- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53265
by Wang Zhaolong 20 Oct '25

20 Oct '25

George Kennedy (1): ubi: ensure that VID header offset + VID header size <= alloc, size Zhihao Cheng (1): ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size drivers/mtd/ubi/build.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.3

2 3

[PATCH OLK-6.6] sched/core: Add sched_change_qos_group() in sched_cgroup_fork()
by Wang Tao 20 Oct '25

20 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID23FN ------------------ We use sched_change_qos_group() to change task qos group for the new task in cgroup_post_fork() if we enable the qos sched feature. Since commit 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") has remove cpu_cgrp_subsys->fork(), if we enable qos sched feature, the function "sched_change_qos_group" is lost. cgroup_post_fork() ss->fork() := cpu_cgroup_fork() --> removed sched_change_group(..., TASK_SET_GROUP) #ifdef CONFIG_QOS_SCHED sched_change_qos_group(); --> lost #endif So this patch add the function "sched_change_qos_group" in sched_cgroup_fork(). Fixes: 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 47877f3b52f6..2740e9b918f5 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -120,6 +120,10 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +#ifdef CONFIG_QOS_SCHED +static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); +#endif + #ifdef CONFIG_SCHED_DEBUG /* * Debugging: various feature bits @@ -4863,6 +4867,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) { unsigned long flags; + struct task_group *tg_qos __maybe_unused = NULL; /* * Because we're not yet on the pid-hash, p->pi_lock isn't strictly @@ -4876,6 +4881,9 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) struct task_group, css); tg = autogroup_task_group(p, tg); p->sched_task_group = tg; +#ifdef CONFIG_QOS_SCHED + tg_qos = tg; +#endif } #endif rseq_migrate(p); @@ -4884,6 +4892,10 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) * so use __set_task_cpu(). */ __set_task_cpu(p, smp_processor_id()); +#ifdef CONFIG_QOS_SCHED + sched_change_qos_group(p, tg_qos); +#endif + if (p->sched_class->task_fork) p->sched_class->task_fork(p); raw_spin_unlock_irqrestore(&p->pi_lock, flags); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53271
by Wang Zhaolong 20 Oct '25

20 Oct '25

Li Zetao (2): ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() drivers/mtd/ubi/vmt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.3

2 3

[PATCH openEuler-1.0-LTS] cifs: Fix warning and UAF when destroy the MR list
by Wang Zhaolong 20 Oct '25

20 Oct '25

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> stable inclusion from stable-v4.19.276 commit 275a3d2b9408fc4895e342f772cab9a89960546e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQRV CVE: CVE-2023-53427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ] If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF. Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Acked-by: Paulo Alcantara (SUSE) <pc(a)cjr.nz> Reviewed-by: Tom Talpey <tom(a)talpey.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/cifs/smbdirect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c index 784628ec4bc4..71b9be2159ed 100644 --- a/fs/cifs/smbdirect.c +++ b/fs/cifs/smbdirect.c @@ -2376,10 +2376,11 @@ static int allocate_mr_list(struct smbd_connection *info) init_waitqueue_head(&info->wait_mr); spin_lock_init(&info->mr_list_lock); atomic_set(&info->mr_ready_count, 0); atomic_set(&info->mr_used_count, 0); init_waitqueue_head(&info->wait_for_mr_cleanup); + INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); /* Allocate more MRs (2x) than hardware responder_resources */ for (i = 0; i < info->responder_resources * 2; i++) { smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); if (!smbdirect_mr) goto out; @@ -2404,17 +2405,17 @@ static int allocate_mr_list(struct smbd_connection *info) smbdirect_mr->conn = info; list_add_tail(&smbdirect_mr->list, &info->mr_list); atomic_inc(&info->mr_ready_count); } - INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); return 0; out: kfree(smbdirect_mr); list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) { + list_del(&smbdirect_mr->list); ib_dereg_mr(smbdirect_mr->mr); kfree(smbdirect_mr->sgl); kfree(smbdirect_mr); } return -ENOMEM; -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
by Wang Zhaolong 20 Oct '25

