- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 1/2] Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED"
by Yipeng Zou 24 May '24

24 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R3F8 CVE: NA -------------------------------- It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. This reverts commit 7fddb812509727addde0bc954a5502e620deae23. Fixes: 7fddb8125097 ("sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- init/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index d6422dc138d8..69bd400daeb3 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1069,7 +1069,6 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" depends on CPUSETS - depends on FAIR_CGROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED
by Yipeng Zou 24 May '24

24 May '24

It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. Yipeng Zou (2): Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED" sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_GROUP_SCHED init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 1/2] Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED"
by Yipeng Zou 24 May '24

24 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R3F8 CVE: NA -------------------------------- It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. This reverts commit 0232640040dc906424ef969ba1a0aaee97cf2846. Fixes: 0232640040dc ("sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- init/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index dc49f231294a..4b16ac2efda8 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1128,7 +1128,6 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" depends on CPUSETS - depends on FAIR_CGROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.34.1

2 3

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 24 May '24

24 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 24 May '24

24 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH OLK-5.10] ACPI: LPIT: Avoid u32 multiplication overflow
by Xiongfeng Wang 24 May '24

24 May '24

From: Nikita Kiryushin <kiryushin(a)ancud.ru> stable inclusion from stable-v5.10.209 commit f39c3d578c7d09a18ceaf56750fc7f20b02ada63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HZ CVE: CVE-2023-52683 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ] In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). Change multiplication to mul_u32_u32(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: eeb2d80d502a ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support") Signed-off-by: Nikita Kiryushin <kiryushin(a)ancud.ru> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/acpi/acpi_lpit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c index 48e5059d67ca..7de59730030c 100644 --- a/drivers/acpi/acpi_lpit.c +++ b/drivers/acpi/acpi_lpit.c @@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, struct acpi_lpit_native *lpit_native) { info->frequency = lpit_native->counter_frequency ? - lpit_native->counter_frequency : tsc_khz * 1000; + lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U); if (!info->frequency) info->frequency = 1; -- 2.20.1

2 1

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 24 May '24

24 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH openEuler-1.0-LTS] hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
by Zheng Yejian 24 May '24

24 May '24

From: Vadim Pasternak <vadimp(a)nvidia.com> stable inclusion from stable-v4.19.209 commit 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O0 CVE: CVE-2021-47393 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e6fab7af6ba1bc77c78713a83876f60ca7a4a064 ] Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature. Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum. Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because in this case statistics update violates thermal statistics table range. The issues is observed in case kernel is configured with option CONFIG_THERMAL_STATISTICS. Here is the trace from KASAN: [ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444 [ 159.545625] Call Trace: [ 159.548366] dump_stack+0x92/0xc1 [ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] thermal_zone_device_update+0x345/0x780 [ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core] [ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff .. [ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001 [ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700 [ 160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013 [ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013 [ 160.143671] [ 160.145338] Allocated by task 2924: [ 160.149242] kasan_save_stack+0x19/0x40 [ 160.153541] __kasan_kmalloc+0x7f/0xa0 [ 160.157743] __kmalloc+0x1a2/0x2b0 [ 160.161552] thermal_cooling_device_setup_sysfs+0xf9/0x1a0 [ 160.167687] __thermal_cooling_device_register+0x1b5/0x500 [ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0 [ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan] [ 160.248140] [ 160.249807] The buggy address belongs to the object at ffff888116163400 [ 160.249807] which belongs to the cache kmalloc-1k of size 1024 [ 160.263814] The buggy address is located 64 bytes to the right of [ 160.263814] 1024-byte region [ffff888116163400, ffff888116163800) [ 160.277536] The buggy address belongs to the page: [ 160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160 [ 160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0 [ 160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0 [ 160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000 [ 160.327033] page dumped because: kasan: bad access detected [ 160.333270] [ 160.334937] Memory state around the buggy address: [ 160.356469] >ffff888116163800: fc .. Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") Signed-off-by: Vadim Pasternak <vadimp(a)nvidia.com> Link: https://lore.kernel.org/r/20210916183151.869427-1-vadimp@nvidia.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/hwmon/mlxreg-fan.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c index d8fa4bea4bc8..e57b0c5119ce 100644 --- a/drivers/hwmon/mlxreg-fan.c +++ b/drivers/hwmon/mlxreg-fan.c @@ -307,8 +307,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, { struct mlxreg_fan *fan = cdev->devdata; unsigned long cur_state; + int i, config = 0; u32 regval; - int i; int err; /* @@ -321,6 +321,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, * overwritten. */ if (state >= MLXREG_FAN_SPEED_MIN && state <= MLXREG_FAN_SPEED_MAX) { + /* + * This is configuration change, which is only supported through sysfs. + * For configuration non-zero value is to be returned to avoid thermal + * statistics update. + */ + config = 1; state -= MLXREG_FAN_MAX_STATE; for (i = 0; i < state; i++) fan->cooling_levels[i] = state; @@ -335,7 +341,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, cur_state = MLXREG_FAN_PWM_DUTY2STATE(regval); if (state < cur_state) - return 0; + return config; state = cur_state; } @@ -351,7 +357,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, dev_err(fan->dev, "Failed to write PWM duty\n"); return err; } - return 0; + return config; } static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Scheduler load balance fixes
by Zhang Qiao 24 May '24

