- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 01/14] khugepaged: inline hpage_collapse_alloc_folio()
by Nanyong Sun 29 Oct '24

29 Oct '24

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.10-rc1 commit 4746f5ce0fa52e21b5fe432970fe9516d1a45ebc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAXCD2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "khugepaged folio conversions". We've been kind of hacking piecemeal at converting khugepaged to use folios instead of compound pages, and so this patchset is a little larger than it should be as I undo some of our wrong moves in the past. In particular, collapse_file() now consistently uses 'new_folio' for the freshly allocated folio and 'folio' for the one that's currently in use. This patch (of 7): This function has one caller, and the combined function is simpler to read, reason about and modify. Link: https://lkml.kernel.org/r/20240403171838.1445826-1-willy@infradead.org Link: https://lkml.kernel.org/r/20240403171838.1445826-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Vishal Moola (Oracle) <vishal.moola(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/khugepaged.c [Context difference only] Signed-off-by: Nanyong Sun <sunnanyong(a)huawei.com> --- mm/khugepaged.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index c6379a2d55bc..4c1d69c04975 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -919,20 +919,6 @@ static int hpage_collapse_find_target_node(struct collapse_control *cc) } #endif -static bool hpage_collapse_alloc_folio(struct folio **folio, gfp_t gfp, int node, - nodemask_t *nmask) -{ - *folio = __folio_alloc(gfp, HPAGE_PMD_ORDER, node, nmask); - - if (unlikely(!*folio)) { - count_vm_event(THP_COLLAPSE_ALLOC_FAILED); - return false; - } - - count_vm_event(THP_COLLAPSE_ALLOC); - return true; -} - /* * If mmap_lock temporarily dropped, revalidate vma * before taking mmap_lock. @@ -1098,11 +1084,14 @@ static int alloc_charge_hpage(struct page **hpage, struct mm_struct *mm, if (cc->reliable) gfp |= GFP_RELIABLE; - if (!hpage_collapse_alloc_folio(&folio, gfp, node, &cc->alloc_nmask)) { + folio = __folio_alloc(gfp, HPAGE_PMD_ORDER, node, &cc->alloc_nmask); + if (!folio) { *hpage = NULL; + count_vm_event(THP_COLLAPSE_ALLOC_FAILED); return SCAN_ALLOC_HUGE_PAGE_FAIL; } + count_vm_event(THP_COLLAPSE_ALLOC); if (unlikely(mem_cgroup_charge(folio, mm, gfp))) { folio_put(folio); *hpage = NULL; -- 2.33.0

2 14

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 29 Oct '24

29 Oct '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.227 commit f4149eec960110ffd5bcb161075dd9f1d7773075 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9Wi CVE: CVE-2024-50049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 ] [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index ddbfce8390bb..3c350c76790a 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1251,7 +1251,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Check null pointer before dereferencing se
by Xiaomeng Zhang 29 Oct '24

29 Oct '24

From: Alex Hung <alex.hung(a)amd.com> stable inclusion from stable-v5.10.227 commit f4149eec960110ffd5bcb161075dd9f1d7773075 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZM9Wi CVE: CVE-2024-50049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ff599ef6970ee000fa5bc38d02fa5ff5f3fc7575 ] [WHAT & HOW] se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARD_NULL issue reported by Coverity. Acked-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Signed-off-by: Alex Hung <alex.hung(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c index adcf5ba83703..c172622365d3 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1252,7 +1252,7 @@ bool dc_validate_seamless_boot_timing(const struct dc *dc, if (crtc_timing->pix_clk_100hz != pix_clk_100hz) return false; - if (!se->funcs->dp_get_pixel_format) + if (!se || !se->funcs->dp_get_pixel_format) return false; if (!se->funcs->dp_get_pixel_format( -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 5435/23883] drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used
by kernel test robot 29 Oct '24

