- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] net: fec: fix the potential memory leak in fec_enet_init()
by Zhang Zekun 07 Apr '24

07 Apr '24

From: Fugang Duan <fugang.duan(a)nxp.com> stable inclusion from stable-5.10.42 commit 8ee7ef4a57a9e1228b6f345aaa70aa8951c7e9cd bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BGVY CVE: CVE-2021-47150 ---------------------------------------------- If the memory allocated for cbd_base is failed, it should free the memory allocated for the queues, otherwise it causes memory leak. And if the memory allocated for the queues is failed, it can return error directly. Fixes: 59d0f7465644 ("net: fec: init multi queue date structure") Signed-off-by: Fugang Duan <fugang.duan(a)nxp.com> Signed-off-by: Joakim Zhang <qiangqing.zhang(a)nxp.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 296ae1e4c322..3e402c9b3598 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -3147,7 +3147,9 @@ static int fec_enet_init(struct net_device *ndev) return ret; } - fec_enet_alloc_queue(ndev); + ret = fec_enet_alloc_queue(ndev); + if (ret) + return ret; bd_size = (fep->total_tx_ring_size + fep->total_rx_ring_size) * dsize; @@ -3155,7 +3157,8 @@ static int fec_enet_init(struct net_device *ndev) cbd_base = dmam_alloc_coherent(&fep->pdev->dev, bd_size, &bd_dma, GFP_KERNEL); if (!cbd_base) { - return -ENOMEM; + ret = -ENOMEM; + goto free_queue_mem; } memset(cbd_base, 0, bd_size); @@ -3235,6 +3238,10 @@ static int fec_enet_init(struct net_device *ndev) fec_enet_update_ethtool_stats(ndev); return 0; + +free_queue_mem: + fec_enet_free_queue(ndev); + return ret; } #ifdef CONFIG_OF -- 2.17.1

2 1

[PATCH V2 OLK-5.10] [Huawei] iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
by Zhang Zekun 07 Apr '24

07 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9EEIG -------------------------------------- This commit fix the following errors in the code: 1. The arm_smmu_aux_attach_dev function returns an uncertain return value ret when all conditions are not met. In this case, the cd table is not initialized. Therefore, a new default exception value is added. 2. In arm_smmu_ecmdq_probe(), the parameter pre_addr is used in the loop but it is not initialed yet. Also, the parameter "ecmdq" is used before check if it is NULL. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- v2: - fix a patch format check warning drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index fe647241ca88..423a54b7611d 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3630,6 +3630,9 @@ static int arm_smmu_aux_attach_dev(struct iommu_domain *domain, struct device *d dev_err(dev, "cannot attach aux domain with different parent\n"); ret = -EINVAL; goto out_unlock; + } else { + ret = -EINVAL; + goto out_unlock; } /* FIXME: serialize against arm_smmu_share_asid() */ @@ -4813,7 +4816,7 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) int ret, cpu; u32 i, nump, numq, gap; u32 reg, shift_increment; - u64 addr, smmu_dma_base; + u64 addr, smmu_dma_base, val, pre_addr; void __iomem *cp_regs, *cp_base; /* IDR6 */ @@ -4831,8 +4834,6 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) return -ENOMEM; for (i = 0; i < nump; i++) { - u64 val, pre_addr; - val = readq_relaxed(cp_regs + 32 * i); if (!(val & ECMDQ_CP_PRESET)) { iounmap(cp_regs); @@ -4872,7 +4873,6 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) struct arm_smmu_queue *q; ecmdq = *per_cpu_ptr(smmu->ecmdqs, cpu); - q = &ecmdq->cmdq.q; /* * The boot option "maxcpus=" can limit the number of online @@ -4885,6 +4885,8 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) */ if (!ecmdq || (ecmdq != per_cpu_ptr(smmu->ecmdq, cpu))) continue; + + q = &ecmdq->cmdq.q; ecmdq->base = cp_base + addr; q->llq.max_n_shift = ECMDQ_MAX_SZ_SHIFT + shift_increment; -- 2.17.1

1 0

[PATCH OLK-5.10] [Huawei] iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
by Zhang Zekun 07 Apr '24