24 May '24

Zhang Qiao (2): sched/numa: Fix numa imbalance in load_balance() config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 arch/arm64/configs/openeuler_defconfig | 2 +- kernel/sched/fair.c | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH openEuler-1.0-LTS] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
by Zhao Mengmeng 24 May '24

24 May '24

From: Jiri Benc <jbenc(a)redhat.com> stable inclusion from stable-v4.19.313 commit b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRPL CVE: CVE-2024-35969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ] Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK> Fixes: 5c578aedcb21d ("IPv6: convert addrconf hash list to RCU") Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Jiri Benc <jbenc(a)redhat.com> Link: https://lore.kernel.org/r/8ab821e36073a4a406c50ec83c9e8dc586c539e4.17125858… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- include/net/addrconf.h | 4 ++++ net/ipv6/addrconf.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 9583d3bbab03..10d270f004f0 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -443,6 +443,10 @@ static inline void in6_ifa_hold(struct inet6_ifaddr *ifp) refcount_inc(&ifp->refcnt); } +static inline bool in6_ifa_hold_safe(struct inet6_ifaddr *ifp) +{ + return refcount_inc_not_zero(&ifp->refcnt); +} /* * compute link-local solicited-node multicast address diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index d08d6822fb65..6c76c0c5b971 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1954,9 +1954,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add if (ipv6_addr_equal(&ifp->addr, addr)) { if (!dev || ifp->idev->dev == dev || !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) { - result = ifp; - in6_ifa_hold(ifp); - break; + if (in6_ifa_hold_safe(ifp)) { + result = ifp; + break; + } } } } -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/7] Patch series "mm: memcg: subtree stats flushing and thresholds" and bugfix
by Lu Jialin 24 May '24

24 May '24

v2->v1: add bugifx for "mm: memcg: restore subtree stats flushing" Lu Jialin (1): memcg/kabi: reserve space for memcg_vmstats_percpu related structures Yosry Ahmed (6): mm: memcg: change flush_next_time to flush_last_time mm: memcg: move vmstats structs definition above flushing code mm: memcg: make stats flushing threshold per-memcg mm: workingset: move the stats flush into workingset_test_recent() mm: memcg: restore subtree stats flushing mm: memcg: optimize parent iteration in memcg_rstat_updated() include/linux/memcontrol.h | 8 +- mm/memcontrol.c | 289 +++++++++++++++++++++---------------- mm/vmscan.c | 2 +- mm/workingset.c | 42 ++++-- 4 files changed, 201 insertions(+), 140 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6] openeuler_defconfig: Modify openeuler-defconfig
by Peng Zhang 24 May '24