29 Oct '24

Hi Mao, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 27399521743732e65e7635fa93bd0cca53981c9e commit: 1c30433d9fa5c5b48039990ba214c0e8e199a22d [5435/23883] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() config: x86_64-randconfig-071-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290956.flJi6dhy-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290956.flJi6dhy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290956.flJi6dhy-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/tty/serial/sc16is7xx.c: In function 'sc16is7xx_init': >> drivers/tty/serial/sc16is7xx.c:1501:1: warning: label 'err_i2c' defined but not used [-Wunused-label] 1501 | err_i2c: | ^~~~~~~ drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_get()+0x104: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_direction_input()+0x13: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_set()+0x105: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_gpio_direction_output()+0x2ba: sibling call from callable instruction with modified stack frame drivers/tty/serial/sc16is7xx.o: warning: objtool: sc16is7xx_set_baud()+0xdf: sibling call from callable instruction with modified stack frame vim +/err_i2c +1501 drivers/tty/serial/sc16is7xx.c 1487 1488 #ifdef CONFIG_SERIAL_SC16IS7XX_SPI 1489 ret = spi_register_driver(&sc16is7xx_spi_uart_driver); 1490 if (ret < 0) { 1491 pr_err("failed to init sc16is7xx spi --> %d\n", ret); 1492 goto err_spi; 1493 } 1494 #endif 1495 return ret; 1496 1497 err_spi: 1498 #ifdef CONFIG_SERIAL_SC16IS7XX_I2C 1499 i2c_del_driver(&sc16is7xx_i2c_uart_driver); 1500 #endif > 1501 err_i2c: 1502 uart_unregister_driver(&sc16is7xx_uart); 1503 return ret; 1504 } 1505 module_init(sc16is7xx_init); 1506 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 8359/23883] fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized
by kernel test robot 29 Oct '24