07 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9EEIG -------------------------------------- This commit fix the following errors in the code: 1. The arm_smmu_aux_attach_dev function returns an uncertain return value ret when all conditions are not met. In this case, the cd table is not initialized. Therefore, a new default exception value is added. 2. In arm_smmu_ecmdq_probe(), the parameter pre_addr is used in the loop but it is not initialed yet. Also, the parameter "ecmdq" is used before check if it is NULL. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index fe647241ca88..423a54b7611d 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3630,6 +3630,9 @@ static int arm_smmu_aux_attach_dev(struct iommu_domain *domain, struct device *d dev_err(dev, "cannot attach aux domain with different parent\n"); ret = -EINVAL; goto out_unlock; + } else { + ret = -EINVAL; + goto out_unlock; } /* FIXME: serialize against arm_smmu_share_asid() */ @@ -4813,7 +4816,7 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) int ret, cpu; u32 i, nump, numq, gap; u32 reg, shift_increment; - u64 addr, smmu_dma_base; + u64 addr, smmu_dma_base, val, pre_addr; void __iomem *cp_regs, *cp_base; /* IDR6 */ @@ -4831,8 +4834,6 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) return -ENOMEM; for (i = 0; i < nump; i++) { - u64 val, pre_addr; - val = readq_relaxed(cp_regs + 32 * i); if (!(val & ECMDQ_CP_PRESET)) { iounmap(cp_regs); @@ -4872,7 +4873,6 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) struct arm_smmu_queue *q; ecmdq = *per_cpu_ptr(smmu->ecmdqs, cpu); - q = &ecmdq->cmdq.q; /* * The boot option "maxcpus=" can limit the number of online @@ -4885,6 +4885,8 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) */ if (!ecmdq || (ecmdq != per_cpu_ptr(smmu->ecmdq, cpu))) continue; + + q = &ecmdq->cmdq.q; ecmdq->base = cp_base + addr; q->llq.max_n_shift = ECMDQ_MAX_SZ_SHIFT + shift_increment; -- 2.17.1

2 1

[PATCH] [Huawei] iommu/arm-smmu-v3: fix using uninitialized or unchecked symbol
by Zhang Zekun 07 Apr '24

07 Apr '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9EEIG -------------------------------------- This commit fix the following errors in the code: 1. The arm_smmu_aux_attach_dev function returns an uncertain return value ret when all conditions are not met. In this case, the cd table is not initialized. Therefore, a new default exception value is added. 2. In arm_smmu_ecmdq_probe(), the parameter pre_addr is used in the loop but it is not initialed yet. Also, the parameter "ecmdq" is used before check if it is NULL. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index fe647241ca88..423a54b7611d 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3630,6 +3630,9 @@ static int arm_smmu_aux_attach_dev(struct iommu_domain *domain, struct device *d dev_err(dev, "cannot attach aux domain with different parent\n"); ret = -EINVAL; goto out_unlock; + } else { + ret = -EINVAL; + goto out_unlock; } /* FIXME: serialize against arm_smmu_share_asid() */ @@ -4813,7 +4816,7 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) int ret, cpu; u32 i, nump, numq, gap; u32 reg, shift_increment; - u64 addr, smmu_dma_base; + u64 addr, smmu_dma_base, val, pre_addr; void __iomem *cp_regs, *cp_base; /* IDR6 */ @@ -4831,8 +4834,6 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) return -ENOMEM; for (i = 0; i < nump; i++) { - u64 val, pre_addr; - val = readq_relaxed(cp_regs + 32 * i); if (!(val & ECMDQ_CP_PRESET)) { iounmap(cp_regs); @@ -4872,7 +4873,6 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) struct arm_smmu_queue *q; ecmdq = *per_cpu_ptr(smmu->ecmdqs, cpu); - q = &ecmdq->cmdq.q; /* * The boot option "maxcpus=" can limit the number of online @@ -4885,6 +4885,8 @@ static int arm_smmu_ecmdq_probe(struct arm_smmu_device *smmu) */ if (!ecmdq || (ecmdq != per_cpu_ptr(smmu->ecmdq, cpu))) continue; + + q = &ecmdq->cmdq.q; ecmdq->base = cp_base + addr; q->llq.max_n_shift = ECMDQ_MAX_SZ_SHIFT + shift_increment; -- 2.17.1