24 May '24

From: yanze <lyz25354840(a)gmail.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9RNUT ------------------------------------------------------- The minimum set of kconfig configuartion items is different from that defined by the openEuler community. For details about the modification and reason, see the issue. arm64: CONFIG_PVPANIC=y CONFIG_PVPANIC_MMIO=m x86: CONFIG_RESET_CONTROLLER=y CONFIG_PVPANIC_MMIO=m CONFIG_SATA_ZHAOXIN=y Signed-off-by: yanze <lyz25354840(a)gmail.com> --- arch/arm64/configs/openeuler_defconfig | 4 +++- arch/x86/configs/openeuler_defconfig | 8 +++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 3b8d78f944a0..4b258aa204d5 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2483,7 +2483,9 @@ CONFIG_ALTERA_STAPL=m CONFIG_MISC_RTSX_PCI=m CONFIG_MISC_RTSX_USB=m CONFIG_UACCE=m -# CONFIG_PVPANIC is not set +CONFIG_PVPANIC=y +CONFIG_PVPANIC_MMIO=m +# CONFIG_PVPANIC_PCI is not set # CONFIG_GP_PCI1XXXX is not set # end of Misc devices diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..ec2284ca3b58 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2463,7 +2463,7 @@ CONFIG_MISC_RTSX_PCI=m CONFIG_MISC_RTSX_USB=m CONFIG_UACCE=m CONFIG_PVPANIC=y -# CONFIG_PVPANIC_MMIO is not set +CONFIG_PVPANIC_MMIO=m # CONFIG_PVPANIC_PCI is not set # CONFIG_GP_PCI1XXXX is not set # end of Misc devices @@ -2630,7 +2630,7 @@ CONFIG_ATA_PIIX=m # CONFIG_SATA_ULI is not set # CONFIG_SATA_VIA is not set # CONFIG_SATA_VITESSE is not set -CONFIG_SATA_ZHAOXIN=m +CONFIG_SATA_ZHAOXIN=y # # PATA SFF controllers with BMDMA @@ -7978,7 +7978,9 @@ CONFIG_PWM_LPSS_PLATFORM=m # end of IRQ chip support # CONFIG_IPACK_BUS is not set -# CONFIG_RESET_CONTROLLER is not set +CONFIG_RESET_CONTROLLER=y +# CONFIG_RESET_TI_SYSCON is not set +# CONFIG_RESET_TI_TPS380X is not set # # PHY Subsystem -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] scsi: megaraid_sas: Fix resource leak in case of probe failure
by Luo Gengkun 24 May '24

24 May '24

From: Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> mainline inclusion from mainline-v5.14-rc1 commit b5438f48fdd8e1c3f130d32637511efd32038152 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RQ71 CVE: CVE-2021-47329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe. Clean up all those resources. Link: https://lore.kernel.org/r/20210528131307.25683-3-chandrakanth.patil@broadco… Signed-off-by: Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> Signed-off-by: Sumit Saxena <sumit.saxena(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> --- drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++++++++++ drivers/scsi/megaraid/megaraid_sas_fusion.c | 1 + 2 files changed, 14 insertions(+) diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c index 3f0752dc8ab5..95e0e39e7f82 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -6620,11 +6620,16 @@ static int megasas_probe_one(struct pci_dev *pdev, return 0; fail_start_aen: + instance->unload = 1; + scsi_remove_host(instance->host); fail_io_attach: megasas_mgmt_info.count--; megasas_mgmt_info.max_index--; megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL; + if (instance->requestorId && !instance->skip_heartbeat_timer_del) + del_timer_sync(&instance->sriov_heartbeat_timer); + instance->instancet->disable_intr(instance); megasas_destroy_irqs(instance); @@ -6632,8 +6637,16 @@ static int megasas_probe_one(struct pci_dev *pdev, megasas_release_fusion(instance); else megasas_release_mfi(instance); + if (instance->msix_vectors) pci_free_irq_vectors(instance->pdev); + instance->msix_vectors = 0; + + if (instance->fw_crash_state != UNAVAILABLE) + megasas_free_host_crash_buffer(instance); + + if (instance->adapter_type != MFI_SERIES) + megasas_fusion_stop_watchdog(instance); fail_init_mfi: scsi_host_put(host); fail_alloc_instance: diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c index f45c54f02bfa..9d4941cb961b 100644 --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c @@ -4857,6 +4857,7 @@ megasas_alloc_fusion_context(struct megasas_instance *instance) if (!fusion->log_to_span) { dev_err(&instance->pdev->dev, "Failed from %s %d\n", __func__, __LINE__); + kfree(instance->ctrl_context); return -ENOMEM; } } -- 2.34.1

2 1

[openeuler:OLK-6.6 9687/9759] drivers/crypto/ccp/hygon/csv-dev.c:32:6: warning: no previous prototype for function 'csv_update_api_version'
by kernel test robot 24 May '24

