April 2025 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> mainline inclusion from mainline-v6.14-rc5 commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/ftrace.c [The conflicts were due to some minor issue] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 36de4ab34431..8199571d9ab3 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -544,6 +544,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -565,23 +566,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] ftrace: Avoid potential division by zero in function_stat_show()
by Pu Lehui 02 Apr '25

02 Apr '25

From: Nikolay Kuratov <kniv(a)yandex-team.ru> stable inclusion from stable-v6.6.81 commit f58a3f8e284d0bdf94164a8e61cd4e70d337a1a3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1a7eb89ca0b89dc1c326eeee2596f263291aca3 upstream. Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case. For now don't care about rec->counter * rec->counter overflow because rec->time * rec->time overflow will likely happen earlier. Cc: stable(a)vger.kernel.org Cc: Wen Yang <wenyang(a)linux.alibaba.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/20250206090156.1561783-1-kniv@yandex-team.ru Fixes: e31f7939c1c27 ("ftrace: Avoid potential division by zero in function profiler") Signed-off-by: Nikolay Kuratov <kniv(a)yandex-team.ru> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/ftrace.c | 27 ++++++++++++--------------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 1043936b352d..fe26b58e753f 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -538,6 +538,7 @@ static int function_stat_show(struct seq_file *m, void *v) static struct trace_seq s; unsigned long long avg; unsigned long long stddev; + unsigned long long stddev_denom; #endif mutex_lock(&ftrace_profile_lock); @@ -559,23 +560,19 @@ static int function_stat_show(struct seq_file *m, void *v) #ifdef CONFIG_FUNCTION_GRAPH_TRACER seq_puts(m, " "); - /* Sample standard deviation (s^2) */ - if (rec->counter <= 1) - stddev = 0; - else { - /* - * Apply Welford's method: - * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) - */ + /* + * Variance formula: + * s^2 = 1 / (n * (n-1)) * (n * \Sum (x_i)^2 - (\Sum x_i)^2) + * Maybe Welford's method is better here? + * Divide only by 1000 for ns^2 -> us^2 conversion. + * trace_print_graph_duration will divide by 1000 again. + */ + stddev = 0; + stddev_denom = rec->counter * (rec->counter - 1) * 1000; + if (stddev_denom) { stddev = rec->counter * rec->time_squared - rec->time * rec->time; - - /* - * Divide only 1000 for ns^2 -> us^2 conversion. - * trace_print_graph_duration will divide 1000 again. - */ - stddev = div64_ul(stddev, - rec->counter * (rec->counter - 1) * 1000); + stddev = div64_ul(stddev, stddev_denom); } trace_seq_init(&s); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Add tracepoints with null-able arguments
by Pu Lehui 02 Apr '25