29 Oct '24

Hi Andreas, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 27399521743732e65e7635fa93bd0cca53981c9e commit: 484798bc8218ce6a0f8269675897b870a12c49e2 [8359/23883] gfs2: gfs2_walk_metadata fix config: x86_64-buildonly-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241029/202410290938.ovb4D3kI-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241029/202410290938.ovb4D3kI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410290938.ovb4D3kI-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): fs/gfs2/bmap.c: In function 'gfs2_iomap_alloc': fs/gfs2/bmap.c:748:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 748 | if (n == 0) | ^ fs/gfs2/bmap.c:751:17: note: here 751 | case ALLOC_GROW_DEPTH: | ^~~~ fs/gfs2/bmap.c:759:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 759 | if (n == 0) | ^ fs/gfs2/bmap.c:762:17: note: here 762 | case ALLOC_DATA: | ^~~~ fs/gfs2/bmap.c: In function 'gfs2_iomap_get': >> fs/gfs2/bmap.c:960:31: warning: 'lblock' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:851:18: note: 'lblock' was declared here 851 | sector_t lblock; | ^~~~~~ fs/gfs2/bmap.c:960:31: warning: 'len' may be used uninitialized [-Wmaybe-uninitialized] 960 | ret = gfs2_hole_size(inode, lblock, len, mp, iomap); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:855:13: note: 'len' was declared here 855 | u64 len; | ^~~ fs/gfs2/bmap.c:959:32: warning: 'height' may be used uninitialized [-Wmaybe-uninitialized] 959 | if (pos < size && height == ip->i_height) | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ fs/gfs2/bmap.c:857:12: note: 'height' was declared here 857 | u8 height; | ^~~~~~ fs/gfs2/bmap.c:1290: warning: Function parameter or member 'inode' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'from' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1290: warning: Function parameter or member 'length' not described in 'gfs2_block_zero_range' fs/gfs2/bmap.c:1493: warning: Function parameter or member 'rd_gh' not described in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1493: warning: Excess function parameter 'rg_gh' description in 'sweep_bh_for_rgrps' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'sdp' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_list' not described in 'find_nonnull_ptr' fs/gfs2/bmap.c:1661: warning: Function parameter or member 'end_aligned' not described in 'find_nonnull_ptr' vim +/lblock +960 fs/gfs2/bmap.c 7ee66c03e40a57 Christoph Hellwig 2018-06-01 831 3974320ca6aa68 Bob Peterson 2017-02-16 832 /** 628e366df11c0a Andreas Gruenbacher 2018-06-04 833 * gfs2_iomap_get - Map blocks from an inode to disk blocks 3974320ca6aa68 Bob Peterson 2017-02-16 834 * @inode: The inode 3974320ca6aa68 Bob Peterson 2017-02-16 835 * @pos: Starting position in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 836 * @length: Length to map, in bytes 3974320ca6aa68 Bob Peterson 2017-02-16 837 * @flags: iomap flags 3974320ca6aa68 Bob Peterson 2017-02-16 838 * @iomap: The iomap structure 628e366df11c0a Andreas Gruenbacher 2018-06-04 839 * @mp: The metapath 3974320ca6aa68 Bob Peterson 2017-02-16 840 * 3974320ca6aa68 Bob Peterson 2017-02-16 841 * Returns: errno 3974320ca6aa68 Bob Peterson 2017-02-16 842 */ 628e366df11c0a Andreas Gruenbacher 2018-06-04 843 static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length, 628e366df11c0a Andreas Gruenbacher 2018-06-04 844 unsigned flags, struct iomap *iomap, 628e366df11c0a Andreas Gruenbacher 2018-06-04 845 struct metapath *mp) b3b94faa5fe596 David Teigland 2006-01-16 846 { feaa7bba026c18 Steven Whitehouse 2006-06-14 847 struct gfs2_inode *ip = GFS2_I(inode); feaa7bba026c18 Steven Whitehouse 2006-06-14 848 struct gfs2_sbd *sdp = GFS2_SB(inode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 849 loff_t size = i_size_read(inode); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 850 __be64 *ptr; 3974320ca6aa68 Bob Peterson 2017-02-16 851 sector_t lblock; 628e366df11c0a Andreas Gruenbacher 2018-06-04 852 sector_t lblock_stop; 628e366df11c0a Andreas Gruenbacher 2018-06-04 853 int ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 854 int eob; 628e366df11c0a Andreas