24 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c564f68dbcd17a532bedbcd78ee4a0b3a2853a84 commit: c73088c4bfaa46261a59e5879143688fb540d53b [9687/9759] crypto: ccp: Print Hygon CSV API version when CSV support is detected config: x86_64-randconfig-003-20240524 (https://download.01.org/0day-ci/archive/20240524/202405240829.xBq9c5jO-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240524/202405240829.xBq9c5jO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405240829.xBq9c5jO-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/csv-dev.c:32:6: warning: no previous prototype for function 'csv_update_api_version' [-Wmissing-prototypes] 32 | void csv_update_api_version(struct sev_user_data_status *status) | ^ drivers/crypto/ccp/hygon/csv-dev.c:32:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 32 | void csv_update_api_version(struct sev_user_data_status *status) | ^ | static drivers/crypto/ccp/hygon/csv-dev.c:40:5: warning: no previous prototype for function 'csv_cmd_buffer_len' [-Wmissing-prototypes] 40 | int csv_cmd_buffer_len(int cmd) | ^ drivers/crypto/ccp/hygon/csv-dev.c:40:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 40 | int csv_cmd_buffer_len(int cmd) | ^ | static 2 warnings generated. vim +/csv_update_api_version +32 drivers/crypto/ccp/hygon/csv-dev.c 26 27 /* 28 * csv_update_api_version used to update the api version of HYGON CSV 29 * firmwareat driver side. 30 * Currently, we only need to update @hygon_csv_build. 31 */ > 32 void csv_update_api_version(struct sev_user_data_status *status) 33 { 34 if (status) { 35 hygon_csv_build = (status->flags >> 9) | 36 ((u32)status->build << 23); 37 } 38 } 39 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 0d9d0b0a2098815d3c3d6dd0b357f79f90673f76
by kernel test robot 24 May '24

24 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0d9d0b0a2098815d3c3d6dd0b357f79f90673f76 !7733 backport some bugfix of HiSilicon PCIe PMU driver Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 742m configs tested: 35 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240524 clang arm64 randconfig-002-20240524 clang arm64 randconfig-003-20240524 gcc arm64 randconfig-004-20240524 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240524 gcc x86_64 buildonly-randconfig-002-20240524 gcc x86_64 buildonly-randconfig-003-20240524 clang x86_64 buildonly-randconfig-004-20240524 gcc x86_64 buildonly-randconfig-005-20240524 gcc x86_64 buildonly-randconfig-006-20240524 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240524 gcc x86_64 randconfig-002-20240524 clang x86_64 randconfig-003-20240524 clang x86_64 randconfig-004-20240524 clang x86_64 randconfig-005-20240524 clang x86_64 randconfig-006-20240524 gcc x86_64 randconfig-011-20240524 gcc x86_64 randconfig-012-20240524 clang x86_64 randconfig-013-20240524 clang x86_64 randconfig-014-20240524 gcc x86_64 randconfig-015-20240524 gcc x86_64 randconfig-016-20240524 clang x86_64 randconfig-071-20240524 gcc x86_64 randconfig-072-20240524 clang x86_64 randconfig-073-20240524 gcc x86_64 randconfig-074-20240524 gcc x86_64 randconfig-075-20240524 clang x86_64 randconfig-076-20240524 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING bcfa0f0eaaa58a3d5bc06386ca698a1eabce086a
by kernel test robot 24 May '24