1 0

[PATCH OLK-6.6 00/16] Support NMI in the virtual machine
by chenxiang 07 Apr '24

07 Apr '24

From: caijian <caijian11(a)h-partners.com> Patch#1 Revert "KVM: arm64: Disable MPAM visibility by default, and handle traps" to make sure it could load vm with high version qemu in the board that supports MPAM feature. Patch#2-16 support nmi in the virtual machine. https://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms.git/log/?… Marc Zyngier (15): KVM: arm64: vgic-v3: Upgrade AP1Rn to 64bit. KVM: arm64: vgic-v3: Allow the NMI state to make it into the LRs KVM: arm64: vgic-v3: Make NMI priority RES0 KVM: arm64: vgic-v4: Propagate the NMI state into the GICv4.1 VSGI configuration KVM: arm64: vgic-v3: Use the NMI attribute as part of the AP-list sorting KVM: arm64: vgic-v3: Add support for GIC{D,R}_INMIR registers KVM: arm64: vgic-v3: Add userspace selection for GICv3.3 NMI KVM: arm64: vgic-debug: Add the NMI field to the debug output KVM: arm64: Allow userspace to control ID_AA64PFR1_EL1.NMI KVM: arm64: Don't trap ALLINT accesses if the vcpu has FEAT_NMI KVM: arm64: vgic-v3: Don't inject an NMI if the vcpu doesn't have FEAT_NMI KVM: arm64: Allow GICv3.3 NMI if the host supports it KVM: arm64: Handle traps of ALLINT arm64: Decouple KVM from CONFIG_ARM64_NMI KVM: arm64: vgic-v3: Handle traps of ICV_NMIAR1_EL1 caijian (1): Revert "KVM: arm64: Disable MPAM visibility by default, and handle traps" arch/arm64/include/asm/cpufeature.h | 3 +- arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/asm/sysreg.h | 3 + arch/arm64/kernel/cpufeature.c | 13 ++- arch/arm64/kvm/arm.c | 3 + arch/arm64/kvm/hyp/include/hyp/switch.h | 6 +- arch/arm64/kvm/hyp/vgic-v3-sr.c | 14 +++- arch/arm64/kvm/sys_regs.c | 107 ++++++++++-------------- arch/arm64/kvm/vgic/vgic-debug.c | 9 +- arch/arm64/kvm/vgic/vgic-init.c | 10 ++- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 1 + arch/arm64/kvm/vgic/vgic-mmio-v3.c | 70 +++++++++++++++- arch/arm64/kvm/vgic/vgic-mmio.c | 25 ++++-- arch/arm64/kvm/vgic/vgic-v3.c | 12 ++- arch/arm64/kvm/vgic/vgic-v4.c | 1 + arch/arm64/kvm/vgic/vgic.c | 8 +- arch/arm64/kvm/vgic/vgic.h | 1 + drivers/irqchip/irq-gic-v3-its.c | 9 ++ drivers/irqchip/irq-gic-v3.c | 12 +++ drivers/irqchip/irq-gic-v4.c | 3 +- include/kvm/arm_vgic.h | 10 ++- include/linux/irqchip/arm-gic-v4.h | 4 +- include/linux/irqchip/arm-vgic-info.h | 2 + 23 files changed, 238 insertions(+), 90 deletions(-) -- 2.30.0

2 17

[openeuler:openEuler-1.0-LTS 20821/22045] fs/io_uring.c:3882:14: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 05 Apr '24