20 Oct '25

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v4.19.276 commit f006f596fe851c3b6aae60b79f89f89f0e515d2f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0REZ CVE: CVE-2023-53481 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Following process will trigger an infinite loop in ubi_wl_put_peb(): ubifs_bgt ubi_bgt ubifs_leb_unmap ubi_leb_unmap ubi_eba_unmap_leb ubi_wl_put_peb wear_leveling_worker e1 = rb_entry(rb_first(&ubi->used) e2 = get_peb_for_wl(ubi) ubi_io_read_vid_hdr // return err (flash fault) out_error: ubi->move_from = ubi->move_to = NULL wl_entry_destroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!! $ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0 Fix it by: 1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'. 2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubi_wl_put_peb(). Fetch a reproducer in [Link]. Fixes: 43f9b25a9cdd7b1 ("UBI: bugfix: protect from volume removal") Fixes: ee59ba8b064f692 ("UBI: Fix stale pointers in ubi->lookuptbl") Link: https://bugzilla.kernel.org/show_bug.cgi?id=216111 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- drivers/mtd/ubi/wl.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index 6f2ac865ff05..c6b62bc16114 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -959,15 +959,15 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, ubi_err(ubi, "error %d while moving PEB %d (LEB %d:%d) to PEB %d", err, e1->pnum, vol_id, lnum, e2->pnum); spin_lock(&ubi->wl_lock); ubi->move_from = ubi->move_to = NULL; ubi->move_to_put = ubi->wl_scheduled = 0; + wl_entry_destroy(ubi, e1); + wl_entry_destroy(ubi, e2); spin_unlock(&ubi->wl_lock); ubi_free_vid_buf(vidb); - wl_entry_destroy(ubi, e1); - wl_entry_destroy(ubi, e2); out_ro: ubi_ro_mode(ubi); mutex_unlock(&ubi->move_mutex); up_read(&ubi->fm_eba_sem); @@ -1224,10 +1224,22 @@ int ubi_wl_put_peb(struct ubi_device *ubi, int vol_id, int lnum, down_read(&ubi->fm_protect); retry: spin_lock(&ubi->wl_lock); e = ubi->lookuptbl[pnum]; + if (!e) { + /* + * This wl entry has been removed for some errors by other + * process (eg. wear leveling worker), corresponding process + * (except __erase_worker, which cannot concurrent with + * ubi_wl_put_peb) will set ubi ro_mode at the same time, + * just ignore this wl entry. + */ + spin_unlock(&ubi->wl_lock); + up_read(&ubi->fm_protect); + return 0; + } if (e == ubi->move_from) { /* * User is putting the physical eraseblock which was selected to * be moved. It will be scheduled for erasure in the * wear-leveling worker. -- 2.34.3

2 1

[PATCH OLK-6.6] sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier
by Bowen You 20 Oct '25

20 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- The `CPU_PM_ENTER_FAILED` case was added to align with the handling in `sdei_pm_notifier`. This ensures proper masking/unmasking of events for the CPU when entering idle fails, maintaining consistency across CPU power management actions. Fixes: c8f96adca7fa ("arm64/watchdog: fix watchdog failure in low power scenarios") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index d8019becf10d..9d63bb063718 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -123,6 +123,7 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: + case CPU_PM_ENTER_FAILED: if (per_cpu(sdei_usr_en, smp_processor_id())) rv = sdei_api_event_enable(sdei_watchdog_event_num); break; -- 2.34.1

2 1

[PATCH OLK-6.6] sdei_watchdog: Add CPU_PM_ENTER_FAILED handling in sdei_watchdog_pm_notifier
by Bowen You 19 Oct '25

19 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- The `CPU_PM_ENTER_FAILED` case was added to align with the handling in `sdei_pm_notifier`. This ensures proper masking/unmasking of events for the CPU when entering idle fails, maintaining consistency across CPU power management actions. Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index d8019becf10d..9d63bb063718 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -123,6 +123,7 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: + case CPU_PM_ENTER_FAILED: if (per_cpu(sdei_usr_en, smp_processor_id())) rv = sdei_api_event_enable(sdei_watchdog_event_num); break; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1739/1739] kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 19 Oct '25

