sparse: cast truncates bits from constant value (3fff becomes ff) mm/memory.c:3064:17: sparse: sparse: context imbalance in 'wp_pfn_shared' - unexpected unlock >> arch/arm64/include/asm/cmpxchg.h:88:1: sparse: sparse: cast truncates bits from constant value (3fff becomes ff) >> arch/arm64/include/asm/cmpxchg.h:88:1: sparse: sparse: cast truncates bits from constant value (3fff becomes ff) mm/memory.c:3127:19: sparse: sparse: context imbalance in 'do_wp_page' - different lock contexts for basic block mm/memory.c:3755:19: sparse: sparse: context imbalance in 'pte_alloc_one_map' - different lock contexts for basic block mm/memory.c:3982:17: sparse: sparse: context imbalance in 'finish_fault' - unexpected unlock mm/memory.c:4091:9: sparse: sparse: context imbalance in 'do_fault_around' - unexpected unlock mm/memory.c:4814:5: sparse: sparse: context imbalance in 'follow_invalidate_pte' - different lock contexts for basic block mm/memory.c:4935:9: sparse: sparse: context imbalance in 'follow_pfn' - unexpected unlock -- mm/migrate.c: note: in included file (through arch/arm64/include/asm/atomic.h, include/linux/atomic.h, include/asm-generic/bitops/atomic.h, ...): >> arch/arm64/include/asm/cmpxchg.h:88:1: sparse: sparse: cast truncates bits from constant value (3fff becomes ff) vim +88 arch/arm64/include/asm/cmpxchg.h 10b663aef1c2479 Catalin Marinas 2012-03-05 84 305d454aaa292be Will Deacon 2015-10-08 85 __XCHG_GEN() 305d454aaa292be Will Deacon 2015-10-08 86 __XCHG_GEN(_acq) 305d454aaa292be Will Deacon 2015-10-08 87 __XCHG_GEN(_rel) 305d454aaa292be Will Deacon 2015-10-08 @88 __XCHG_GEN(_mb) 305d454aaa292be Will Deacon 2015-10-08 89 :::::: The code at line 88 was first introduced by commit :::::: 305d454aaa292be3a09a9d674e6c35f5b4249a13 arm64: atomics: implement native {relaxed, acquire, release} atomics :::::: TO: Will Deacon <will.deacon(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1355/1355] kernel/ktask.c:80:5: sparse: sparse: symbol 'ktask_max_threads' was not declared. Should it be static?
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a8a9daf97ebc8e303e039402fe784e7bd4e5a9bb commit: c48676ef6b6f9cb8497d6264ae9ff71b87630337 [1355/1355] ktask: multithread CPU-intensive kernel work config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412280123.7Ss8XbOc-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412280123.7Ss8XbOc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412280123.7Ss8XbOc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/ktask.c:80:5: sparse: sparse: symbol 'ktask_max_threads' was not declared. Should it be static? vim +/ktask_max_threads +80 kernel/ktask.c 78 79 /* Maximum number of threads for a single task. */ > 80 int ktask_max_threads = KTASK_DEFAULT_MAX_THREADS; 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1667/1667] fs/proc/etmem_scan.c:737:16: sparse: sparse: cast removes address space '__rcu' of expression
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e53a23ef21aa9859c864e7c4bb6ecde5269f54b6 commit: 5d3b64fd78b80ec49285f2186e7b5ac5850f76e4 [1667/1667] etmem: add etmem scan feature config: arm64-randconfig-r111-20241227 (https://download.01.org/0day-ci/archive/20241228/202412280138.9neQNRRd-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412280138.9neQNRRd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412280138.9neQNRRd-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) fs/proc/etmem_scan.c:269:18: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __user *buf @@ got void *buf @@ fs/proc/etmem_scan.c:269:18: sparse: expected void [noderef] __user *buf fs/proc/etmem_scan.c:269:18: sparse: got void *buf >> fs/proc/etmem_scan.c:737:16: sparse: sparse: cast removes address space '__rcu' of expression fs/proc/etmem_scan.c:1361:40: sparse: sparse: incorrect type in assignment (incompatible argument 2 (different address spaces)) @@ expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) @@ got long ( * )( ... ) @@ fs/proc/etmem_scan.c:1361:40: sparse: expected long ( *extern [addressable] [assigned] [toplevel] read )( ... ) fs/proc/etmem_scan.c:1361:40: sparse: got long ( * )( ... ) fs/proc/etmem_scan.c:697:46: sparse: sparse: self-comparison always evaluates to false fs/proc/etmem_scan.c:720:46: sparse: sparse: self-comparison always evaluates to false vim +/__rcu +737 fs/proc/etmem_scan.c 724 725 static int arm_page_range(struct page_idle_ctrl *pic, 726 unsigned long addr, 727 unsigned long end) 728 { 729 pgd_t *pgd; 730 unsigned long next; 731 struct kvm *kvm = pic->kvm; 732 int err = 0; 733 734 WARN_ON(addr >= end); 735 736 read_lock(&pic->kvm->mmu_lock); > 737 pgd = (pgd_t *)kvm->arch.mmu.pgt->pgd + pgd_index(addr) * PTRS_PER_PTE; 738 read_unlock(&pic->kvm->mmu_lock); 739 740 local_irq_disable(); 741 do { 742 next = pgd_addr_end(addr, end); 743 if (!pgd_present(*pgd)) { 744 set_restart_gpa(next, "PGD_HOLE"); 745 continue; 746 } 747 748 err = arm_p4d_range(pic, pgd, addr, next); 749 if (err) 750 break; 751 } while (pgd++, addr = next, addr != end); 752 753 local_irq_enable(); 754 return err; 755 } 756 #endif 757 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1355/1355] drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1175:23: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a8a9daf97ebc8e303e039402fe784e7bd4e5a9bb commit: 4b565ca5a2cbbbb6345e8789da89c193b6b00e5a [1355/1355] drm/msm: Add A6XX device support config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241227/202412272355.CAWxIepM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412272355.CAWxIepM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412272355.CAWxIepM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:601:9: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:603:9: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:713:23: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1083:31: sparse: sparse: incorrect type in return expression (different address spaces) @@ expected void [noderef] __iomem * @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1083:31: sparse: expected void [noderef] __iomem * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1083:31: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1089:31: sparse: sparse: incorrect type in return expression (different address spaces) @@ expected void [noderef] __iomem * @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1089:31: sparse: expected void [noderef] __iomem * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1089:31: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1172:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[noderef] mmio @@ got void [noderef] __iomem * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1172:19: sparse: expected void *[noderef] mmio drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1172:19: sparse: got void [noderef] __iomem * >> drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1175:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[noderef] pdc_mmio @@ got void [noderef] __iomem * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1175:23: sparse: expected void *[noderef] pdc_mmio drivers/gpu/drm/msm/adreno/a6xx_gmu.c:1175:23: sparse: got void [noderef] __iomem * drivers/gpu/drm/msm/adreno/a6xx_gmu.c: note: in included file (through drivers/gpu/drm/msm/adreno/a6xx_gpu.h): drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:124:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:124:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:124:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:124:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:124:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:124:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:143:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:143:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:143:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:143:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:143:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:143:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:183:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:183:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:183:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:183:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:183:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.c:183:15: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: expected void const [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:36: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:84:26: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:34: sparse: sparse: dereference of noderef expression drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void [noderef] __iomem *addr @@ got void * @@ drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: expected void [noderef] __iomem *addr drivers/gpu/drm/msm/adreno/a6xx_gmu.h:89:44: sparse: got void * vim +1175 drivers/gpu/drm/msm/adreno/a6xx_gmu.c 1131 1132 int a6xx_gmu_probe(struct a6xx_gpu *a6xx_gpu, struct device_node *node) 1133 { 1134 struct a6xx_gmu *gmu = &a6xx_gpu->gmu; 1135 struct platform_device *pdev = of_find_device_by_node(node); 1136 int ret; 1137 1138 if (!pdev) 1139 return -ENODEV; 1140 1141 gmu->dev = &pdev->dev; 1142 1143 of_dma_configure(gmu->dev, node, false); 1144 1145 /* Fow now, don't do anything fancy until we get our feet under us */ 1146 gmu->idle_level = GMU_IDLE_STATE_ACTIVE; 1147 1148 pm_runtime_enable(gmu->dev); 1149 gmu->gx = devm_regulator_get(gmu->dev, "vdd"); 1150 1151 /* Get the list of clocks */ 1152 ret = a6xx_gmu_clocks_probe(gmu); 1153 if (ret) 1154 return ret; 1155 1156 /* Set up the IOMMU context bank */ 1157 ret = a6xx_gmu_memory_probe(gmu); 1158 if (ret) 1159 return ret; 1160 1161 /* Allocate memory for for the HFI queues */ 1162 gmu->hfi = a6xx_gmu_memory_alloc(gmu, SZ_16K); 1163 if (IS_ERR(gmu->hfi)) 1164 goto err; 1165 1166 /* Allocate memory for the GMU debug region */ 1167 gmu->debug = a6xx_gmu_memory_alloc(gmu, SZ_16K); 1168 if (IS_ERR(gmu->debug)) 1169 goto err; 1170 1171 /* Map the GMU registers */ 1172 gmu->mmio = a6xx_gmu_get_mmio(pdev, "gmu"); 1173 1174 /* Map the GPU power domain controller registers */ > 1175 gmu->pdc_mmio = a6xx_gmu_get_mmio(pdev, "gmu_pdc"); -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] mm/page_alloc.o: warning: objtool: __drain_all_pages()+0x235: unreachable instruction
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 053a6b6f8e4c86200cdb20bc80c063c3bb119859 commit: e037ee4a8deaff7c579618c0aba1f066d6d14b11 [2589/2589] mm, page_alloc: disable pcplists during memory offline config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241227/202412272117.9LTbAHTs-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241227/202412272117.9LTbAHTs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412272117.9LTbAHTs-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_alloc.o: warning: objtool: __drain_all_pages()+0x235: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] svcrdma: Address an integer overflow
by Liu Jian 27 Dec '24