05 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e89315eb08769716cbf7e08f49672222cf0eca47 commit: b2b243d6115480833f9d888b06d70e372ae6fdb2 [20821/22045] io_uring: get rid of intermediate IORING_OP_CLOSE stage config: arm64-randconfig-r112-20240401 (https://download.01.org/0day-ci/archive/20240405/202404050320.ikGdTX4Z-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240405/202404050320.ikGdTX4Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404050320.ikGdTX4Z-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) fs/io_uring.c:2822:24: sparse: sparse: incorrect type in return expression (different address spaces) @@ expected void [noderef] <asn:1> * @@ got struct io_buffer *[assigned] kbuf @@ fs/io_uring.c:2822:24: sparse: expected void [noderef] <asn:1> * fs/io_uring.c:2822:24: sparse: got struct io_buffer *[assigned] kbuf fs/io_uring.c:2988:40: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] <asn:1> *[assigned] iov_base @@ got void * @@ fs/io_uring.c:2988:40: sparse: expected void [noderef] <asn:1> *[assigned] iov_base fs/io_uring.c:2988:40: sparse: got void * fs/io_uring.c:3364:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected long long [noderef] [usertype] <asn:1> *off_in @@ got long long [usertype] *[assigned] poff_in @@ fs/io_uring.c:3364:37: sparse: expected long long [noderef] [usertype] <asn:1> *off_in fs/io_uring.c:3364:37: sparse: got long long [usertype] *[assigned] poff_in fs/io_uring.c:3364:51: sparse: sparse: incorrect type in argument 4 (different address spaces) @@ expected long long [noderef] [usertype] <asn:1> *off_out @@ got long long [usertype] *[assigned] poff_out @@ fs/io_uring.c:3364:51: sparse: expected long long [noderef] [usertype] <asn:1> *off_out fs/io_uring.c:3364:51: sparse: got long long [usertype] *[assigned] poff_out >> fs/io_uring.c:3882:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct file *[assigned] file @@ got struct file [noderef] <asn:4> * @@ fs/io_uring.c:3882:14: sparse: expected struct file *[assigned] file fs/io_uring.c:3882:14: sparse: got struct file [noderef] <asn:4> * fs/io_uring.c:4529:72: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected int mask @@ got restricted __poll_t [usertype] mask @@ fs/io_uring.c:4529:72: sparse: expected int mask fs/io_uring.c:4529:72: sparse: got restricted __poll_t [usertype] mask fs/io_uring.c:4533:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] result @@ got restricted __poll_t [usertype] mask @@ fs/io_uring.c:4533:21: sparse: expected unsigned int [usertype] result fs/io_uring.c:4533:21: sparse: got restricted __poll_t [usertype] mask fs/io_uring.c:4571:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] result @@ got restricted __poll_t @@ fs/io_uring.c:4571:29: sparse: expected unsigned int [usertype] result fs/io_uring.c:4571:29: sparse: got restricted __poll_t fs/io_uring.c:4636:34: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __poll_t [usertype] mask @@ got unsigned int [usertype] result @@ fs/io_uring.c:4636:34: sparse: expected restricted __poll_t [usertype] mask fs/io_uring.c:4636:34: sparse: got unsigned int [usertype] result fs/io_uring.c:4788:41: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected int mask @@ got restricted __poll_t [usertype] @@ fs/io_uring.c:4788:41: sparse: expected int mask fs/io_uring.c:4788:41: sparse: got restricted __poll_t [usertype] fs/io_uring.c:4877:22: sparse: sparse: invalid assignment: |= fs/io_uring.c:4877:22: sparse: left side has type restricted __poll_t fs/io_uring.c:4877:22: sparse: right side has type int fs/io_uring.c:4879:22: sparse: sparse: invalid assignment: |= fs/io_uring.c:4879:22: sparse: left side has type restricted __poll_t fs/io_uring.c:4879:22: sparse: right side has type int fs/io_uring.c:4880:14: sparse: sparse: invalid assignment: |= fs/io_uring.c:4880:14: sparse: left side has type restricted __poll_t fs/io_uring.c:4880:14: sparse: right side has type int fs/io_uring.c:4894:67: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected int mask @@ got restricted __poll_t [assigned] [usertype] mask @@ fs/io_uring.c:4894:67: sparse: expected int mask fs/io_uring.c:4894:67: sparse: got restricted __poll_t [assigned] [usertype] mask fs/io_uring.c:4895:52: sparse: sparse: incorrect type in argument 5 (different base types) @@ expected int events @@ got restricted __poll_t [usertype] events @@ fs/io_uring.c:4895:52: sparse: expected int events fs/io_uring.c:4895:52: sparse: got restricted __poll_t [usertype] events fs/io_uring.c:5051:34: sparse: sparse: restricted __poll_t degrades to integer fs/io_uring.c:5050:57: sparse: sparse: restricted __poll_t degrades to integer fs/io_uring.c:5050:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __poll_t [usertype] events @@ got unsigned int @@ fs/io_uring.c:5050:22: sparse: expected restricted __poll_t [usertype] events fs/io_uring.c:5050:22: sparse: got unsigned int In file included from include/linux/hugetlb.h:45, from fs/io_uring.c:73: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ fs/io_uring.c: In function 'io_probe.isra': fs/io_uring.c:8725:23: warning: array subscript i is outside array bounds of 'struct io_uring_probe_op[0]' [-Warray-bounds=] 8725 | p->ops[i].op = i; | ~~~~~~^~~ In file included from fs/io_uring.c:86: include/uapi/linux/io_uring.h:291:34: note: while referencing 'ops' 291 | struct io_uring_probe_op ops[0]; | ^~~ fs/io_uring.c:8727:31: warning: array subscript i is outside array bounds of 'struct io_uring_probe_op[0]' [-Warray-bounds=] 8727 | p->ops[i].flags = IO_URING_OP_SUPPORTED; | ~~~~~~^~~ include/uapi/linux/io_uring.h:291:34: note: while referencing 'ops' 291 | struct io_uring_probe_op ops[0]; | ^~~ In file included from include/linux/if_ether.h:23, from include/uapi/linux/ethtool.h:19, from include/linux/ethtool.h:19, from include/linux/netdevice.h:42, from include/net/sock.h:52, from fs/io_uring.c:65: In function '__skb_queue_before', inlined from '__skb_queue_tail' at include/linux/skbuff.h:1908:2, inlined from 'io_ring_file_put.isra' at fs/io_uring.c:6991:3: include/linux/skbuff.h:1874:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds=] 1874 | __skb_insert(newsk, next->prev, next, list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/io_uring.c: In function 'io_ring_file_put.isra': fs/io_uring.c:6949:29: note: object 'list' of size 80 6949 | struct sk_buff_head list, *head = &sock->sk_receive_queue; | ^~~~ In function '__skb_queue_before', inlined from '__skb_queue_tail' at include/linux/skbuff.h:1908:2, inlined from 'io_ring_file_put.isra' at fs/io_uring.c:6981:5: include/linux/skbuff.h:1874:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds=] 1874 | __skb_insert(newsk, next->prev, next, list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ fs/io_uring.c: In function 'io_ring_file_put.isra': fs/io_uring.c:6949:29: note: object 'list' of size 80 6949 | struct sk_buff_head list, *head = &sock->sk_receive_queue; | ^~~~ In file included from include/linux/poll.h:12, from include/linux/ring_buffer.h:7, from include/linux/trace_events.h:6, from include/trace/syscall.h:7, from include/linux/syscalls.h:86, from fs/io_uring.c:45: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'io_uring_setup' at fs/io_uring.c:8679:6: include/linux/uaccess.h:112:17: warning: 'p' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:265, from include/linux/kernel.h:10, from fs/io_uring.c:42: include/linux/kasan-checks.h: In function 'io_uring_setup': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); vim +3882 fs/io_uring.c 3864 3865 static int io_close(struct io_kiocb *req, bool force_nonblock, 3866 struct io_comp_state *cs) 3867 { 3868 struct files_struct *files = current->files; 3869 struct io_close *close = &req->close; 3870 struct fdtable *fdt; 3871 struct file *file; 3872 int ret; 3873 3874 file = NULL; 3875 ret = -EBADF; 3876 spin_lock(&files->file_lock); 3877 fdt = files_fdtable(files); 3878 if (close->fd >= fdt->max_fds) { 3879 spin_unlock(&files->file_lock); 3880 goto err; 3881 } > 3882 file = fdt->fd[close->fd]; 3883 if (!file) { 3884 spin_unlock(&files->file_lock); 3885 goto err; 3886 } 3887 3888 if (file->f_op == &io_uring_fops) { 3889 spin_unlock(&files->file_lock); 3890 file = NULL; 3891 goto err; 3892 } 3893 3894 /* if the file has a flush method, be safe and punt to async */ 3895 if ((file->f_op->flush && force_nonblock) || 3896 req->close.fd == req->ctx->ring_fd) { 3897 spin_unlock(&files->file_lock); 3898 return -EAGAIN; 3899 } 3900 3901 ret = __close_fd_get_file(close->fd, &file); 3902 spin_unlock(&files->file_lock); 3903 if (ret < 0) { 3904 if (ret == -ENOENT) 3905 ret = -EBADF; 3906 goto err; 3907 } 3908 3909 /* No ->flush() or already async, safely close from here */ 3910 ret = filp_close(file, current->files); 3911 err: 3912 if (ret < 0) 3913 req_set_fail_links(req); 3914 if (file) 3915 fput(file); 3916 __io_req_complete(req, ret, 0, cs); 3917 return 0; 3918 } 3919 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20444/22045] arch/arm64/kernel/cpufeature.c:1287:9: error: 'a32_elf_hwcap2' undeclared; did you mean 'elf_hwcap'?
by kernel test robot 05 Apr '24