Gruenbacher 2018-06-04 855 u64 len; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 856 struct buffer_head *dibh = NULL, *bh; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 857 u8 height; 7276b3b0c77101 Steven Whitehouse 2006-09-21 858 628e366df11c0a Andreas Gruenbacher 2018-06-04 859 if (!length) 628e366df11c0a Andreas Gruenbacher 2018-06-04 860 return -EINVAL; b3b94faa5fe596 David Teigland 2006-01-16 861 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 862 down_read(&ip->i_rw_mutex); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 863 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 864 ret = gfs2_meta_inode_buffer(ip, &dibh); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 865 if (ret) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 866 goto unlock; 38084377af4fc8 Andreas Gruenbacher 2018-11-11 867 mp->mp_bh[0] = dibh; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 868 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 869 if (gfs2_is_stuffed(ip)) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 870 if (flags & IOMAP_WRITE) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 871 loff_t max_size = gfs2_max_stuffed_size(ip); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 872 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 873 if (pos + length > max_size) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 874 goto unstuff; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 875 iomap->length = max_size; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 876 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 877 if (pos >= size) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 878 if (flags & IOMAP_REPORT) { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 879 ret = -ENOENT; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 880 goto unlock; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 881 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 882 /* report a hole */ d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 883 iomap->offset = pos; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 884 iomap->length = length; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 885 goto do_alloc; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 886 } 3974320ca6aa68 Bob Peterson 2017-02-16 887 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 888 iomap->length = size; 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 889 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 890 iomap->addr = (ip->i_no_addr << inode->i_blkbits) + d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 891 sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 892 iomap->type = IOMAP_INLINE; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 893 iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode); d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 894 goto out; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 895 } d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 896 d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 897 unstuff: 3974320ca6aa68 Bob Peterson 2017-02-16 898 lblock = pos >> inode->i_blkbits; 3974320ca6aa68 Bob Peterson 2017-02-16 899 iomap->offset = lblock << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 900 lblock_stop = (pos + length - 1) >> inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 901 len = lblock_stop - lblock + 1; d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 902 iomap->length = len << inode->i_blkbits; 20cdc1931ee8e0 Andreas Gruenbacher 2017-09-22 903 9b8c81d1de4994 Steven Whitehouse 2008-02-22 904 height = ip->i_height; 9a38662ba4e268 Andreas Gruenbacher 2018-04-16 905 while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height]) ecc30c79157103 Steven Whitehouse 2008-01-28 906 height++; 628e366df11c0a Andreas Gruenbacher 2018-06-04 907 find_metapath(sdp, lblock, mp, height); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 908 if (height > ip->i_height || gfs2_is_stuffed(ip)) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 909 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 910 628e366df11c0a Andreas Gruenbacher 