27 Dec '24

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v6.6.64 commit 838dd342962cef4c320632a5af48d3c31f2f9877 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGF CVE: CVE-2024-53151 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 3c63d8946e578663b868cb9912dac616ea68bfd0 ] Dan Carpenter reports: > Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data > structure") from Jun 22, 2020 (linux-next), leads to the following > Smatch static checker warning: > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() > warn: potential user controlled sizeof overflow 'segcount * 4 * 4' > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) > 489 { > 490 u32 segcount; > 491 __be32 *p; > 492 > 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) > ^^^^^^^^ > > 494 return false; > 495 > 496 /* A bogus segcount causes this buffer overflow check to fail. */ > 497 p = xdr_inline_decode(&rctxt->rc_stream, > --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p)); > > > segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will > have an integer overflow and some those values will be accepted by > xdr_inline_decode(). Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Fixes: 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure") Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c index 3b05f90a3e50d..9cec7bcb8a976 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c @@ -478,7 +478,13 @@ static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) return false; - /* A bogus segcount causes this buffer overflow check to fail. */ + /* Before trusting the segcount value enough to use it in + * a computation, perform a simple range check. This is an + * arbitrary but sensible limit (ie, not architectural). + */ + if (unlikely(segcount > RPCSVC_MAXPAGES)) + return false; + p = xdr_inline_decode(&rctxt->rc_stream, segcount * rpcrdma_segment_maxsz * sizeof(*p)); return p != NULL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] mm: Backport mainline patch
by Liu Shixin 27 Dec '24

27 Dec '24

Kemeng Shi (1): mm/compaction: correctly return failure with bogus compound_order in strict mode Xueshi Hu (1): mm/hugetlb: fix nodes huge page allocation when there are surplus pages mm/compaction.c | 6 +++--- mm/hugetlb.c | 4 +++- 2 files changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] LeapIOraid: Fix hiding ugood disk problem
by haodongdong 27 Dec '24