05 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e89315eb08769716cbf7e08f49672222cf0eca47 commit: 6dfc76f160cb5e8bf25cb85d4763cdc3144bfda8 [20444/22045] arm64: errata: Remove AES hwcap for COMPAT tasks config: arm64-randconfig-r112-20240401 (https://download.01.org/0day-ci/archive/20240405/202404050118.HPvTb5SP-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240405/202404050118.HPvTb5SP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404050118.HPvTb5SP-lkp@intel.com/ Note: the openeuler/openEuler-1.0-LTS HEAD e89315eb08769716cbf7e08f49672222cf0eca47 builds fine. It only hurts bisectability. All errors (new ones prefixed by >>): arch/arm64/kernel/cpufeature.c:1287:9: sparse: sparse: undefined identifier 'a32_elf_hwcap2' arch/arm64/kernel/cpufeature.c: In function 'elf_hwcap_fixup': >> arch/arm64/kernel/cpufeature.c:1287:9: error: 'a32_elf_hwcap2' undeclared (first use in this function); did you mean 'elf_hwcap'? 1287 | a32_elf_hwcap2 &= ~COMPAT_HWCAP2_AES; | ^~~~~~~~~~~~~~ | elf_hwcap arch/arm64/kernel/cpufeature.c:1287:9: note: each undeclared identifier is reported only once for each function it appears in vim +1287 arch/arm64/kernel/cpufeature.c 1282 1283 static void elf_hwcap_fixup(void) 1284 { 1285 #ifdef CONFIG_ARM64_ERRATUM_1742098 1286 if (cpus_have_const_cap(ARM64_WORKAROUND_1742098)) > 1287 a32_elf_hwcap2 &= ~COMPAT_HWCAP2_AES; 1288 #endif /* ARM64_ERRATUM_1742098 */ 1289 } 1290 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7041/7280] ld.lld: error: duplicate symbol: remove_mbx_irq
by kernel test robot 04 Apr '24