19 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e98deea13d81cacd6479edf0de6267118ae7c639 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1739/1739] dhugetlb: backport dynamic hugetlb feature config: arm64-randconfig-r121-20250728 (https://download.01.org/0day-ci/archive/20251019/202510190902.kewkpNkE-lkp@…) compiler: aarch64-linux-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251019/202510190902.kewkpNkE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510190902.kewkpNkE-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] <asn:4> * @@ kernel/cgroup/cgroup.c:5286:48: sparse: expected struct cgroup_subsys_state *css kernel/cgroup/cgroup.c:5286:48: sparse: got struct cgroup_subsys_state [noderef] <asn:4> * kernel/cgroup/cgroup.c:2685:20: sparse: sparse: context imbalance in 'cgroup_procs_write_start' - wrong count at exit kernel/cgroup/cgroup.c:2741:9: sparse: sparse: context imbalance in 'cgroup_procs_write_finish' - wrong count at exit kernel/cgroup/cgroup.c:2874:9: sparse: sparse: context imbalance in 'cgroup_lock_and_drain_offline' - wrong count at exit kernel/cgroup/cgroup.c:4528:16: sparse: sparse: context imbalance in 'cgroup_procs_write' - wrong count at exit kernel/cgroup/cgroup.c:4580:16: sparse: sparse: context imbalance in 'cgroup_threads_write' - wrong count at exit vim +5286 kernel/cgroup/cgroup.c 5234 5235 /** 5236 * cgroup_destroy_locked - the first stage of cgroup destruction 5237 * @cgrp: cgroup to be destroyed 5238 * 5239 * css's make use of percpu refcnts whose killing latency shouldn't be 5240 * exposed to userland and are RCU protected. Also, cgroup core needs to 5241 * guarantee that css_tryget_online() won't succeed by the time 5242 * ->css_offline() is invoked. To satisfy all the requirements, 5243 * destruction is implemented in the following two steps. 5244 * 5245 * s1. Verify @cgrp can be destroyed and mark it dying. Remove all 5246 * userland visible parts and start killing the percpu refcnts of 5247 * css's. Set up so that the next stage will be kicked off once all 5248 * the percpu refcnts are confirmed to be killed. 5249 * 5250 * s2. Invoke ->css_offline(), mark the cgroup dead and proceed with the 5251 * rest of destruction. Once all cgroup references are gone, the 5252 * cgroup is RCU-freed. 5253 * 5254 * This function implements s1. After this step, @cgrp is gone as far as 5255 * the userland is concerned and a new cgroup with the same name may be 5256 * created. As cgroup doesn't care about the names internally, this 5257 * doesn't cause any problem. 5258 */ 5259 static int cgroup_destroy_locked(struct cgroup *cgrp) 5260 __releases(&cgroup_mutex) __acquires(&cgroup_mutex) 5261 { 5262 struct cgroup *tcgrp, *parent = cgroup_parent(cgrp); 5263 struct cgroup_subsys_state *css; 5264 struct cgrp_cset_link *link; 5265 int ssid; 5266 5267 lockdep_assert_held(&cgroup_mutex); 5268 5269 /* 5270 * Only migration can raise populated from zero and we're already 5271 * holding cgroup_mutex. 5272 */ 5273 if (cgroup_is_populated(cgrp)) 5274 return -EBUSY; 5275 5276 /* 5277 * Make sure there's no live children. We can't test emptiness of 5278 * ->self.children as dead children linger on it while being 5279 * drained; otherwise, "rmdir parent/child parent" may fail. 5280 */ 5281 if (css_has_online_children(&cgrp->self)) 5282 return -EBUSY; 5283 5284 #ifdef CONFIG_MEMCG 5285 /* If we use dynamic hugetlb, make sure dhugtlb_pool is free */ > 5286 if (!dhugetlb_pool_is_free(cgrp->subsys[memory_cgrp_id])) 5287 return -EBUSY; 5288 #endif 5289 /* 5290 * Mark @cgrp and the associated csets dead. The former prevents 5291 * further task migration and child creation by disabling 5292 * cgroup_lock_live_group(). The latter makes the csets ignored by 5293 * the migration path. 5294 */ 5295 cgrp->self.flags &= ~CSS_ONLINE; 5296 5297 spin_lock_irq(&css_set_lock); 5298 list_for_each_entry(link, &cgrp->cset_links, cset_link) 5299 link->cset->dead = true; 5300 spin_unlock_irq(&css_set_lock); 5301 5302 /* initiate massacre of all css's */ 5303 for_each_css(css, ssid, cgrp) 5304 kill_css(css); 5305 5306 /* clear and remove @cgrp dir, @cgrp has an extra ref on its kn */ 5307 css_clear_dir(&cgrp->self); 5308 kernfs_remove(cgrp->kn); 5309 5310 if (parent && cgroup_is_threaded(cgrp)) 5311 parent->nr_threaded_children--; 5312 5313 spin_lock_irq(&css_set_lock); 5314 for (tcgrp = cgroup_parent(cgrp); tcgrp; tcgrp = cgroup_parent(tcgrp)) { 5315 tcgrp->nr_descendants--; 5316 tcgrp->nr_dying_descendants++; 5317 } 5318 spin_unlock_irq(&css_set_lock); 5319 5320 cgroup1_check_for_release(parent); 5321 5322 /* put the base reference */ 5323 percpu_ref_kill(&cgrp->self.refcnt); 5324 5325 return 0; 5326 }; 5327 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1739/1739] mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &=
by kernel test robot 19 Oct '25