24 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bcfa0f0eaaa58a3d5bc06386ca698a1eabce086a !7854 net/mlx5e: fix a double-free in arfs_create_groups Warning: (recently discovered and may have been fixed) drivers/spi/spi-phytium-plat.c:186:34: warning: unused variable 'phytium_spi_of_match' [-Wunused-const-variable] mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] Unverified Warning (likely false positive, please contact us if interested): drivers/block/loop.c:1338 loop_set_status() warn: inconsistent returns '&loop_ctl_mutex'. Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-buildonly-randconfig-002-20240524 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-003-20240524 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-005-20240420 | |-- drivers-spi-spi-phytium-plat.c:warning:unused-variable-phytium_spi_of_match | |-- mm-debug.c:warning:format-specifies-type-int-but-the-argument-has-type-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-unsigned-long-but-the-argument-has-type-const-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-void-but-the-argument-has-type-int | `-- mm-debug.c:warning:more-conversions-than-data-arguments `-- x86_64-randconfig-161-20240430 `-- drivers-block-loop.c-loop_set_status()-warn:inconsistent-returns-loop_ctl_mutex-. elapsed time: 740m configs tested: 20 configs skipped: 103 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240524 gcc x86_64 buildonly-randconfig-002-20240524 gcc x86_64 buildonly-randconfig-003-20240524 clang x86_64 buildonly-randconfig-004-20240524 gcc x86_64 buildonly-randconfig-005-20240524 gcc x86_64 buildonly-randconfig-006-20240524 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240524 gcc x86_64 randconfig-002-20240524 clang x86_64 randconfig-003-20240524 clang x86_64 randconfig-004-20240524 clang x86_64 randconfig-005-20240524 clang x86_64 randconfig-006-20240524 gcc x86_64 randconfig-011-20240524 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7548/9759] drivers/usb/host/xhci.h:2306:17: warning: null destination pointer
by kernel test robot 24 May '24