04 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5cf97fd1b2bc5ef3aefe91efc63c73b4721a7a44 commit: bf177ad1d8f72824180b44563c09f37562f645de [7041/7280] drivers: initial support for rnpgbevf drivers from Mucse Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20240404/202404041822.U2KyOb5f-lkp@…) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240404/202404041822.U2KyOb5f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404041822.U2KyOb5f-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: duplicate symbol: remove_mbx_irq >>> defined at rnpvf_main.c >>> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.o:(remove_mbx_irq) in archive vmlinux.a >>> defined at rnpgbevf_main.c >>> drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.o:(.text+0x9B40) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: __cfi_remove_mbx_irq >>> defined at rnpvf_main.c >>> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.o:(__cfi_remove_mbx_irq) in archive vmlinux.a >>> defined at rnpgbevf_main.c >>> drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.o:(.text+0x9B00) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: register_mbx_irq >>> defined at rnpvf_main.c >>> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.o:(register_mbx_irq) in archive vmlinux.a >>> defined at rnpgbevf_main.c >>> drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.o:(.text+0x9D80) in archive vmlinux.a -- >> ld.lld: error: duplicate symbol: __cfi_register_mbx_irq >>> defined at rnpvf_main.c >>> drivers/net/ethernet/mucse/rnpvf/rnpvf_main.o:(__cfi_register_mbx_irq) in archive vmlinux.a >>> defined at rnpgbevf_main.c >>> drivers/net/ethernet/mucse/rnpgbevf/rnpgbevf_main.o:(.text+0x9D40) in archive vmlinux.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20434/22045] net/sched/act_mirred.c:217:21: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 04 Apr '24