2018-06-04 911 ret = lookup_metapath(ip, mp); e8b43fe0c1e035 Andreas Gruenbacher 2017-12-08 912 if (ret) 628e366df11c0a Andreas Gruenbacher 2018-06-04 913 goto unlock; 3974320ca6aa68 Bob Peterson 2017-02-16 914 628e366df11c0a Andreas Gruenbacher 2018-06-04 915 if (mp->mp_aheight != ip->i_height) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 916 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 917 628e366df11c0a Andreas Gruenbacher 2018-06-04 918 ptr = metapointer(ip->i_height - 1, mp); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 919 if (*ptr == 0) 9b8c81d1de4994 Steven Whitehouse 2008-02-22 920 goto do_alloc; 3974320ca6aa68 Bob Peterson 2017-02-16 921 628e366df11c0a Andreas Gruenbacher 2018-06-04 922 bh = mp->mp_bh[ip->i_height - 1]; bcfe94139a45fa Andreas Gruenbacher 2018-05-11 923 len = gfs2_extent_length(bh, ptr, len, &eob); 3974320ca6aa68 Bob Peterson 2017-02-16 924 628e366df11c0a Andreas Gruenbacher 2018-06-04 925 iomap->addr = be64_to_cpu(*ptr) << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 926 iomap->length = len << inode->i_blkbits; 628e366df11c0a Andreas Gruenbacher 2018-06-04 927 iomap->type = IOMAP_MAPPED; 0ed91eca1130e6 Andreas Gruenbacher 2018-07-25 928 iomap->flags |= IOMAP_F_MERGED; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 929 if (eob) 7ee66c03e40a57 Christoph Hellwig 2018-06-01 930 iomap->flags |= IOMAP_F_GFS2_BOUNDARY; 3974320ca6aa68 Bob Peterson 2017-02-16 931 3974320ca6aa68 Bob Peterson 2017-02-16 932 out: 628e366df11c0a Andreas Gruenbacher 2018-06-04 933 iomap->bdev = inode->i_sb->s_bdev; 628e366df11c0a Andreas Gruenbacher 2018-06-04 934 unlock: 628e366df11c0a Andreas Gruenbacher 2018-06-04 935 up_read(&ip->i_rw_mutex); 9b8c81d1de4994 Steven Whitehouse 2008-02-22 936 return ret; 9b8c81d1de4994 Steven Whitehouse 2008-02-22 937 9b8c81d1de4994 Steven Whitehouse 2008-02-22 938 do_alloc: 628e366df11c0a Andreas Gruenbacher 2018-06-04 939 iomap->addr = IOMAP_NULL_ADDR; 628e366df11c0a Andreas Gruenbacher 2018-06-04 940 iomap->type = IOMAP_HOLE; 628e366df11c0a Andreas Gruenbacher 2018-06-04 941 if (flags & IOMAP_REPORT) { 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 942 if (pos >= size) 3974320ca6aa68 Bob Peterson 2017-02-16 943 ret = -ENOENT; 628e366df11c0a Andreas Gruenbacher 2018-06-04 944 else if (height == ip->i_height) 628e366df11c0a Andreas Gruenbacher 2018-06-04 945 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 946 else 49edd5bf429c40 Andreas Gruenbacher 2018-02-06 947 iomap->length = size - pos; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 948 } else if (flags & IOMAP_WRITE) { 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 949 u64 alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 950 967bcc91b04493 Andreas Gruenbacher 2018-06-19 951 if (flags & IOMAP_DIRECT) 967bcc91b04493 Andreas Gruenbacher 2018-06-19 952 goto out; /* (see gfs2_file_direct_write) */ 967bcc91b04493 Andreas Gruenbacher 2018-06-19 953 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 954 len = gfs2_alloc_size(inode, mp, len); 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 955 alloc_size = len << inode->i_blkbits; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 956 if (alloc_size < iomap->length) 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 957 iomap->length = alloc_size; 64bc06bb32ee9c Andreas Gruenbacher 2018-06-24 958 } else { d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 959 if (pos < size && height == ip->i_height) d505a96a3b16f4 Andreas Gruenbacher 2018-06-24 @960 ret = gfs2_hole_size(inode, lblock, len, mp, iomap); 3974320ca6aa68 Bob Peterson 2017-02-16 961 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 962 goto out; 628e366df11c0a Andreas Gruenbacher 2018-06-04 963 } 628e366df11c0a Andreas Gruenbacher 2018-06-04 964 :::::: The code at line 960 was first introduced by commit :::::: d505a96a3b16f46455035dc0296bc2da6014e163 gfs2: Further iomap cleanups :::::: TO: Andreas Gruenbacher <agruenba(a)redhat.com> :::::: CC: Andreas Gruenbacher <agruenba(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 8dcdd5a432518f8f8deb6ab608551ecda71bda40
by kernel test robot 29 Oct '24