27 Dec '24

LeapIO inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBE7VU ------------------------------------------ fix hiding ugood disk problem. fix "The address of local variable 'mpi_request' might be accessed at non-zero index in function leapioraid_base_send_ioc_init" Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapioraid/leapioraid_app.c | 1 - drivers/scsi/leapioraid/leapioraid_func.c | 15 ++++++++------- drivers/scsi/leapioraid/leapioraid_func.h | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/leapioraid/leapioraid_app.c b/drivers/scsi/leapioraid/leapioraid_app.c index 9d699721d1be7..6e7f6bf877782 100644 --- a/drivers/scsi/leapioraid/leapioraid_app.c +++ b/drivers/scsi/leapioraid/leapioraid_app.c @@ -53,7 +53,6 @@ #include <linux/poll.h> #include <linux/io.h> #include <linux/uaccess.h> -#include "leapioraid_func.h" #ifdef __KERNEL__ #include <linux/miscdevice.h> diff --git a/drivers/scsi/leapioraid/leapioraid_func.c b/drivers/scsi/leapioraid/leapioraid_func.c index 2d80a86da007d..97e0f893ab4c5 100644 --- a/drivers/scsi/leapioraid/leapioraid_func.c +++ b/drivers/scsi/leapioraid/leapioraid_func.c @@ -4746,14 +4746,11 @@ leapioraid_base_send_ioc_init(struct LEAPIORAID_ADAPTER *ioc) current_time = ktime_get_real(); mpi_request.TimeStamp = cpu_to_le64(ktime_to_ms(current_time)); if (ioc->logging_level & LEAPIORAID_DEBUG_INIT) { - __le32 *mfp; - int i; - mfp = (__le32 *) &mpi_request; pr_info("%s \toffset:data\n", ioc->name); - for (i = 0; i < sizeof(struct LeapioraidIOCInitReq_t) / 4; i++) - pr_info("%s \t[0x%02x]:%08x\n", - ioc->name, i * 4, le32_to_cpu(mfp[i])); + leapioraid_debug_dump_mf(&mpi_request, + sizeof(struct LeapioraidIOCInitReq_t) / 4); + } r = leapioraid_base_handshake_req_reply_wait(ioc, sizeof @@ -7022,7 +7019,11 @@ leapioraid_config_get_volume_handle(struct LEAPIORAID_ADAPTER *ioc, r = -1; ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & LEAPIORAID_IOCSTATUS_MASK; - if (ioc_status != LEAPIORAID_IOCSTATUS_SUCCESS) + if (ioc_status == LEAPIORAID_IOCSTATUS_CONFIG_INVALID_PAGE) { + *volume_handle = 0; + r = 0; + goto out; + } else if (ioc_status != LEAPIORAID_IOCSTATUS_SUCCESS) goto out; for (i = 0; i < config_page->NumElements; i++) { element_type = diff --git a/drivers/scsi/leapioraid/leapioraid_func.h b/drivers/scsi/leapioraid/leapioraid_func.h index 9cf8206ccb3ce..8ca8fc0a6f262 100644 --- a/drivers/scsi/leapioraid/leapioraid_func.h +++ b/drivers/scsi/leapioraid/leapioraid_func.h @@ -103,7 +103,7 @@ #define LEAPIORAID_KDUMP_SCSI_IO_DEPTH (64) #define LEAPIORAID_RAID_MAX_SECTORS (128) -#define LEAPIORAID_NAME_LENGTH (32) +#define LEAPIORAID_NAME_LENGTH (48) #define LEAPIORAID_DRIVER_NAME_LENGTH (24) #define LEAPIORAID_STRING_LENGTH (64) -- 2.25.1

2 1

[openeuler:OLK-5.10 2589/2589] block/blk-mq.o: warning: objtool: blk_mq_unquiesce_queue()+0xae: unreachable instruction
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 951151c7a27bc2a9436c2c49ae12510c82137ec1 commit: ed1ab377e8ea69c014a86efe7059231138233717 [2589/2589] blk-mq: support concurrent queue quiesce/unquiesce config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241227/202412271628.GxDQTcxv-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241227/202412271628.GxDQTcxv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271628.GxDQTcxv-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-mq.o: warning: objtool: blk_mq_unquiesce_queue()+0xae: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] mm: shmem: don't truncate page if memory failure happens
by Tong Tiangen 27 Dec '24