24 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c564f68dbcd17a532bedbcd78ee4a0b3a2853a84 commit: 1119ec49ac4ac643e6d7c9a5a834040aef87612e [7548/9759] mm, fs: Add BPF_READAHEAD build option for bpf readhead config: arm64-randconfig-003-20240524 (https://download.01.org/0day-ci/archive/20240524/202405240401.vDimp7ud-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240524/202405240401.vDimp7ud-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405240401.vDimp7ud-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/usb/host/xhci-trace.h:25, from drivers/usb/host/xhci-trace.c:12: In function 'xhci_decode_trb', inlined from 'trace_raw_output_xhci_log_trb' at drivers/usb/host/./xhci-trace.h:110:1: >> drivers/usb/host/xhci.h:2306:17: warning: null destination pointer [-Wformat-truncation=] 2306 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2307 | "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2308 | field1, field0, | ~~~~~~~~~~~~~~~ 2309 | xhci_trb_comp_code_string(GET_COMP_CODE(field2)), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2310 | EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2311 | /* Macro decrements 1, maybe it shouldn't?!? */ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2312 | TRB_TO_EP_INDEX(field3) + 1, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2313 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2314 | field3 & EVENT_DATA ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2315 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2486:17: warning: null destination pointer [-Wformat-truncation=] 2486 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2487 | "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2488 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2489 | field2, field1, field0 & 0xffffffe0, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2490 | TRB_TO_PACKET_TYPE(field0), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2491 | TRB_TO_ROOTHUB_PORT(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2492 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2477:17: warning: null destination pointer [-Wformat-truncation=] 2477 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2478 | "%s: ctx %08x%08x slot %d speed %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2479 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2480 | field1, field0, | ~~~~~~~~~~~~~~~ 2481 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ 2482 | TRB_TO_DEV_SPEED(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2483 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2470:17: warning: null destination pointer [-Wformat-truncation=] 2470 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2471 | "%s: belt %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~ 2472 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2473 | TRB_TO_BELT(field3), | ~~~~~~~~~~~~~~~~~~~~ 2474 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2461:17: warning: null destination pointer [-Wformat-truncation=] 2461 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2462 | "%s: event %08x%08x vf intr %d vf id %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2463 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2464 | field1, field0, | ~~~~~~~~~~~~~~~ 2465 | TRB_TO_VF_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2466 | TRB_TO_VF_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~ 2467 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2454:17: warning: null destination pointer [-Wformat-truncation=] 2454 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2455 | "%s: slot %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~ 2456 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2457 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ 2458 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2443:17: warning: null destination pointer [-Wformat-truncation=] 2443 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2444 | "%s: deq %08x%08x stream %d slot %d ep %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2445 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2446 | field1, field0, | ~~~~~~~~~~~~~~~ 2447 | TRB_TO_STREAM_ID(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2448 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ -- | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2359 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2337:17: warning: null destination pointer [-Wformat-truncation=] 2337 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2338 | "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2339 | field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2340 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2341 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2342 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2343 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2344 | field3 & TRB_CHAIN ? 'C' : 'c', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2345 | field3 & TRB_NO_SNOOP ? 'S' : 's', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2346 | field3 & TRB_ISP ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2347 | field3 & TRB_ENT ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2348 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2319:17: warning: null destination pointer [-Wformat-truncation=] 2319 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2320 | "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2321 | field0 & 0xff, | ~~~~~~~~~~~~~~ 2322 | (field0 & 0xff00) >> 8, | ~~~~~~~~~~~~~~~~~~~~~~~ 2323 | (field0 & 0xff000000) >> 24, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2324 | (field0 & 0xff0000) >> 16, | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 2325 | (field1 & 0xff00) >> 8, | ~~~~~~~~~~~~~~~~~~~~~~~ 2326 | field1 & 0xff, | ~~~~~~~~~~~~~~ 2327 | (field1 & 0xff000000) >> 16 | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2328 | (field1 & 0xff0000) >> 16, | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 2329 | TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2330 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2331 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2332 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2333 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2334 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2365:17: warning: null destination pointer [-Wformat-truncation=] 2365 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2366 | "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2367 | field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2368 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2369 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2370 | field3 & TRB_BEI ? 