29 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8dcdd5a432518f8f8deb6ab608551ecda71bda40 !12459 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202410282334.pOpu4nRk-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290217.j4yRbZGJ-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290835.BHKldai7-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202410290853.IWsztKim-lkp@intel.com arch/arm64/include/asm/kgdb.h:21:25: error: value '1025' out of range for constraint 'I' drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=] kernel/trace/trace_osnoise.c:933: undefined reference to `latency_fsnotify' mm/memcontrol.c:5879:40: error: implicit declaration of function 'ksm_process_profit' [-Werror=implicit-function-declaration] mm/pin_mem.c:859:63: error: lvalue required as unary '&' operand Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20241029 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-002-20241029 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20241029 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- drivers-ptp-ptp_hisi.c:warning:hisi_ptp_acpi_match-defined-but-not-used | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_create_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_create_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_remove_dev_attr_files | |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:warning:no-previous-prototype-for-ubcore_remove_port_attr_files | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_destroy_upi_list | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_dispatch_event | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_net_exit | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:strnlen-specified-bound-exceeds-source-size | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_add_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_check_port_state | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_del_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_idx | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_add_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_del_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_put_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_set_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_alloc | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_free | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_init | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_uninit | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_unset_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:strnlen-specified-bound-exceeds-source-size | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-ubcore_modify_tp_state | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:warning:strncpy-output-truncated-before-terminating-nul-copying-bytes-from-a-string-of-the-same-length | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-ubcore_hash_table_rmv_vtpn | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | |-- fs-proc-base.c:warning:no-previous-prototype-for-pbha_bit0_hide_file | |-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-004-20241029 | |-- arch-arm64-include-asm-kgdb.h:error:value-out-of-range-for-constraint-I | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED |-- x86_64-allyesconfig | |-- drivers-net-ipvlan-ipvlan_main.c:warning:variable-old_prog-set-but-not-used | |-- kernel-sched-core.c:warning:no-previous-prototype-for-function-sched_setsteal | `-- kernel-sched-core.c:warning:no-previous-prototype-for-function-tg_change_steal |-- x86_64-buildonly-randconfig-002-20241029 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn | `-- drivers-net-can-spi-mcp251xfd-mcp251xfd-core.c:warning:no-previous-prototype-for-mcp251xfd_tx_obj_write_sync |-- x86_64-buildonly-randconfig-003-20241029 | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit | `-- mm-memcontrol.c:error:implicit-declaration-of-function-ksm_process_profit |-- x86_64-buildonly-randconfig-004-20241029 | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_OPCODE-undeclared-(first-use-in-this-function) | |-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) | `-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn |-- x86_64-buildonly-randconfig-005-20241029 | |-- arch-x86-kernel-paravirt.c:error:implicit-declaration-of-function-__text_gen_insn-Werror-Wimplicit-function-declaration | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_SIZE | `-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() |-- x86_64-randconfig-011-20241029 | `-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_irq_ack-falls-through-to-next-function-evergreen_resume() |-- x86_64-randconfig-013-20241029 | `-- drivers-gpu-drm-radeon-evergreen.o:warning:objtool:evergreen_irq_ack-falls-through-to-next-function-evergreen_resume() |-- x86_64-randconfig-014-20241028 | `-- arch-x86-kvm-mmu-mmu.o:warning:objtool:mmu_set_spte:unreachable-instruction |-- x86_64-randconfig-072-20241028 | `-- kernel-trace-trace_osnoise.c:undefined-reference-to-latency_fsnotify |-- x86_64-randconfig-072-20241029 | `-- fs-ntfs3-frecord.o:warning:objtool:ni_read_frame-falls-through-to-next-function-ni_readpage_cmprcold() |-- x86_64-randconfig-075-20241029 | `-- fs-ntfs3-frecord.o:warning:objtool:ni_read_frame-falls-through-to-next-function-ni_readpage_cmprcold() `-- x86_64-randconfig-161-20241029 |-- fs-ntfs3-attrib.c-attr_allocate_frame()-error:we-previously-assumed-attr_b-could-be-null-(see-line-) |-- fs-ntfs3-fslog.c-last_log_lsn()-warn:possible-memory-leak-of-page_bufs `-- mm-memcontrol.c-uncharge_page()-error:uninitialized-symbol-objcg-. elapsed time: 749m configs tested: 35 configs skipped: 128 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241029 clang-17 arm64 randconfig-002-20241029 clang-20 arm64 randconfig-003-20241029 gcc-14.1.0 arm64 randconfig-004-20241029 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241029 gcc-12 x86_64 buildonly-randconfig-002-20241029 gcc-12 x86_64 buildonly-randconfig-003-20241029 gcc-12 x86_64 buildonly-randconfig-004-20241029 gcc-12 x86_64 buildonly-randconfig-005-20241029 clang-19 x86_64 buildonly-randconfig-006-20241029 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241029 gcc-12 x86_64 randconfig-002-20241029 clang-19 x86_64 randconfig-003-20241029 gcc-12 x86_64 randconfig-004-20241029 clang-19 x86_64 randconfig-005-20241029 gcc-12 x86_64 randconfig-006-20241029 gcc-12 x86_64 randconfig-011-20241029 clang-19 x86_64 randconfig-012-20241029 clang-19 x86_64 randconfig-013-20241029 clang-19 x86_64 randconfig-014-20241029 clang-19 x86_64 randconfig-015-20241029 gcc-12 x86_64 randconfig-016-20241029 gcc-12 x86_64 randconfig-071-20241029 gcc-12 x86_64 randconfig-072-20241029 gcc-12 x86_64 randconfig-073-20241029 gcc-12 x86_64 randconfig-074-20241029 clang-19 x86_64 randconfig-075-20241029 gcc-12 x86_64 randconfig-076-20241029 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] blk_iocost: fix more out of bound shifts
by Zheng Qixing 29 Oct '24