27 Dec '24

From: Yang Shi <shy828301(a)gmail.com> stable inclusion from stable-v5.15.80 commit 94fa250ea55cd4eea8049011ea4045343547ebd8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBE6C6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a7605426666196c5a460dd3de6f8dac1d3c21f00 upstream. The current behavior of memory failure is to truncate the page cache regardless of dirty or clean. If the page is dirty the later access will get the obsolete data from disk without any notification to the users. This may cause silent data loss. It is even worse for shmem since shmem is in-memory filesystem, truncating page cache means discarding data blocks. The later read would return all zero. The right approach is to keep the corrupted page in page cache, any later access would return error for syscalls or SIGBUS for page fault, until the file is truncated, hole punched or removed. The regular storage backed filesystems would be more complicated so this patch is focused on shmem. This also unblock the support for soft offlining shmem THP. [akpm(a)linux-foundation.org: coding style fixes] [arnd(a)arndb.de: fix uninitialized variable use in me_pagecache_clean()] Link: https://lkml.kernel.org/r/20211022064748.4173718-1-arnd@kernel.org [Fix invalid pointer dereference in shmem_read_mapping_page_gfp() with a slight different implementation from what Ajay Garg <ajaygargnsit(a)gmail.com> and Muchun Song <songmuchun(a)bytedance.com> proposed and reworked the error handling of shmem_write_begin() suggested by Linus] Link: https://lore.kernel.org/linux-mm/20211111084617.6746-1-ajaygargnsit@gmail.c… Link: https://lkml.kernel.org/r/20211020210755.23964-6-shy828301@gmail.com Link: https://lkml.kernel.org/r/20211116193247.21102-1-shy828301@gmail.com Signed-off-by: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Cc: Hugh Dickins <hughd(a)google.com> Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Naoya Horiguchi <naoya.horiguchi(a)nec.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Peter Xu <peterx(a)redhat.com> Cc: Ajay Garg <ajaygargnsit(a)gmail.com> Cc: Muchun Song <songmuchun(a)bytedance.com> Cc: Andy Lavr <andy.lavr(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Naoya Horiguchi <naoya.horiguchi(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/memory-failure.c mm/shmem.c mm/userfaultfd.c [context conflict and userfaultfd do not merge 153132571f02("userfaultfd/ shmem: support UFFDIO_CONTINUE for shmem")] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/memory-failure.c | 14 ++++++++++--- mm/shmem.c | 51 +++++++++++++++++++++++++++++++++++++++------ 2 files changed, 56 insertions(+), 9 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 8924d7d9bffa..22a63879a3d5 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -59,6 +59,7 @@ #include <linux/kfifo.h> #include <linux/ratelimit.h> #include <linux/page-isolation.h> +#include <linux/shmem_fs.h> #include "internal.h" #include "ras/ras_event.h" @@ -715,6 +716,7 @@ static int me_pagecache_clean(struct page_state *ps, struct page *p) { int ret; struct address_space *mapping; + bool extra_pins; delete_from_lru_cache(p); @@ -743,18 +745,24 @@ static int me_pagecache_clean(struct page_state *ps, struct page *p) goto out; } + /* + * The shmem page is kept in page cache instead of truncating + * so is expected to have an extra refcount after error-handling. + */ + extra_pins = shmem_mapping(mapping); + /* * Truncation is a bit tricky. Enable it per file system for now. * * Open: to take i_mutex or not for this? Right now we don't. */ ret = truncate_error_page(p, page_to_pfn(p), mapping); + if (has_extra_refcount(ps, p, extra_pins)) + ret = MF_FAILED; + out: unlock_page(p); - if (has_extra_refcount(ps, p, false)) - ret = MF_FAILED; - return ret; } diff --git a/mm/shmem.c b/mm/shmem.c index e300395fe308..e4649747a2e6 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -2565,6 +2565,7 @@ shmem_write_begin(struct file *file, struct address_space *mapping, struct inode *inode = mapping->host; struct shmem_inode_info *info = SHMEM_I(inode); pgoff_t index = pos >> PAGE_SHIFT; + int ret = 0; /* i_mutex is held by caller */ if (unlikely(info->seals & (F_SEAL_WRITE | F_SEAL_GROW))) { @@ -2574,7 +2575,19 @@ shmem_write_begin(struct file *file, struct address_space *mapping, return -EPERM; } - return shmem_getpage(inode, index, pagep, SGP_WRITE); + ret = shmem_getpage(inode, index, pagep, SGP_WRITE); + + if (ret) + return ret; + + if (PageHWPoison(*pagep)) { + unlock_page(*pagep); + put_page(*pagep); + *pagep = NULL; + return -EIO; + } + + return 0; } static int @@ -2661,6 +2674,12 @@ static ssize_t shmem_file_read_iter(struct kiocb *iocb, struct iov_iter *to) if (sgp == SGP_CACHE) set_page_dirty(page); unlock_page(page); + + if (PageHWPoison(page)) { + put_page(page); + error = -EIO; + break; + } } /* @@ -3263,7 +3282,8 @@ static const char *shmem_get_link(struct dentry *dentry, page = find_get_page(inode->i_mapping, 0); if (!page) return ERR_PTR(-ECHILD); - if (!PageUptodate(page)) { + if (PageHWPoison(page) || + !PageUptodate(page)) { put_page(page); return ERR_PTR(-ECHILD); } @@ -3271,6 +3291,13 @@ static const char *shmem_get_link(struct dentry *dentry, error = shmem_getpage(inode, 0, &page, SGP_READ); if (error) return ERR_PTR(error); + if (!page) + return ERR_PTR(-ECHILD); + if (PageHWPoison(page)) { + unlock_page(page); + put_page(page); + return ERR_PTR(-ECHILD); + } unlock_page(page); } set_delayed_call(done, shmem_put_link, page); @@ -3832,6 +3859,13 @@ static void shmem_destroy_inodecache(void) kmem_cache_destroy(shmem_inode_cachep); } +/* Keep the page in page cache instead of truncating it */ +static int shmem_error_remove_page(struct address_space *mapping, + struct page *page) +{ + return 0; +} + static const struct address_space_operations shmem_aops = { .writepage = shmem_writepage, .set_page_dirty = __set_page_dirty_no_writeback, @@ -3842,7 +3876,7 @@ static const struct address_space_operations shmem_aops = { #ifdef CONFIG_MIGRATION .migratepage = migrate_page, #endif - .error_remove_page = generic_error_remove_page, + .error_remove_page = shmem_error_remove_page, }; static const struct file_operations shmem_file_operations = { @@ -4270,9 +4304,14 @@ struct page *shmem_read_mapping_page_gfp(struct address_space *mapping, error = shmem_getpage_gfp(inode, index, &page, SGP_CACHE, gfp, NULL, NULL, NULL); if (error) - page = ERR_PTR(error); - else - unlock_page(page); + return ERR_PTR(error); + + unlock_page(page); + if (PageHWPoison(page)) { + put_page(page); + return ERR_PTR(-EIO); + } + return page; #else /* -- 2.25.1