'B' : 'b', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2371 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2372 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2373 | field3 & TRB_CHAIN ? 'C' : 'c', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2374 | field3 & TRB_NO_SNOOP ? 'S' : 's', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2375 | field3 & TRB_ISP ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2376 | field3 & TRB_ENT ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2377 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2495:17: warning: null destination pointer [-Wformat-truncation=] 2495 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2496 | "type '%s' -> raw %08x %08x %08x %08x", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2497 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2498 | field0, field1, field2, field3); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/trace/define_trace.h:102, from drivers/usb/host/xhci-trace.h:622: drivers/usb/host/./xhci-trace.h: In function 'trace_raw_output_xhci_log_trb': >> drivers/usb/host/./xhci-trace.h:127:19: warning: '%s' directive argument is null [-Wformat-overflow=] 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~~~~~~~ include/trace/trace_events.h:203:34: note: in definition of macro 'DECLARE_EVENT_CLASS' 203 | trace_event_printf(iter, print); \ | ^~~~~ drivers/usb/host/./xhci-trace.h:127:9: note: in expansion of macro 'TP_printk' 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~~~~~~~~ In file included from include/trace/trace_events.h:237: drivers/usb/host/./xhci-trace.h:127:24: note: format string is defined here 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~ In function 'xhci_decode_ep_context', inlined from 'trace_raw_output_xhci_log_ep_ctx' at drivers/usb/host/./xhci-trace.h:312:1: >> drivers/usb/host/xhci.h:2801:15: warning: argument 1 null where non-null expected [-Wnonnull] 2801 | ret = sprintf(str, "State %s mult %d max P. Streams %d %s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2802 | xhci_ep_state_string(ep_state), mult, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2803 | max_pstr, lsa ? "LSA " : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/kernel.h:32, from include/linux/cpumask.h:10, from include/linux/smp.h:13, from include/linux/tracepoint.h:15, from drivers/usb/host/xhci-trace.h:24: include/linux/sprintf.h: In function 'trace_raw_output_xhci_log_ep_ctx': include/linux/sprintf.h:10:20: note: in a call to function 'sprintf' declared 'nonnull' 10 | __printf(2, 3) int sprintf(char *buf, const char * fmt, ...); | ^~~~~~~ In function 'xhci_decode_ep_context', inlined from 'trace_raw_output_xhci_log_ep_ctx' at drivers/usb/host/./xhci-trace.h:312:1: drivers/usb/host/xhci.h:2801:15: warning: null destination pointer [-Wformat-overflow=] 2801 | ret = sprintf(str, "State %s mult %d max P. Streams %d %s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2802 | xhci_ep_state_string(ep_state), mult, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2803 | max_pstr, lsa ? "LSA " : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/./xhci-trace.h: In function 'trace_raw_output_xhci_log_ep_ctx': drivers/usb/host/./xhci-trace.h:327:19: warning: '%s' directive argument is null [-Wformat-overflow=] 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~~~ include/trace/trace_events.h:203:34: note: in definition of macro 'DECLARE_EVENT_CLASS' 203 | trace_event_printf(iter, print); \ | ^~~~~ drivers/usb/host/./xhci-trace.h:327:9: note: in expansion of macro 'TP_printk' 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~~~~~~~~ drivers/usb/host/./xhci-trace.h:327:20: note: format string is defined here 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~ In function 'xhci_decode_slot_context', inlined from 'trace_raw_output_xhci_log_slot_ctx' at drivers/usb/host/./xhci-trace.h:357:1: drivers/usb/host/xhci.h:2546:15: warning: argument 1 null where non-null expected [-Wnonnull] 2546 | ret = sprintf(str, "RS %05x %s%s%s Ctx Entries %d MEL %d us Port# %d/%d", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2547 | info & ROUTE_STRING_MASK, | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2548 | ({ char *s; | ~~~~~~~~~~~ 2549 | switch (speed) { | ~~~~~~~~~~~~~~~~ 2550 | case SLOT_SPEED_FS: | ~~~~~~~~~~~~~~~~~~~ 2551 | s = "full-speed"; | ~~~~~~~~~~~~~~~~~ 2552 | break; | ~~~~~~ 2553 | case SLOT_SPEED_LS: | ~~~~~~~~~~~~~~~~~~~ 2554 | s = "low-speed"; | ~~~~~~~~~~~~~~~~ 2555 | break; | ~~~~~~ 2556 | case SLOT_SPEED_HS: | ~~~~~~~~~~~~~~~~~~~ 2557 | s = "high-speed"; | ~~~~~~~~~~~~~~~~~ 2558 | break; | ~~~~~~ 2559 | case SLOT_SPEED_SS: | ~~~~~~~~~~~~~~~~~~~ 2560 | s = "super-speed"; | ~~~~~~~~~~~~~~~~~~ 2561 | break; | ~~~~~~ 2562 | case SLOT_SPEED_SSP: | ~~~~~~~~~~~~~~~~~~~~ 2563 | s = "super-speed plus"; | ~~~~~~~~~~~~~~~~~~~~~~~ 2564 | break; | ~~~~~~ 2565 | default: | ~~~~~~~~ 2566 | s = "UNKNOWN speed"; | ~~~~~~~~~~~~~~~~~~~~ 2567 | } s; }), | ~~~~~~~~ 2568 | mtt ? " multi-TT" : "", | ~~~~~~~~~~~~~~~~~~~~~~~ 2569 | hub ? " Hub" : "", | ~~~~~~~~~~~~~~~~~~ 2570 | (info & LAST_CTX_MASK) >> 27, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2571 | info2 & MAX_EXIT, | ~~~~~~~~~~~~~~~~~ 2572 | DEVINFO_TO_ROOT_HUB_PORT(info2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2573 | DEVINFO_TO_MAX_PORTS(info2)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/sprintf.h: In function 'trace_raw_output_xhci_log_slot_ctx': include/linux/sprintf.h:10:20: note: in a call to function 'sprintf' declared 'nonnull' 10 | __printf(2, 3) int sprintf(char *buf, const char * fmt, ...); | ^~~~~~~ vim +2306 drivers/usb/host/xhci.h 52407729fbeabb Felipe Balbi 2017-04-07 2281 cbf286e8ef8337 Mathias Nyman 2021-08-20 2282 static inline const char *xhci_decode_trb(char *str, size_t size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2283 u32 field0, u32 field1, u32 field2, u32 field3) a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2284 { a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2285 int type = TRB_FIELD_TO_TYPE(field3); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2286 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2287 switch (type) { a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2288 case TRB_LINK: cbf286e8ef8337 Mathias Nyman 2021-08-20 2289 snprintf(str, size, 96d9a6eb97d77d Lu Baolu 2017-04-07 2290 "LINK %08x%08x intr %d type '%s' flags %c:%c:%c:%c", 96d9a6eb97d77d Lu Baolu 2017-04-07 2291 field1, field0, GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2292 xhci_trb_type_string(type), 96d9a6eb97d77d Lu Baolu 2017-04-07 2293 field3 & TRB_IOC ? 'I' : 'i', 96d9a6eb97d77d Lu Baolu 2017-04-07 2294 field3 & TRB_CHAIN ? 'C' : 'c', 96d9a6eb97d77d Lu Baolu 2017-04-07 2295 field3 & TRB_TC ? 