02 Apr '25

From: Jiri Olsa <jolsa(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit c83e2d970bae8616b94c40caa43d85f2f2c7d81e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY5DV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Some of the tracepoints slipped when we did the first scan, adding them now. Fixes: 838a10bd2ebf ("bpf: Augment raw_tp arguments with PTR_MAYBE_NULL") Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Link: https://lore.kernel.org/r/20250210175913.2893549-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 99 insertions(+) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index bbc99401b4e7..39fc33e6368f 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -5997,6 +5997,8 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { /* rxrpc */ { "rxrpc_recvdata", 0x1 }, { "rxrpc_resend", 0x10 }, + { "rxrpc_tq", 0x10 }, + { "rxrpc_client", 0x1 }, /* sunrpc */ { "xs_stream_read_data", 0x1 }, /* ... from xprt_cong_event event class */ @@ -6017,6 +6019,103 @@ static const struct bpf_raw_tp_null_args raw_tp_null_args[] = { { "mr_integ_alloc", 0x2000 }, /* bpf_testmod */ { "bpf_testmod_test_read", 0x0 }, + /* amdgpu */ + { "amdgpu_vm_bo_map", 0x1 }, + { "amdgpu_vm_bo_unmap", 0x1 }, + /* netfs */ + { "netfs_folioq", 0x1 }, + /* xfs from xfs_defer_pending_class */ + { "xfs_defer_create_intent", 0x1 }, + { "xfs_defer_cancel_list", 0x1 }, + { "xfs_defer_pending_finish", 0x1 }, + { "xfs_defer_pending_abort", 0x1 }, + { "xfs_defer_relog_intent", 0x1 }, + { "xfs_defer_isolate_paused", 0x1 }, + { "xfs_defer_item_pause", 0x1 }, + { "xfs_defer_item_unpause", 0x1 }, + /* xfs from xfs_defer_pending_item_class */ + { "xfs_defer_add_item", 0x1 }, + { "xfs_defer_cancel_item", 0x1 }, + { "xfs_defer_finish_item", 0x1 }, + /* xfs from xfs_icwalk_class */ + { "xfs_ioc_free_eofblocks", 0x10 }, + { "xfs_blockgc_free_space", 0x10 }, + /* xfs from xfs_btree_cur_class */ + { "xfs_btree_updkeys", 0x100 }, + { "xfs_btree_overlapped_query_range", 0x100 }, + /* xfs from xfs_imap_class*/ + { "xfs_map_blocks_found", 0x10000 }, + { "xfs_map_blocks_alloc", 0x10000 }, + { "xfs_iomap_alloc", 0x1000 }, + { "xfs_iomap_found", 0x1000 }, + /* xfs from xfs_fs_class */ + { "xfs_inodegc_flush", 0x1 }, + { "xfs_inodegc_push", 0x1 }, + { "xfs_inodegc_start", 0x1 }, + { "xfs_inodegc_stop", 0x1 }, + { "xfs_inodegc_queue", 0x1 }, + { "xfs_inodegc_throttle", 0x1 }, + { "xfs_fs_sync_fs", 0x1 }, + { "xfs_blockgc_start", 0x1 }, + { "xfs_blockgc_stop", 0x1 }, + { "xfs_blockgc_worker", 0x1 }, + { "xfs_blockgc_flush_all", 0x1 }, + /* xfs_scrub */ + { "xchk_nlinks_live_update", 0x10 }, + /* xfs_scrub from xchk_metapath_class */ + { "xchk_metapath_lookup", 0x100 }, + /* nfsd */ + { "nfsd_dirent", 0x1 }, + { "nfsd_file_acquire", 0x1001 }, + { "nfsd_file_insert_err", 0x1 }, + { "nfsd_file_cons_err", 0x1 }, + /* nfs4 */ + { "nfs4_setup_sequence", 0x1 }, + { "pnfs_update_layout", 0x10000 }, + { "nfs4_inode_callback_event", 0x200 }, + { "nfs4_inode_stateid_callback_event", 0x200 }, + /* nfs from pnfs_layout_event */ + { "pnfs_mds_fallback_pg_init_read", 0x10000 }, + { "pnfs_mds_fallback_pg_init_write", 0x10000 }, + { "pnfs_mds_fallback_pg_get_mirror_count", 0x10000 }, + { "pnfs_mds_fallback_read_done", 0x10000 }, + { "pnfs_mds_fallback_write_done", 0x10000 }, + { "pnfs_mds_fallback_read_pagelist", 0x10000 }, + { "pnfs_mds_fallback_write_pagelist", 0x10000 }, + /* coda */ + { "coda_dec_pic_run", 0x10 }, + { "coda_dec_pic_done", 0x10 }, + /* cfg80211 */ + { "cfg80211_scan_done", 0x11 }, + { "rdev_set_coalesce", 0x10 }, + { "cfg80211_report_wowlan_wakeup", 0x100 }, + { "cfg80211_inform_bss_frame", 0x100 }, + { "cfg80211_michael_mic_failure", 0x10000 }, + /* cfg80211 from wiphy_work_event */ + { "wiphy_work_queue", 0x10 }, + { "wiphy_work_run", 0x10 }, + { "wiphy_work_cancel", 0x10 }, + { "wiphy_work_flush", 0x10 }, + /* hugetlbfs */ + { "hugetlbfs_alloc_inode", 0x10 }, + /* spufs */ + { "spufs_context", 0x10 }, + /* kvm_hv */ + { "kvm_page_fault_enter", 0x100 }, + /* dpu */ + { "dpu_crtc_setup_mixer", 0x100 }, + /* binder */ + { "binder_transaction", 0x100 }, + /* bcachefs */ + { "btree_path_free", 0x100 }, + /* hfi1_tx */ + { "hfi1_sdma_progress", 0x1000 }, + /* iptfs */ + { "iptfs_ingress_postq_event", 0x1000 }, + /* neigh */ + { "neigh_update", 0x10 }, + /* snd_firewire_lib */ + { "amdtp_packet", 0x100 }, }; bool btf_ctx_access(int off, int size, enum bpf_access_type type, -- 2.34.1