2 1

[openeuler:OLK-5.10 2600/2600] kernel/sched/core.c:9822:6: sparse: sparse: symbol 'sched_setsteal' was not declared. Should it be static?
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 951151c7a27bc2a9436c2c49ae12510c82137ec1 commit: b7772972a0a76efac27078392f3f706914fe2af7 [2600/2600] sched/core: Add cpu.steal_task in cgroup v1 cpu subsystem config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241227/202412271614.c7NFJYsk-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412271614.c7NFJYsk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271614.c7NFJYsk-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) kernel/sched/core.c:635:39: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *task @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:635:39: sparse: expected struct task_struct *task kernel/sched/core.c:635:39: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:705:48: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:705:48: sparse: expected struct task_struct *p kernel/sched/core.c:705:48: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:959:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:959:38: sparse: expected struct task_struct *curr kernel/sched/core.c:959:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:1014:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/core.c:1014:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/core.c:1014:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/core.c:2067:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:2067:33: sparse: expected struct task_struct *p kernel/sched/core.c:2067:33: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:2067:68: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *tsk @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:2067:68: sparse: expected struct task_struct *tsk kernel/sched/core.c:2067:68: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:2809:17: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/core.c:2809:17: sparse: expected struct sched_domain *[assigned] sd kernel/sched/core.c:2809:17: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/core.c:3010:36: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct const *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:3010:36: sparse: expected struct task_struct const *p kernel/sched/core.c:3010:36: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:4447:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:4447:38: sparse: expected struct task_struct *curr kernel/sched/core.c:4447:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:5341:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct task_struct *prev @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:5341:14: sparse: expected struct task_struct *prev kernel/sched/core.c:5341:14: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:6010:17: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/core.c:6010:17: sparse: struct task_struct * kernel/sched/core.c:6010:17: sparse: struct task_struct [noderef] __rcu * kernel/sched/core.c:6208:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/core.c:6208:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/core.c:6208:22: sparse: struct task_struct * >> kernel/sched/core.c:9822:6: sparse: sparse: symbol 'sched_setsteal' was not declared. Should it be static? >> kernel/sched/core.c:9854:5: sparse: sparse: symbol 'tg_change_steal' was not declared. Should it be static? kernel/sched/core.c:10398:25: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/core.c:10398:25: sparse: expected struct task_struct *p kernel/sched/core.c:10398:25: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c: note: in included file: kernel/sched/sched.h:1411:17: sparse: sparse: self-comparison always evaluates to true kernel/sched/core.c:460:6: sparse: sparse: context imbalance in 'raw_spin_rq_lock_nested' - wrong count at exit kernel/sched/sched.h:1411:17: sparse: sparse: self-comparison always evaluates to true kernel/sched/core.c:493:23: sparse: sparse: context imbalance in 'raw_spin_rq_trylock' - wrong count at exit kernel/sched/core.c:509:6: sparse: sparse: context imbalance in 'raw_spin_rq_unlock' - unexpected unlock kernel/sched/core.c:547:36: sparse: sparse: context imbalance in '__task_rq_lock' - wrong count at exit kernel/sched/core.c:588:36: sparse: sparse: context imbalance in 'task_rq_lock' - wrong count at exit kernel/sched/core.c: note: in included file: kernel/sched/pelt.h:78:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct task_struct const *p @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/pelt.h:78:13: sparse: expected struct task_struct const *p kernel/sched/pelt.h:78:13: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/core.c:705:11: sparse: sparse: dereference of noderef expression kernel/sched/core.c:2058:33: sparse: sparse: dereference of noderef expression kernel/sched/core.c:2059:19: sparse: sparse: dereference of noderef expression kernel/sched/core.c:2060:37: sparse: sparse: dereference of noderef expression kernel/sched/core.c: note: in included file: kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/core.c:2033:38: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/core.c:2033:38: sparse: struct task_struct [noderef] __rcu * kernel/sched/core.c:2033:38: sparse: struct task_struct const * kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * kernel/sched/sched.h:2163:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2163:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2163:25: sparse: struct task_struct * kernel/sched/sched.h:2314:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2314:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2314:9: sparse: struct task_struct * vim +/sched_setsteal +9822 kernel/sched/core.c 9821 > 9822 void sched_setsteal(struct task_struct *tsk, s64 steal_task) 9823 { 9824 struct sched_entity *se = &tsk->se; 9825 int queued, running, queue_flags = 9826 DEQUEUE_SAVE | DEQUEUE_MOVE | DEQUEUE_NOCLOCK; 9827 struct rq_flags rf; 9828 struct rq *rq; 9829 9830 if (se->steal_task == steal_task) 9831 return; 9832 9833 rq = task_rq_lock(tsk, &rf); 9834 9835 running = task_current(rq, tsk); 9836 queued = task_on_rq_queued(tsk); 9837 9838 update_rq_clock(rq); 9839 if (queued) 9840 dequeue_task(rq, tsk, queue_flags); 9841 if (running) 9842 put_prev_task(rq, tsk); 9843 9844 se->steal_task = steal_task; 9845 9846 if (queued) 9847 enqueue_task(rq, tsk, queue_flags); 9848 if (running) 9849 set_next_task(rq, tsk); 9850 9851 task_rq_unlock(rq, tsk, &rf); 9852 } 9853 > 9854 int tg_change_steal(struct task_group *tg, void *data) 9855 { 9856 struct css_task_iter it; 9857 struct task_struct *tsk; 9858 s64 steal_task = *(s64 *)data; 9859 struct cgroup_subsys_state *css = &tg->css; 9860 9861 tg->steal_task = steal_task; 9862 9863 css_task_iter_start(css, 0, &it); 9864 while ((tsk = css_task_iter_next(&it))) 9865 sched_setsteal(tsk, steal_task); 9866 css_task_iter_end(&it); 9867 9868 return 0; 9869 } 9870 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2600/2600] mm/hugetlb.c:6315:13: sparse: sparse: symbol 'hugetlb_alloc_hugepage_nodemask' was not declared. Should it be static?
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 951151c7a27bc2a9436c2c49ae12510c82137ec1 commit: 8deff3a60ce1a9dffb552210f065fc9ed6a55f84 [2600/2600] mm/sharepool: Add mg_sp_alloc_nodemask config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241227/202412271456.Cm4dJ23V-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412271456.Cm4dJ23V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271456.Cm4dJ23V-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/hugetlb.c:6315:13: sparse: sparse: symbol 'hugetlb_alloc_hugepage_nodemask' was not declared. Should it be static? mm/hugetlb.c:446:12: sparse: sparse: context imbalance in 'allocate_file_region_entries' - wrong count at exit mm/hugetlb.c:519:13: sparse: sparse: context imbalance in 'region_add' - wrong count at exit mm/hugetlb.c:587:13: sparse: sparse: context imbalance in 'region_chg' - wrong count at exit mm/hugetlb.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/mm.h): include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false mm/hugetlb.c: note: in included file: include/linux/mm.h:1232:21: sparse: sparse: context imbalance in 'hugetlb_cow' - unexpected unlock mm/hugetlb.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/mm.h): include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false mm/hugetlb.c:5402:25: sparse: sparse: context imbalance in 'follow_hugetlb_page' - different lock contexts for basic block include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false include/linux/page-flags.h:263:46: sparse: sparse: self-comparison always evaluates to false vim +/hugetlb_alloc_hugepage_nodemask +6315 mm/hugetlb.c 6311 6312 /* 6313 * Allocate hugepage without reserve 6314 */ > 6315 struct page *hugetlb_alloc_hugepage_nodemask(int nid, int flag, nodemask_t *nodemask) 6316 { 6317 struct hstate *h = &default_hstate; 6318 gfp_t gfp_mask = htlb_alloc_mask(h); 6319 struct page *page = NULL; 6320 6321 if (nid == NUMA_NO_NODE) 6322 nid = numa_mem_id(); 6323 6324 if (nid < 0 || nid >= MAX_NUMNODES) 6325 return NULL; 6326 6327 if (flag & ~HUGETLB_ALLOC_MASK) 6328 return NULL; 6329 6330 if (enable_charge_mighp) 6331 gfp_mask |= __GFP_ACCOUNT; 6332 6333 if (flag & HUGETLB_ALLOC_NORECLAIM) 6334 gfp_mask &= ~__GFP_RECLAIM; 6335 6336 if (flag & HUGETLB_ALLOC_NORMAL) 6337 page = hugetlb_alloc_hugepage_normal(h, gfp_mask, nid); 6338 else if (flag & HUGETLB_ALLOC_BUDDY) 6339 page = alloc_migrate_huge_page(h, gfp_mask, nid, nodemask); 6340 else 6341 page = alloc_huge_page_nodemask(h, nid, nodemask, gfp_mask); 6342 6343 return page; 6344 } 6345 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2600/2600] arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static?