04 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e89315eb08769716cbf7e08f49672222cf0eca47 commit: 66b5f39a891163c63bedcb59610991c784b416a4 [20434/22045] net: sched: protect against stack overflow in TC act_mirred config: arm64-randconfig-r112-20240401 (https://download.01.org/0day-ci/archive/20240404/202404041743.yILerkAq-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240404/202404041743.yILerkAq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404041743.yILerkAq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/sched/act_mirred.c:217:21: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned int [noderef] <asn:3> *__p @@ got unsigned int * @@ net/sched/act_mirred.c:217:21: sparse: expected unsigned int [noderef] <asn:3> *__p net/sched/act_mirred.c:217:21: sparse: got unsigned int * >> net/sched/act_mirred.c:217:21: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned int [noderef] <asn:3> *__p @@ got unsigned int * @@ net/sched/act_mirred.c:217:21: sparse: expected unsigned int [noderef] <asn:3> *__p net/sched/act_mirred.c:217:21: sparse: got unsigned int * >> net/sched/act_mirred.c:217:21: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned int [noderef] <asn:3> *__p @@ got unsigned int * @@ net/sched/act_mirred.c:217:21: sparse: expected unsigned int [noderef] <asn:3> *__p net/sched/act_mirred.c:217:21: sparse: got unsigned int * >> net/sched/act_mirred.c:217:21: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned int [noderef] <asn:3> *__p @@ got unsigned int * @@ net/sched/act_mirred.c:217:21: sparse: expected unsigned int [noderef] <asn:3> *__p net/sched/act_mirred.c:217:21: sparse: got unsigned int * net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression net/sched/act_mirred.c:217:21: sparse: sparse: dereference of noderef expression In file included from include/net/act_api.h:13, from include/net/pkt_cls.h:8, from net/sched/act_mirred.c:28: In function 'net_generic', inlined from 'tc_action_net_exit' at include/net/act_api.h:137:30, inlined from 'mirred_exit_net' at net/sched/act_mirred.c:444:2: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'mirred_exit_net': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ In function 'net_generic', inlined from 'mirred_init_net' at net/sched/act_mirred.c:437:29: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'mirred_init_net': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ In function 'net_generic', inlined from 'tcf_mirred_walker' at net/sched/act_mirred.c:357:29: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'tcf_mirred_walker': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ In function 'net_generic', inlined from 'tcf_mirred_init' at net/sched/act_mirred.c:102:29: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'tcf_mirred_init': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ In function 'net_generic', inlined from 'tcf_mirred_search' at net/sched/act_mirred.c:365:29: include/net/netns/generic.h:46:22: warning: array subscript <unknown> is outside array bounds of 'void *[0]' [-Warray-bounds=] 46 | ptr = ng->ptr[id]; | ~~~~~~~^~~~ include/net/netns/generic.h: In function 'tcf_mirred_search': include/net/netns/generic.h:35:23: note: while referencing 'ptr' 35 | void *ptr[0]; | ^~~ vim +217 net/sched/act_mirred.c 199 200 static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, 201 struct tcf_result *res) 202 { 203 struct tcf_mirred *m = to_mirred(a); 204 struct sk_buff *skb2 = skb; 205 bool m_mac_header_xmit; 206 struct net_device *dev; 207 unsigned int rec_level; 208 int retval, err = 0; 209 bool use_reinsert; 210 bool want_ingress; 211 bool is_redirect; 212 bool expects_nh; 213 int m_eaction; 214 int mac_len; 215 bool at_nh; 216 > 217 rec_level = __this_cpu_inc_return(mirred_rec_level); 218 if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) { 219 net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n", 220 netdev_name(skb->dev)); 221 __this_cpu_dec(mirred_rec_level); 222 return TC_ACT_SHOT; 223 } 224 225 tcf_lastuse_update(&m->tcf_tm); 226 bstats_cpu_update(this_cpu_ptr(m->common.cpu_bstats), skb); 227 228 m_mac_header_xmit = READ_ONCE(m->tcfm_mac_header_xmit); 229 m_eaction = READ_ONCE(m->tcfm_eaction); 230 retval = READ_ONCE(m->tcf_action); 231 dev = rcu_dereference_bh(m->tcfm_dev); 232 if (unlikely(!dev)) { 233 pr_notice_once("tc mirred: target device is gone\n"); 234 goto out; 235 } 236 237 if (unlikely(!(dev->flags & IFF_UP))) { 238 net_notice_ratelimited("tc mirred to Houston: device %s is down\n", 239 dev->name); 240 goto out; 241 } 242 243 /* we could easily avoid the clone only if called by ingress and clsact; 244 * since we can't easily detect the clsact caller, skip clone only for 245 * ingress - that covers the TC S/W datapath. 246 */ 247 is_redirect = tcf_mirred_is_act_redirect(m_eaction); 248 use_reinsert = skb_at_tc_ingress(skb) && is_redirect && 249 tcf_mirred_can_reinsert(retval); 250 if (!use_reinsert) { 251 skb2 = skb_clone(skb, GFP_ATOMIC); 252 if (!skb2) 253 goto out; 254 } 255 256 want_ingress = tcf_mirred_act_wants_ingress(m_eaction); 257 258 expects_nh = want_ingress || !m_mac_header_xmit; 259 at_nh = skb->data == skb_network_header(skb); 260 if (at_nh != expects_nh) { 261 mac_len = skb_at_tc_ingress(skb) ? skb->mac_len : 262 skb_network_header(skb) - skb_mac_header(skb); 263 if (expects_nh) { 264 /* target device/action expect data at nh */ 265 skb_pull_rcsum(skb2, mac_len); 266 } else { 267 /* target device/action expect data at mac */ 268 skb_push_rcsum(skb2, mac_len); 269 } 270 } 271 272 skb2->skb_iif = skb->dev->ifindex; 273 skb2->dev = dev; 274 275 /* mirror is always swallowed */ 276 if (is_redirect) { 277 skb2->tc_redirected = 1; 278 skb2->tc_from_ingress = skb2->tc_at_ingress; 279 280 /* let's the caller reinsert the packet, if possible */ 281 if (use_reinsert) { 282 res->ingress = want_ingress; 283 res->qstats = this_cpu_ptr(m->common.cpu_qstats); 284 skb_tc_reinsert(skb, res); 285 __this_cpu_dec(mirred_rec_level); 286 return TC_ACT_CONSUMED; 287 } 288 } 289 290 if (!want_ingress) 291 err = dev_queue_xmit(skb2); 292 else 293 err = netif_receive_skb(skb2); 294 295 if (err) { 296 out: 297 qstats_overlimit_inc(this_cpu_ptr(m->common.cpu_qstats)); 298 if (tcf_mirred_is_act_redirect(m_eaction)) 299 retval = TC_ACT_SHOT; 300 } 301 __this_cpu_dec(mirred_rec_level); 302 303 return retval; 304 } 305 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20217/22045] kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 04 Apr '24