2 1

[openeuler:OLK-5.10 2830/2830] fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [2830/2830] tracing: Make tracepoint lockdep check actually test something config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021010.h7TdpCwx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021010.h7TdpCwx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/xfs/libxfs/xfs_da_btree.o: warning: objtool: xfs_da3_split()+0x787: unreachable instruction -- >> fs/xfs/libxfs/xfs_attr_leaf.o: warning: objtool: xfs_attr3_leaf_split()+0x2da: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dmaengine: Fix double increment of client_count in dma_chan_get()
by Xiaomeng Zhang 02 Apr '25

02 Apr '25

From: Koba Ko <koba.ko(a)canonical.com> stable inclusion from stable-v4.19.272 commit c6221afe573413fd2981e291f7df4a58283e0654 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBWVX7 CVE: CVE-2022-49753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ] The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning. [ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx] [ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]--- cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2 2 2 Fixes: d2f4f99db3e9 ("dmaengine: Rework dma_chan_get") Signed-off-by: Koba Ko <koba.ko(a)canonical.com> Reviewed-by: Jie Hai <haijie1(a)huawei.com> Test-by: Jie Hai <haijie1(a)huawei.com> Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Tested-by: Joel Savitz <jsavitz(a)redhat.com> Link: https://lore.kernel.org/r/20221201030050.978595-1-koba.ko@canonical.com Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c index f1a441ab395d..450b1c4b2129 100644 --- a/drivers/dma/dmaengine.c +++ b/drivers/dma/dmaengine.c @@ -223,7 +223,8 @@ static int dma_chan_get(struct dma_chan *chan) /* The channel is already in use, update client count */ if (chan->client_count) { __module_get(owner); - goto out; + chan->client_count++; + return 0; } if (!try_module_get(owner)) @@ -236,11 +237,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; + if (!dma_has_cap(DMA_PRIVATE, chan->device->cap_mask)) balance_ref_count(chan); -out: - chan->client_count++; return 0; err_out: -- 2.34.1

2 1

[PATCH v2 OLK-6.6 0/5] Support the FEAT_HDBSS introduced in Armv9.5
by Zhenyu Ye 02 Apr '25

02 Apr '25

From: eillon <yezhenyu2(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB103D CVE: NA This series of patches add support to the Hardware Dirty state tracking Structure(HDBSS) feature, which is introduced by the ARM architecture in the DDI0601(ID121123) version. The HDBSS feature is an extension to the architecture that enhances tracking translation table descriptors' dirty state, identified as FEAT_HDBSS. The goal of this feature is to reduce the cost of surveying for dirtied granules, with minimal effect on recording when a granule has been dirtied. The purpose of this feature is to make the execution overhead of live migration lower to both the guest and the host, compared to existing approaches (write-protect or search stage 2 tables). After these patches, users(such as qemu) can use the KVM_CAP_ARM_HW_DIRTY_STATE_TRACK ioctl to enable or disable the HDBSS feature before and after the live migration. See patches for details, Thanks. eillon (5): arm64/sysreg: add HDBSS related register information arm64/kvm: support set the DBM attr during memory abort arm64/kvm: using ioctl to enable/disable the HDBSS feature arm64/kvm: support to handle the HDBSSF event arm64/config: add config to control whether enable HDBSS feature arch/arm64/Kconfig | 12 ++++ arch/arm64/configs/openeuler_defconfig | 6 ++ arch/arm64/include/asm/cpufeature.h | 14 ++++ arch/arm64/include/asm/esr.h | 2 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_host.h | 8 +++ arch/arm64/include/asm/kvm_mmu.h | 14 ++++ arch/arm64/include/asm/kvm_pgtable.h | 1 + arch/arm64/include/asm/sysreg.h | 14 ++++ arch/arm64/kvm/arm.c | 88 ++++++++++++++++++++++++++ arch/arm64/kvm/handle_exit.c | 50 +++++++++++++++ arch/arm64/kvm/hyp/pgtable.c | 12 ++++ arch/arm64/kvm/hyp/vhe/switch.c | 3 + arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 4 ++ arch/arm64/kvm/mmu.c | 17 ++++- arch/arm64/kvm/reset.c | 9 +++ arch/arm64/tools/sysreg | 28 ++++++++ include/linux/kvm_host.h | 3 + include/uapi/linux/kvm.h | 2 + tools/include/uapi/linux/kvm.h | 2 + 20 files changed, 289 insertions(+), 1 deletion(-) -- 2.39.3