19 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e98deea13d81cacd6479edf0de6267118ae7c639 commit: 875ffd41499ee5a3512da409cbd4c2ffd32b3cfa [1739/1739] mm: Do limit checking after memory allocation for memory reliable config: arm64-randconfig-r121-20250728 (https://download.01.org/0day-ci/archive/20251019/202510190803.oHSjvBlI-lkp@…) compiler: aarch64-linux-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251019/202510190803.oHSjvBlI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510190803.oHSjvBlI-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c:141:1: sparse: sparse: symbol '__pcpu_scope_pcpu_drain' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer >> mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &= mm/page_alloc.c:4648:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4648:27: sparse: right side has type int In file included from mm/page_alloc.c:70: mm/page_alloc.c: In function 'deferred_init_memmap': include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] .kc_thread_func = (ktask_thread_func)(thread_func), 15- ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 18- ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1730:3: note: in expansion of macro 'DEFINE_KTASK_CTL' DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, ^~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] .kc_thread_func = (ktask_thread_func)(thread_func), 24- ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 27- ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1746:3: note: in expansion of macro 'DEFINE_KTASK_CTL' DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, ^~~~~~~~~~~~~~~~ mm/page_alloc.c:3083: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' vim +4648 mm/page_alloc.c 4606 4607 /* 4608 * return true means memory allocation need retry and flag ___GFP_RELIABILITY 4609 * must be cleared. 4610 */ 4611 static inline bool check_after_alloc(gfp_t *gfp_mask, unsigned int order, 4612 int preferred_nid, nodemask_t *nodemask, 4613 struct page **_page) 4614 { 4615 if (!mem_reliable_is_enabled()) 4616 return false; 4617 4618 if (!(*gfp_mask & ___GFP_RELIABILITY)) 4619 return false; 4620 4621 if (!*_page) 4622 goto out_retry; 4623 4624 if (*gfp_mask & __GFP_NOFAIL) 4625 goto out; 4626 4627 /* check water mark, reserver mirrored mem for kernel */ 4628 if (!mem_reliable_watermark_ok(1 << order)) 4629 goto out_free_page; 4630 4631 /* percpu counter is not initialized, ignore limit check */ 4632 if (!mem_reliable_counter_initialized()) 4633 goto out; 4634 4635 /* spcial user task, systemd is limited by task_reliable_limit */ 4636 if (((current->flags & PF_RELIABLE) || is_global_init(current)) && 4637 !reliable_mem_limit_check(1 << order)) 4638 goto out_free_page; 4639 4640 goto out; 4641 4642 out_free_page: 4643 __free_pages(*_page, order); 4644 *_page = NULL; 4645 4646 out_retry: 4647 if (reliable_allow_fb_enabled() || is_global_init(current)) { > 4648 *gfp_mask &= ~___GFP_RELIABILITY; 4649 return true; 4650 } 4651 4652 if (*gfp_mask & (__GFP_NORETRY | __GFP_RETRY_MAYFAIL | __GFP_THISNODE)) 4653 goto out; 4654 4655 /* Coredumps can quickly deplete all memory reserves */ 4656 if (current->flags & PF_DUMPCORE) 4657 goto out; 4658 /* The OOM killer will not help higher order allocs */ 4659 if (order > PAGE_ALLOC_COSTLY_ORDER) 4660 goto out; 4661 4662 /* oom here */ 4663 mem_reliable_out_of_memory(*gfp_mask, order, preferred_nid, 4664 nodemask); 4665 out: 4666 return false; 4667 } 4668 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION e98deea13d81cacd6479edf0de6267118ae7c639
by kernel test robot 19 Oct '25