29 Oct '24

From: Konstantin Ovsepian <ovs(a)ovs.to> stable inclusion from stable-v5.10.227 commit 1f61d509257d6a05763d05bf37943b35306522b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW CVE: CVE-2024-49933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ] Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700 ... Actual impact of this issue was not identified but I propose to fix the undefined behaviour. The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits. Reported-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 2b3bbae302e2..35e10e1c58fe 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2047,7 +2047,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) { struct ioc_gq *iocg; - u64 dur, usage_pct, nr_cycles; + u64 dur, usage_pct, nr_cycles, nr_cycles_shift; /* if no debtor, reset the cycle */ if (!nr_debtors) { @@ -2109,10 +2109,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1); if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1; + if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?: 1; + iocg->delay = iocg->delay >> nr_cycles_shift ?: 1; iocg_kick_waitq(iocg, true, now); -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 27399521743732e65e7635fa93bd0cca53981c9e
by kernel test robot 29 Oct '24

29 Oct '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 27399521743732e65e7635fa93bd0cca53981c9e !12441 hwmon: (coretemp) Check for null before removing sysfs attrs Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241029 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- mm-pin_mem.c:error:HUGETLB_PAGE_DTOR-undeclared-(first-use-in-this-function) | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-002-20241029 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount |-- arm64-randconfig-003-20241029 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-pin_mem.c:error:HUGETLB_PAGE_DTOR-undeclared-(first-use-in-this-function) | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- arm64-randconfig-004-20241029 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- include-linux-uaccess.h:warning:cap-may-be-used-uninitialized | `-- mm-pin_mem.c:error:HUGETLB_PAGE_DTOR-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-001-20241029 | `-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized |-- x86_64-buildonly-randconfig-002-20241029 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-soundwire-bus_type.o:warning:objtool:missing-symbol-for-section-.init.text | `-- drivers-soundwire-intel.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241029 | |-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init | `-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit |-- x86_64-buildonly-randconfig-006-20241029 | |-- fs-nilfs2-btree.c:warning:bh-may-be-used-uninitialized | |-- include-asm-generic-atomic-instrumented.h:warning:wait_req-may-be-used-uninitialized | `-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized |-- x86_64-randconfig-001-20241029 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- x86_64-randconfig-002-20241029 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group |-- x86_64-randconfig-014-20241029 | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity-Werror-Wimplicit-function-declaration | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains-Werror-Wimplicit-function-declaration | `-- kernel-sched-core.c:error:use-of-undeclared-identifier-root_task_group `-- x86_64-randconfig-076-20241029 `-- arch-x86-events-zhaoxin-core.c:error:redefinition-of-zhaoxin_pmu_init elapsed time: 737m configs tested: 35 configs skipped: 127 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20241029 gcc-14.1.0 arm64 randconfig-002-20241029 gcc-14.1.0 arm64 randconfig-003-20241029 gcc-14.1.0 arm64 randconfig-004-20241029 gcc-14.1.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241029 gcc-12 x86_64 buildonly-randconfig-002-20241029 gcc-12 x86_64 buildonly-randconfig-003-20241029 gcc-12 x86_64 buildonly-randconfig-004-20241029 gcc-12 x86_64 buildonly-randconfig-005-20241029 clang-19 x86_64 buildonly-randconfig-006-20241029 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241029 gcc-12 x86_64 randconfig-002-20241029 clang-19 x86_64 randconfig-003-20241029 gcc-12 x86_64 randconfig-004-20241029 clang-19 x86_64 randconfig-005-20241029 gcc-12 x86_64 randconfig-006-20241029 gcc-12 x86_64 randconfig-011-20241029 clang-19 x86_64 randconfig-012-20241029 clang-19 x86_64 randconfig-013-20241029 clang-19 x86_64 randconfig-014-20241029 clang-19 x86_64 randconfig-015-20241029 gcc-12 x86_64 randconfig-016-20241029 gcc-12 x86_64 randconfig-071-20241029 gcc-12 x86_64 randconfig-072-20241029 gcc-12 x86_64 randconfig-073-20241029 gcc-12 x86_64 randconfig-074-20241029 clang-19 x86_64 randconfig-075-20241029 gcc-12 x86_64 randconfig-076-20241029 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] blk_iocost: fix more out of bound shifts
by Zheng Qixing 29 Oct '24