2 6

[openeuler:openEuler-1.0-LTS 1537/1537] fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 8b9ea9010139596e71aae4be5264c3dd901b13cb [1537/1537] pagecache: support percpu refcount to imporve performance config: x86_64-buildonly-randconfig-004-20250331 (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504021020.oxRcBdkg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504021020.oxRcBdkg-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/f2fs/gc.o: warning: objtool: f2fs_gc()+0x1f3f: unreachable instruction -- >> fs/f2fs/file.o: warning: objtool: truncate_partial_data_page()+0x213: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] fix CVE-2025-21712
by Zheng Qixing 02 Apr '25

02 Apr '25

Patch 1 is to fix the UAF issue in CVE-2025-21712. Patch 2 is to fix status collection for external bitmaps. Yu Kuai (1): md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime Zheng Qixing (1): md/md-bitmap: fix stats collection for external bitmaps drivers/md/md-bitmap.c | 3 ++- drivers/md/md.c | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[openeuler:OLK-5.10 2836/2836] arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos'
by kernel test robot 02 Apr '25

02 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 411f2e6e24ad11083d85f2ab7324b1f77ad0d371 commit: 0cd6fd52741f659d2a57501ca933ab33040cb911 [2836/2836] mm: Enhanced copy capabilities for Hygon processor config: x86_64-randconfig-101-20250402 (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250402/202504020854.WbZXJEHJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020854.WbZXJEHJ-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/fpu/core.c:444:14: warning: no previous prototype for 'get_fpustate_free_space' [-Wmissing-prototypes] 444 | unsigned int get_fpustate_free_space(struct fpu *fpu) | ^~~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/fpu/core.c:452:15: warning: no previous prototype for 'get_fpu_registers_pos' [-Wmissing-prototypes] 452 | unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) | ^~~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/fpu/core.c:533:6: warning: no previous prototype for 'save_fpregs_to_fpkernelstate' [-Wmissing-prototypes] 533 | void save_fpregs_to_fpkernelstate(struct fpu *kfpu) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/get_fpu_registers_pos +452 arch/x86/kernel/fpu/core.c 451 > 452 unsigned long get_fpu_registers_pos(struct fpu *fpu, unsigned int off) 453 { 454 unsigned long addr = 0; 455 456 if (fpu && (fpu_kernel_nonatomic_xstate_size > off)) { 457 addr = (unsigned long)&fpu->__fpstate.regs.__padding[0]; 458 addr += fpu_kernel_cfg.default_size + off; 459 } 460 return addr; 461 } 462 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1544/1544] mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared
by kernel test robot 02 Apr '25