19 Oct '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: e98deea13d81cacd6479edf0de6267118ae7c639 !18333 scsi: qla2xxx: Wait for io return on terminate rport Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202510181808.04lWorDM-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202510182012.jZtZFjLW-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202510182359.uGdUMBQy-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202510190105.Ksp4uNzL-lkp@intel.com mm/mmu_gather.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): include/linux/uaccess.h:112:17: warning: 's32' may be used uninitialized [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-queue-in-(struct-list_head-)packet.prev | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test |-- arm64-allnoconfig | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-wait-in-((struct-list_head-)x)-.prev | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-waiter-in-(struct-list_head-)((char-)sem-).prev | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-mmap.c:warning:variable-new_start-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-clear_zone_contiguous | |-- mm-page_alloc.c:warning:no-previous-prototype-for-set_zone_contiguous | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-defconfig | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-waiter-in-(struct-list_head-)((char-)sem-).prev | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-clear_zone_contiguous | `-- mm-page_alloc.c:warning:no-previous-prototype-for-set_zone_contiguous |-- arm64-randconfig-001-20251018 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20251018 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-string.h:warning:__builtin_memcpy-specified-bound-between-and-exceeds-maximum-object-size | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-page_alloc.c:warning:no-previous-prototype-for-clear_zone_contiguous | |-- mm-page_alloc.c:warning:no-previous-prototype-for-set_zone_contiguous | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250930 | `-- include-linux-uaccess.h:warning:s32-may-be-used-uninitialized |-- arm64-randconfig-003-20251018 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-ticket-in-((struct-list_head-)((char-)space_info-))-.prev | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-page_alloc.c:warning:no-previous-prototype-for-clear_zone_contiguous | |-- mm-page_alloc.c:warning:no-previous-prototype-for-set_zone_contiguous | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-004-20251018 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-asm-generic-io.h:warning:reg-may-be-used-uninitialized-in-this-function | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized-in-this-function | |-- init-calibrate.c:warning:no-previous-prototype-for-calibration_delay_done | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-mmap.c:warning:variable-new_start-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-clear_zone_contiguous | |-- mm-page_alloc.c:warning:no-previous-prototype-for-set_zone_contiguous | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r121-20250729 | |-- mm-mem_reliable.c:sparse:sparse:invalid-assignment: | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_debug_handler-was-not-declared.-Should-it-be-static | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_limit_handler-was-not-declared.-Should-it-be-static | |-- mm-mem_reliable.c:sparse:sparse:symbol-reliable_pagecache_max_bytes_write-was-not-declared.-Should-it-be-static | `-- mm-page_alloc.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-gfp_t-usertype-flags-got-unsigned-int |-- x86_64-allnoconfig | |-- mm-mmap.c:warning:variable-new_start-set-but-not-used | |-- mm-mmu_gather.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-buildonly-randconfig-006-20251018 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used `-- x86_64-rhel-9.4-rust |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- mm-memcontrol.c:warning:bad-line:otherwise. |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type `-- mm-rmap.c:warning:variable-cstart-set-but-not-used elapsed time: 832m configs tested: 17 configs skipped: 122 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 defconfig gcc-15.1.0 arm64 randconfig-001-20251018 gcc-8.5.0 arm64 randconfig-002-20251018 gcc-15.1.0 arm64 randconfig-003-20251018 gcc-13.4.0 arm64 randconfig-004-20251018 gcc-11.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20251018 gcc-14 x86_64 buildonly-randconfig-002-20251018 gcc-14 x86_64 buildonly-randconfig-003-20251018 gcc-14 x86_64 buildonly-randconfig-004-20251018 gcc-14 x86_64 buildonly-randconfig-005-20251018 gcc-14 x86_64 buildonly-randconfig-006-20251018 clang-20 x86_64 defconfig gcc-14 x86_64 rhel-9.4-rust clang-22 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0