29 Oct '24

From: Konstantin Ovsepian <ovs(a)ovs.to> stable inclusion from stable-v5.10.227 commit 1f61d509257d6a05763d05bf37943b35306522b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW CVE: CVE-2024-49933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ] Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700 ... Actual impact of this issue was not identified but I propose to fix the undefined behaviour. The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits. Reported-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 2b3bbae302e2..35e10e1c58fe 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2047,7 +2047,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) { struct ioc_gq *iocg; - u64 dur, usage_pct, nr_cycles; + u64 dur, usage_pct, nr_cycles, nr_cycles_shift; /* if no debtor, reset the cycle */ if (!nr_debtors) { @@ -2109,10 +2109,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1); if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1; + if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?: 1; + iocg->delay = iocg->delay >> nr_cycles_shift ?: 1; iocg_kick_waitq(iocg, true, now); -- 2.39.2

2 1

[PATCH OLK-6.6] blk_iocost: fix more out of bound shifts
by Zheng Qixing 29 Oct '24

29 Oct '24

From: Konstantin Ovsepian <ovs(a)ovs.to> stable inclusion from stable-v6.6.55 commit 1ab2cfe19700fb3dde4c7dfec392acff34db3120 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCW CVE: CVE-2024-49933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bce8005ec0dcb23a58300e8522fe4a31da606fa ] Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dump_stack_lvl+0xca/0x130 __ubsan_handle_shift_out_of_bounds+0x22c/0x280 ? __lock_acquire+0x6441/0x7c10 ioc_timer_fn+0x6cec/0x7750 ? blk_iocost_init+0x720/0x720 ? call_timer_fn+0x5d/0x470 call_timer_fn+0xfa/0x470 ? blk_iocost_init+0x720/0x720 __run_timer_base+0x519/0x700 ... Actual impact of this issue was not identified but I propose to fix the undefined behaviour. The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits. Reported-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Konstantin Ovsepian <ovs(a)ovs.to> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20240822154137.2627818-1-ovs@ovs.to Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-iocost.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 3ac79f0c098f..3a5ba10ba2b1 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2076,7 +2076,7 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, struct ioc_now *now) { struct ioc_gq *iocg; - u64 dur, usage_pct, nr_cycles; + u64 dur, usage_pct, nr_cycles, nr_cycles_shift; /* if no debtor, reset the cycle */ if (!nr_debtors) { @@ -2138,10 +2138,12 @@ static void ioc_forgive_debts(struct ioc *ioc, u64 usage_us_sum, int nr_debtors, old_debt = iocg->abs_vdebt; old_delay = iocg->delay; + nr_cycles_shift = min_t(u64, nr_cycles, BITS_PER_LONG - 1); if (iocg->abs_vdebt) - iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles ?: 1; + iocg->abs_vdebt = iocg->abs_vdebt >> nr_cycles_shift ?: 1; + if (iocg->delay) - iocg->delay = iocg->delay >> nr_cycles ?: 1; + iocg->delay = iocg->delay >> nr_cycles_shift ?: 1; iocg_kick_waitq(iocg, true, now); -- 2.39.2

2 1