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 951151c7a27bc2a9436c2c49ae12510c82137ec1 commit: 66ae8ddda388386daea0623a65ea2ac85c24ca00 [2600/2600] ascend/arm64: Add ascend_enable_all kernel parameter config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241227/202412271224.evPeUzDD-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412271224.evPeUzDD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271224.evPeUzDD-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/arm64/mm/init.c:746:9: sparse: sparse: mixing declarations and code >> arch/arm64/mm/init.c:730:6: sparse: sparse: symbol 'ascend_enable_all_features' was not declared. Should it be static? vim +/ascend_enable_all_features +730 arch/arm64/mm/init.c 729 > 730 void ascend_enable_all_features(void) 731 { 732 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 733 enable_mmap_dvpp = 1; 734 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/btrfs/file-item.o: warning: objtool: btrfs_csum_one_bio()+0x5e6: unreachable instruction
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 951151c7a27bc2a9436c2c49ae12510c82137ec1 commit: 2f922250bd7fb299dbad240497e488b48ece9198 [2589/2589] btrfs: replace BUG_ON() in btrfs_csum_one_bio() with proper error handling config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241227/202412271119.g81AT8wi-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241227/202412271119.g81AT8wi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271119.g81AT8wi-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/btrfs/file-item.o: warning: objtool: btrfs_csum_one_bio()+0x5e6: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1667/1667] drivers/iommu/loongarch_iommu.c:101:1: sparse: sparse: symbol 'la_rlookup_iommu_list' was not declared. Should it be static?
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 16a0cbac6609f8ba10a91a9d52b15bf28243c3ee commit: 72fe4978ee346c10869113410da1b61710dd8d8f [1667/1667] LoongArch: add iommu support config: loongarch-randconfig-r121-20241227 (https://download.01.org/0day-ci/archive/20241227/202412271142.yFd4x2L2-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412271142.yFd4x2L2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271142.yFd4x2L2-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/iommu/loongarch_iommu.c: note: in included file: drivers/iommu/loongarch_iommu.h:137:3: sparse: sparse: symbol 'loongarch_iommu' was not declared. Should it be static? drivers/iommu/loongarch_iommu.h:152:3: sparse: sparse: symbol 'iommu_info' was not declared. Should it be static? drivers/iommu/loongarch_iommu.h:161:3: sparse: sparse: symbol 'dom_info' was not declared. Should it be static? drivers/iommu/loongarch_iommu.h:166:3: sparse: sparse: symbol 'dom_entry' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:101:1: sparse: sparse: symbol 'la_rlookup_iommu_list' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:108:9: sparse: sparse: symbol 'la_iommu_last_bdf' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:112:5: sparse: sparse: symbol 'loongarch_iommu_disable' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:130:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:130:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:130:15: sparse: got void * >> drivers/iommu/loongarch_iommu.c:132:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:132:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:132:9: sparse: got void * drivers/iommu/loongarch_iommu.c:135:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:135:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:135:15: sparse: got void * drivers/iommu/loongarch_iommu.c:137:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:137:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:137:9: sparse: got void * drivers/iommu/loongarch_iommu.c:150:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:150:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:150:15: sparse: got void * drivers/iommu/loongarch_iommu.c:152:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:152:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:152:9: sparse: got void * drivers/iommu/loongarch_iommu.c:155:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:155:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:155:15: sparse: got void * drivers/iommu/loongarch_iommu.c:157:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:157:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:157:9: sparse: got void * drivers/iommu/loongarch_iommu.c:160:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:160:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:160:15: sparse: got void * drivers/iommu/loongarch_iommu.c:162:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:162:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:162:9: sparse: got void * drivers/iommu/loongarch_iommu.c:190:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:190:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:190:15: sparse: got void * drivers/iommu/loongarch_iommu.c:193:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:193:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:193:9: sparse: got void * drivers/iommu/loongarch_iommu.c:196:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:196:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:196:15: sparse: got void * drivers/iommu/loongarch_iommu.c:199:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:199:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:199:9: sparse: got void * drivers/iommu/loongarch_iommu.c:206:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:206:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:206:15: sparse: got void * drivers/iommu/loongarch_iommu.c:306:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:306:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:306:17: sparse: got void * drivers/iommu/loongarch_iommu.c:310:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:310:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:310:17: sparse: got void * drivers/iommu/loongarch_iommu.c:312:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:312:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:312:23: sparse: got void * drivers/iommu/loongarch_iommu.c:314:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:314:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:314:17: sparse: got void * drivers/iommu/loongarch_iommu.c:322:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:322:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:322:23: sparse: got void * drivers/iommu/loongarch_iommu.c:325:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:325:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:325:17: sparse: got void * drivers/iommu/loongarch_iommu.c:327:23: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:327:23: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:327:23: sparse: got void * drivers/iommu/loongarch_iommu.c:329:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:329:17: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:329:17: sparse: got void * drivers/iommu/loongarch_iommu.c:349:15: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:349:15: sparse: expected void const volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:349:15: sparse: got void * drivers/iommu/loongarch_iommu.c:352:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:352:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:352:9: sparse: got void * >> drivers/iommu/loongarch_iommu.c:610:6: sparse: sparse: symbol 'domain_deattach_iommu' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:651:28: sparse: sparse: symbol 'lookup_rlooptable' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:662:24: sparse: sparse: symbol 'find_iommu_by_dev' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:721:21: sparse: sparse: symbol 'la_iommu_probe_device' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:752:19: sparse: sparse: symbol 'get_iommu_info_from_dom' was not declared. Should it be static? drivers/iommu/loongarch_iommu.c:794:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:794:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:794:9: sparse: got void * drivers/iommu/loongarch_iommu.c:795:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:795:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:795:9: sparse: got void * drivers/iommu/loongarch_iommu.c:796:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void * @@ drivers/iommu/loongarch_iommu.c:796:9: sparse: expected void volatile [noderef] __iomem *addr drivers/iommu/loongarch_iommu.c:796:9: sparse: got void * >> drivers/iommu/loongarch_iommu.c:1178:24: sparse: sparse: symbol 'la_iommu_ops' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:1197:24: sparse: sparse: symbol 'loongarch_get_iommu_by_devid' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:1215:6: sparse: sparse: symbol 'check_device_compat' was not declared. Should it be static? >> drivers/iommu/loongarch_iommu.c:1259:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *confbase @@ got void [noderef] __iomem * @@ drivers/iommu/loongarch_iommu.c:1259:25: sparse: expected void *confbase drivers/iommu/loongarch_iommu.c:1259:25: sparse: got void [noderef] __iomem * >> drivers/iommu/loongarch_iommu.c:1344:28: sparse: sparse: symbol 'create_rlookup_entry' was not declared. Should it be static? vim +/la_rlookup_iommu_list +101 drivers/iommu/loongarch_iommu.c 100 > 101 LIST_HEAD(la_rlookup_iommu_list); 102 LIST_HEAD(la_iommu_list); /* list of all loongarch 103 * IOMMUs in the system 104 */ 105 106 static u32 rlookup_table_size; /* size if the rlookup table */ 107 static int la_iommu_target_ivhd_type; > 108 u16 la_iommu_last_bdf; /* largest PCI device id 109 * we have to handle 110 */ 111 > 112 int loongarch_iommu_disable; 113 114 #define iommu_write_regl(iommu, off, val) \ 115 writel(val, iommu->confbase + off) 116 #define iommu_read_regl(iommu, off) readl(iommu->confbase + off) 117 118 static void switch_huge_to_page(unsigned long *ptep, unsigned long start); 119 120 static void iommu_translate_disable(struct loongarch_iommu *iommu) 121 { 122 u32 val; 123 124 if (iommu == NULL) { 125 pr_err("%s iommu is NULL", __func__); 126 return; 127 } 128 129 /* Disable */ > 130 val = iommu_read_regl(iommu, LA_IOMMU_PFM_CNT_EN); 131 val &= ~(1 << 31); > 132 iommu_write_regl(iommu, LA_IOMMU_PFM_CNT_EN, val); 133 134 /* Write cmd */ 135 val = iommu_read_regl(iommu, LA_IOMMU_CMD); 136 val &= 0xfffffffc; 137 iommu_write_regl(iommu, LA_IOMMU_CMD, val); 138 } 139 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] zram: fix NULL pointer in comp_algorithm_show()
by Liu Shixin 27 Dec '24