04 Apr '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e89315eb08769716cbf7e08f49672222cf0eca47 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [20217/22045] dhugetlb: backport dynamic hugetlb feature config: arm64-randconfig-r112-20240401 (https://download.01.org/0day-ci/archive/20240404/202404041400.pyWx04Vl-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240404/202404041400.pyWx04Vl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404041400.pyWx04Vl-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] <asn:4> * @@ kernel/cgroup/cgroup.c:5286:48: sparse: expected struct cgroup_subsys_state *css kernel/cgroup/cgroup.c:5286:48: sparse: got struct cgroup_subsys_state [noderef] <asn:4> * kernel/cgroup/cgroup.c:2685:20: sparse: sparse: context imbalance in 'cgroup_procs_write_start' - wrong count at exit kernel/cgroup/cgroup.c:2741:9: sparse: sparse: context imbalance in 'cgroup_procs_write_finish' - wrong count at exit kernel/cgroup/cgroup.c:2874:9: sparse: sparse: context imbalance in 'cgroup_lock_and_drain_offline' - wrong count at exit kernel/cgroup/cgroup.c:4528:16: sparse: sparse: context imbalance in 'cgroup_procs_write' - wrong count at exit kernel/cgroup/cgroup.c:4580:16: sparse: sparse: context imbalance in 'cgroup_threads_write' - wrong count at exit vim +5286 kernel/cgroup/cgroup.c 5234 5235 /** 5236 * cgroup_destroy_locked - the first stage of cgroup destruction 5237 * @cgrp: cgroup to be destroyed 5238 * 5239 * css's make use of percpu refcnts whose killing latency shouldn't be 5240 * exposed to userland and are RCU protected. Also, cgroup core needs to 5241 * guarantee that css_tryget_online() won't succeed by the time 5242 * ->css_offline() is invoked. To satisfy all the requirements, 5243 * destruction is implemented in the following two steps. 5244 * 5245 * s1. Verify @cgrp can be destroyed and mark it dying. Remove all 5246 * userland visible parts and start killing the percpu refcnts of 5247 * css's. Set up so that the next stage will be kicked off once all 5248 * the percpu refcnts are confirmed to be killed. 5249 * 5250 * s2. Invoke ->css_offline(), mark the cgroup dead and proceed with the 5251 * rest of destruction. Once all cgroup references are gone, the 5252 * cgroup is RCU-freed. 5253 * 5254 * This function implements s1. After this step, @cgrp is gone as far as 5255 * the userland is concerned and a new cgroup with the same name may be 5256 * created. As cgroup doesn't care about the names internally, this 5257 * doesn't cause any problem. 5258 */ 5259 static int cgroup_destroy_locked(struct cgroup *cgrp) 5260 __releases(&cgroup_mutex) __acquires(&cgroup_mutex) 5261 { 5262 struct cgroup *tcgrp, *parent = cgroup_parent(cgrp); 5263 struct cgroup_subsys_state *css; 5264 struct cgrp_cset_link *link; 5265 int ssid; 5266 5267 lockdep_assert_held(&cgroup_mutex); 5268 5269 /* 5270 * Only migration can raise populated from zero and we're already 5271 * holding cgroup_mutex. 5272 */ 5273 if (cgroup_is_populated(cgrp)) 5274 return -EBUSY; 5275 5276 /* 5277 * Make sure there's no live children. We can't test emptiness of 5278 * ->self.children as dead children linger on it while being 5279 * drained; otherwise, "rmdir parent/child parent" may fail. 5280 */ 5281 if (css_has_online_children(&cgrp->self)) 5282 return -EBUSY; 5283 5284 #ifdef CONFIG_MEMCG 5285 /* If we use dynamic hugetlb, make sure dhugtlb_pool is free */ > 5286 if (!dhugetlb_pool_is_free(cgrp->subsys[memory_cgrp_id])) 5287 return -EBUSY; 5288 #endif 5289 /* 5290 * Mark @cgrp and the associated csets dead. The former prevents 5291 * further task migration and child creation by disabling 5292 * cgroup_lock_live_group(). The latter makes the csets ignored by 5293 * the migration path. 5294 */ 5295 cgrp->self.flags &= ~CSS_ONLINE; 5296 5297 spin_lock_irq(&css_set_lock); 5298 list_for_each_entry(link, &cgrp->cset_links, cset_link) 5299 link->cset->dead = true; 5300 spin_unlock_irq(&css_set_lock); 5301 5302 /* initiate massacre of all css's */ 5303 for_each_css(css, ssid, cgrp) 5304 kill_css(css); 5305 5306 /* clear and remove @cgrp dir, @cgrp has an extra ref on its kn */ 5307 css_clear_dir(&cgrp->self); 5308 kernfs_remove(cgrp->kn); 5309 5310 if (parent && cgroup_is_threaded(cgrp)) 5311 parent->nr_threaded_children--; 5312 5313 spin_lock_irq(&css_set_lock); 5314 for (tcgrp = cgroup_parent(cgrp); tcgrp; tcgrp = cgroup_parent(tcgrp)) { 5315 tcgrp->nr_descendants--; 5316 tcgrp->nr_dying_descendants++; 5317 } 5318 spin_unlock_irq(&css_set_lock); 5319 5320 cgroup1_check_for_release(parent); 5321 5322 /* put the base reference */ 5323 percpu_ref_kill(&cgrp->self.refcnt); 5324 5325 return 0; 5326 }; 5327 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0