02 Apr '25

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54ad6c4559d2bcbb5d7a03050b2f417a326a1ce2 commit: 0886320b818787f720824229f153f161c89faf70 [1544/1544] mm/sharepool: Charge Buddy hugepage to memcg config: arm64-randconfig-r131-20250401 (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250402/202504020332.I3Yx3nDu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504020332.I3Yx3nDu-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c:1086:29: sparse: sparse: incompatible types for operation (<=): mm/share_pool.c:1086:29: sparse: int *num mm/share_pool.c:1086:29: sparse: int mm/share_pool.c:3299:21: sparse: sparse: undefined identifier 'huge_ptep_get' mm/share_pool.c:3299:34: sparse: sparse: invalid initializer mm/share_pool.c:4577:32: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c:4585:30: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4606:23: sparse: sparse: undefined identifier 'huge_add_to_page_cache' mm/share_pool.c:4625:14: sparse: sparse: undefined identifier 'huge_pte_none' mm/share_pool.c:4631:9: sparse: sparse: undefined identifier 'set_huge_pte_at' mm/share_pool.c:4633:9: sparse: sparse: undefined identifier 'hugetlb_count_add' mm/share_pool.c:4797:24: sparse: sparse: undefined identifier 'hugetlb_alloc_hugepage' mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:1086:29: warning: ordered comparison of pointer with integer zero [-Wextra] 1086 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3299:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3299 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3299:21: error: invalid initializer mm/share_pool.c: In function 'sharepool_no_page': mm/share_pool.c:4577:32: error: implicit declaration of function 'hugetlb_alloc_hugepage'; did you mean 'vmalloc_hugepage'? [-Werror=implicit-function-declaration] 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~~~~ | vmalloc_hugepage >> mm/share_pool.c:4577:64: error: 'HUGETLB_ALLOC_BUDDY' undeclared (first use in this function) 4577 | page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:4577:64: note: each undeclared identifier is reported only once for each function it appears in mm/share_pool.c:4585:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4585 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock mm/share_pool.c:4606:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4606 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache mm/share_pool.c:4631:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4631 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at mm/share_pool.c:4633:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4633 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub mm/share_pool.c: In function 'sp_alloc_pages': mm/share_pool.c:4797:61: error: 'HUGETLB_ALLOC_NONE' undeclared (first use in this function); did you mean 'HUGETLB_ANON_FILE'? 4797 | page = hugetlb_alloc_hugepage(NUMA_NO_NODE, HUGETLB_ALLOC_NONE); | ^~~~~~~~~~~~~~~~~~ | HUGETLB_ANON_FILE cc1: some warnings being treated as errors vim +/HUGETLB_ALLOC_BUDDY +4577 mm/share_pool.c 4541 4542 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4543 struct vm_area_struct *vma, 4544 struct address_space *mapping, pgoff_t idx, 4545 unsigned long address, pte_t *ptep, unsigned int flags) 4546 { 4547 struct hstate *h = hstate_vma(vma); 4548 vm_fault_t ret = VM_FAULT_SIGBUS; 4549 unsigned long size; 4550 struct page *page; 4551 pte_t new_pte; 4552 spinlock_t *ptl; 4553 unsigned long haddr = address & huge_page_mask(h); 4554 bool new_page = false; 4555 int err; 4556 int node_id; 4557 struct sp_area *spa; 4558 bool charge_hpage = false; 4559 struct mem_cgroup *memcg; 4560 4561 spa = vma->vm_private_data; 4562 if (!spa) { 4563 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4564 return ret; 4565 } 4566 node_id = spa->node_id; 4567 4568 retry: 4569 page = find_lock_page(mapping, idx); 4570 if (!page) { 4571 size = i_size_read(mapping->host) >> huge_page_shift(h); 4572 if (idx >= size) 4573 goto out; 4574 4575 page = alloc_huge_page(vma, haddr, 0); 4576 if (IS_ERR(page)) { > 4577 page = hugetlb_alloc_hugepage(node_id, HUGETLB_ALLOC_BUDDY); 4578 if (!page) 4579 page = ERR_PTR(-ENOMEM); 4580 else if (!PageKmemcg(page)) 4581 charge_hpage = true; 4582 } 4583 if (IS_ERR(page)) { 4584 ptl = huge_pte_lock(h, mm, ptep); 4585 if (!huge_pte_none(huge_ptep_get(ptep))) { 4586 ret = 0; 4587 spin_unlock(ptl); 4588 goto out; 4589 } 4590 spin_unlock(ptl); 4591 ret = vmf_error(PTR_ERR(page)); 4592 goto out; 4593 } 4594 4595 if (charge_hpage && 4596 mem_cgroup_try_charge_delay(page, vma->vm_mm, GFP_KERNEL, &memcg, true)) { 4597 put_page(page); 4598 ret = vmf_error(-ENOMEM); 4599 goto out; 4600 } 4601 4602 __SetPageUptodate(page); 4603 new_page = true; 4604 4605 /* sharepool pages are all shared */ 4606 err = huge_add_to_page_cache(page, mapping, idx); 4607 if (err) { 4608 if (charge_hpage) { 4609 mem_cgroup_cancel_charge(page, memcg, true); 4610 charge_hpage = false; 4611 } 4612 put_page(page); 4613 if (err == -EEXIST) 4614 goto retry; 4615 goto out; 4616 } 4617 } 4618 4619 ptl = huge_pte_lock(h, mm, ptep); 4620 size = i_size_read(mapping->host) >> huge_page_shift(h); 4621 if (idx >= size) 4622 goto backout; 4623 4624 ret = 0; 4625 if (!huge_pte_none(huge_ptep_get(ptep))) 4626 goto backout; 4627 4628 page_dup_rmap(page, true); 4629 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4630 && (vma->vm_flags & VM_SHARED))); 4631 set_huge_pte_at(mm, haddr, ptep, new_pte); 4632 4633 hugetlb_count_add(pages_per_huge_page(h), mm); 4634 4635 if (charge_hpage) 4636 mem_cgroup_commit_charge(page, memcg, false, true); 4637 4638 spin_unlock(ptl); 4639 4640 if (new_page) 4641 SetPagePrivate(&page[1]); 4642 4643 unlock_page(page); 4644 out: 4645 return ret; 4646 4647 backout: 4648 spin_unlock(ptl); 4649 unlock_page(page); 4650 if (charge_hpage) 4651 mem_cgroup_cancel_charge(page, memcg, true); 4652 put_page(page); 4653 goto out; 4654 } 4655 EXPORT_SYMBOL(sharepool_no_page); 4656 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0