27 Dec '24

mainline inclusion from mainline-v6.13-rc1 commit f364cdeb38938f9d03061682b8ff3779dd1730e5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB35M9 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- LTP reported a NULL pointer dereference as followed: CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __pi_strcmp+0x24/0x140 lr : zcomp_available_show+0x60/0x100 [zram] sp : ffff800088b93b90 x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0 x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000 x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280 x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000 Call trace: __pi_strcmp+0x24/0x140 comp_algorithm_show+0x40/0x70 [zram] dev_attr_show+0x28/0x80 sysfs_kf_seq_show+0x90/0x140 kernfs_seq_show+0x34/0x48 seq_read_iter+0x1d4/0x4e8 kernfs_fop_read_iter+0x40/0x58 new_sync_read+0x9c/0x168 vfs_read+0x1a8/0x1f8 ksys_read+0x74/0x108 __arm64_sys_read+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0x138 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 The zram->comp_algs[ZRAM_PRIMARY_COMP] can be NULL in zram_add() if comp_algorithm_set() has not been called. User can access the zram device by sysfs after device_add_disk(), so there is a time window to trigger the NULL pointer dereference. Move it ahead device_add_disk() to make sure when user can access the zram device, it is ready. comp_algorithm_set() is protected by zram->init_lock in other places and no such problem. Link: https://lkml.kernel.org/r/20241108100147.3776123-1-liushixin2@huawei.com Fixes: 7ac07a26dea7 ("zram: preparation for multi-zcomp support") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Minchan Kim <minchan(a)kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: drivers/block/zram/zram_drv.c [ Context conflict. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/block/zram/zram_drv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 1ffc53ff5ecc..5e29a9cb923b 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -2218,6 +2218,7 @@ static int zram_add(void) zram->disk->fops = &zram_devops; zram->disk->private_data = zram; snprintf(zram->disk->disk_name, 16, "zram%d", device_id); + comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor); /* Actual capacity set using sysfs (/sys/block/zram<id>/disksize */ set_capacity(zram->disk, 0); @@ -2253,8 +2254,6 @@ static int zram_add(void) if (ret) goto out_cleanup_disk; - comp_algorithm_set(zram, ZRAM_PRIMARY_COMP, default_compressor); - zram_debugfs_register(zram); pr_info("Added device: %s\n", zram->disk->disk_name); return device_id; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] back some mainline patches for damon
by Ze Zuo 27 Dec '24

27 Dec '24

back some mainline patches for damon Alex Rusuf (1): mm/damon/core: fix return value from damos_wmark_metric_value Huan Yang (1): mm/damon/core: remove unnecessary si_meminfo invoke. mm/damon/core.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 00/11] back some mainline patches for damon
by Ze Zuo 27 Dec '24

27 Dec '24

back some mainline patches for damon Alex Rusuf (1): mm/damon/core: fix return value from damos_wmark_metric_value Huan Yang (1): mm/damon/core: remove unnecessary si_meminfo invoke. Ryan Roberts (1): mm/damon/ops-common: atomically test and clear young on ptes and pmds SeongJae Park (7): mm/damon/sysfs: check DAMOS regions update progress from before_terminate() mm/damon: implement a function for max nr_accesses safe calculation mm/damon/ops-common: avoid divide-by-zero during region hotness calculation mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation mm/damon/sysfs-schemes: handle tried regions sysfs directory allocation failure mm/damon/sysfs-schemes: handle tried region directory allocation failure mm/damon/core: merge regions aggressively when max_nr_regions is unmet Ze Zuo (1): mm/damon/core: fix the compilation warning in kdamond_merge_regions include/linux/damon.h | 7 +++++++ mm/damon/core.c | 36 ++++++++++++++++++++++++++---------- mm/damon/lru_sort.c | 4 +--- mm/damon/ops-common.c | 21 ++++++++------------- mm/damon/ops-common.h | 4 ++-- mm/damon/paddr.c | 4 ++-- mm/damon/sysfs-schemes.c | 5 +++++ mm/damon/sysfs.c | 7 +++++-- mm/damon/vaddr.c | 4 ++-- 9 files changed, 58 insertions(+), 34 deletions(-) -- 2.25.1

2 12

[openeuler:OLK-5.10 2600/2600] mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 27 Dec '24

27 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 951151c7a27bc2a9436c2c49ae12510c82137ec1 commit: 426b9efea56f9b065151d165caab2ebd32906505 [2600/2600] mm: Add sysctl to clear free list pages config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241227/202412271034.6jlVqgfq-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241227/202412271034.6jlVqgfq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412271034.6jlVqgfq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/clear_freelist_page.c:141:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/clear_freelist_page.c:141:50: sparse: expected void * mm/clear_freelist_page.c:141:50: sparse: got void [noderef] __user *buffer >> mm/clear_freelist_page.c:155:36: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/clear_freelist_page.c:155:36: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/clear_freelist_page.c:155:36: sparse: got int ( * )( ... ) vim +141 mm/clear_freelist_page.c 133 134 static int sysctl_clear_freelist_handler(struct ctl_table *table, int write, 135 void __user *buffer, size_t *lenp, loff_t *ppos) 136 { 137 int ret; 138 int val; 139 140 table->data = &val; > 141 ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); 142 143 if (!ret && write) 144 clear_freelist_pages(); 145 146 return ret; 147 } 148 149 static struct ctl_table clear_freelist_table[] = { 150 { 151 .procname = "clear_freelist_pages", 152 .data = NULL, 153 .maxlen = sizeof(int), 154 .mode = 0200, > 155 .proc_handler = &sysctl_clear_freelist_handler, 156 .extra1 = SYSCTL_ONE, 157 .extra2 = SYSCTL_ONE, 158 }, 159 { } 160 }; 161 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] exfat: fix out-of-bounds access of directory entries
by Long Li 27 Dec '24

27 Dec '24

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> mainline inclusion from mainline-v6.10-rc2 commit 184fa506e392eb78364d9283c961217ff2c0617b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGB CVE: CVE-2024-53147 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty. Cc: stable(a)vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Co-developed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Conflicts: fs/exfat/namei.c [Conflicts due to not merge 11a347fb6cef ("exfat: change to get file size from DataLength")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/exfat/namei.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c index 95c51b025b91..89b458b9482c 100644 --- a/fs/exfat/namei.c +++ b/fs/exfat/namei.c @@ -656,13 +656,19 @@ static int exfat_find(struct inode *dir, struct qstr *qname, info->type = exfat_get_entry_type(ep); info->attr = le16_to_cpu(ep->dentry.file.attr); info->size = le64_to_cpu(ep2->dentry.stream.valid_size); + + info->start_clu = le32_to_cpu(ep2->dentry.stream.start_clu); + if (!is_valid_cluster(sbi, info->start_clu) && info->size) { + exfat_warn(sb, "start_clu is invalid cluster(0x%x)", + info->start_clu); + info->size = 0; + } + if (info->size == 0) { info->flags = ALLOC_NO_FAT_CHAIN; info->start_clu = EXFAT_EOF_CLUSTER; } else { info->flags = ep2->dentry.stream.flags; - info->start_clu = - le32_to_cpu(ep2->dentry.stream.start_clu); } exfat_get_entry_time(sbi, &info->crtime, -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-53147
by Long Li 27 Dec '24

27 Dec '24

This patch set fix CVE-2024-53147. Yuezhang Mo (2): exfat: support handle zero-size directory exfat: fix out-of-bounds access of directory entries fs/exfat/namei.c | 39 ++++++++++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 9 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] exfat: fix out-of-bounds access of directory entries
by Long Li 27 Dec '24

27 Dec '24

From: Yuezhang Mo <Yuezhang.Mo(a)sony.com> mainline inclusion from mainline-v6.10-rc2 commit 184fa506e392eb78364d9283c961217ff2c0617b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGB CVE: CVE-2024-53147 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty. Cc: stable(a)vger.kernel.org Signed-off-by: Yuezhang Mo <Yuezhang.Mo(a)sony.com> Co-developed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Conflicts: fs/exfat/namei.c [Conflicts due to not merge 11a347fb6cef ("exfat: change to get file size from DataLength")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/exfat/namei.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c index d62d961e278d..5b78b9ba417e 100644 --- a/fs/exfat/namei.c +++ b/fs/exfat/namei.c @@ -655,13 +655,19 @@ static int exfat_find(struct inode *dir, struct qstr *qname, info->type = exfat_get_entry_type(ep); info->attr = le16_to_cpu(ep->dentry.file.attr); info->size = le64_to_cpu(ep2->dentry.stream.valid_size); + + info->start_clu = le32_to_cpu(ep2->dentry.stream.start_clu); + if (!is_valid_cluster(sbi, info->start_clu) && info->size) { + exfat_warn(sb, "start_clu is invalid cluster(0x%x)", + info->start_clu); + info->size = 0; + } + if (info->size == 0) { info->flags = ALLOC_NO_FAT_CHAIN; info->start_clu = EXFAT_EOF_CLUSTER; } else { info->flags = ep2->dentry.stream.flags; - info->start_clu = - le32_to_cpu(ep2->dentry.stream.start_clu); } exfat_get_entry_time(sbi, &info->crtime, -- 2.39.2

2 1

[PATCH] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 27 Dec '24

27 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 95b019f15224..6ccea6d1727f 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -21,6 +21,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -38,36 +42,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

1 0

[PATCH] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 27 Dec '24

27 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.64 commit 74cb86e1006c5437b1d90084d22018da30fddc77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77 commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index a676ad093d18..f0f1e445cc56 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -36,6 +36,12 @@ union uac23_clock_multiplier_desc { struct uac_clock_multiplier_descriptor v3; }; +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p, proto) \ + ((proto) == UAC_VERSION_3 ? \ + ((p)->v3.bLength >= sizeof((p)->v3)) : \ + ((p)->v2.bLength >= sizeof((p)->v2))) + #define GET_VAL(p, proto, field) \ ((proto) == UAC_VERSION_3 ? (p)->v3.field : (p)->v2.field) @@ -58,6 +64,8 @@ static bool validate_clock_source(void *p, int id, int proto) { union uac23_clock_source_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } @@ -65,13 +73,27 @@ static bool validate_clock_selector(void *p, int id, int proto) { union uac23_clock_selector_desc *cs = p; - return GET_VAL(cs, proto, bClockID) == id; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; + if (GET_VAL(cs, proto, bClockID) != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + if (proto == UAC_VERSION_3) + return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; + else + return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_multiplier(void *p, int id, int proto) { union uac23_clock_multiplier_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } -- 2.34.1

1 0

[PATCH] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 27 Dec '24

27 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 95b019f15224..6ccea6d1727f 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -21,6 +21,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -38,36 +42,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

1 0