'T' : 't', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2296 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2297 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2298 case TRB_TRANSFER: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2299 case TRB_COMPLETION: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2300 case TRB_PORT_STATUS: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2301 case TRB_BANDWIDTH_EVENT: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2302 case TRB_DOORBELL: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2303 case TRB_HC_EVENT: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2304 case TRB_DEV_NOTE: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2305 case TRB_MFINDEX_WRAP: cbf286e8ef8337 Mathias Nyman 2021-08-20 @2306 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2307 "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2308 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2309 xhci_trb_comp_code_string(GET_COMP_CODE(field2)), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2310 EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2311 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2312 TRB_TO_EP_INDEX(field3) + 1, d2561626b9d126 Lu Baolu 2017-04-07 2313 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2314 field3 & EVENT_DATA ? 'E' : 'e', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2315 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2316 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2317 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2318 case TRB_SETUP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2319 snprintf(str, size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2320 "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2321 field0 & 0xff, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2322 (field0 & 0xff00) >> 8, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2323 (field0 & 0xff000000) >> 24, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2324 (field0 & 0xff0000) >> 16, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2325 (field1 & 0xff00) >> 8, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2326 field1 & 0xff, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2327 (field1 & 0xff000000) >> 16 | a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2328 (field1 & 0xff0000) >> 16, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2329 TRB_LEN(field2), GET_TD_SIZE(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2330 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2331 xhci_trb_type_string(type), 5d062aba0d399c Felipe Balbi 2017-04-07 2332 field3 & TRB_IDT ? 'I' : 'i', 5d062aba0d399c Felipe Balbi 2017-04-07 2333 field3 & TRB_IOC ? 'I' : 'i', 5d062aba0d399c Felipe Balbi 2017-04-07 2334 field3 & TRB_CYCLE ? 'C' : 'c'); 5d062aba0d399c Felipe Balbi 2017-04-07 2335 break; 5d062aba0d399c Felipe Balbi 2017-04-07 2336 case TRB_DATA: cbf286e8ef8337 Mathias Nyman 2021-08-20 2337 snprintf(str, size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2338 "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", 5d062aba0d399c Felipe Balbi 2017-04-07 2339 field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), 5d062aba0d399c Felipe Balbi 2017-04-07 2340 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2341 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2342 field3 & TRB_IDT ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2343 field3 & TRB_IOC ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2344 field3 & TRB_CHAIN ? 'C' : 'c', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2345 field3 & TRB_NO_SNOOP ? 'S' : 's', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2346 field3 & TRB_ISP ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2347 field3 & TRB_ENT ? 'E' : 'e', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2348 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2349 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2350 case TRB_STATUS: cbf286e8ef8337 Mathias Nyman 2021-08-20 2351 snprintf(str, size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2352 "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", 5d062aba0d399c Felipe Balbi 2017-04-07 2353 field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), 5d062aba0d399c Felipe Balbi 2017-04-07 2354 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2355 xhci_trb_type_string(type), 5d062aba0d399c Felipe Balbi 2017-04-07 2356 field3 & TRB_IOC ? 'I' : 'i', 5d062aba0d399c Felipe Balbi 2017-04-07 2357 field3 & TRB_CHAIN ? 'C' : 'c', 5d062aba0d399c Felipe Balbi 2017-04-07 2358 field3 & TRB_ENT ? 'E' : 'e', 5d062aba0d399c Felipe Balbi 2017-04-07 2359 field3 & TRB_CYCLE ? 'C' : 'c'); 5d062aba0d399c Felipe Balbi 2017-04-07 2360 break; 5d062aba0d399c Felipe Balbi 2017-04-07 2361 case TRB_NORMAL: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2362 case TRB_ISOC: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2363 case TRB_EVENT_DATA: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2364 case TRB_TR_NOOP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2365 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2366 "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2367 field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2368 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2369 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2370 field3 & TRB_BEI ? 'B' : 'b', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2371 field3 & TRB_IDT ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2372 field3 & TRB_IOC ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2373 field3 & TRB_CHAIN ? 'C' : 'c', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2374 field3 & TRB_NO_SNOOP ? 'S' : 's', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2375 field3 & TRB_ISP ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2376 field3 & TRB_ENT ? 'E' : 'e', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2377 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2378 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2379 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2380 case TRB_CMD_NOOP: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2381 case TRB_ENABLE_SLOT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2382 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2383 "%s: flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2384 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2385 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2386 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2387 case TRB_DISABLE_SLOT: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2388 case TRB_NEG_BANDWIDTH: cbf286e8ef8337 Mathias Nyman 2021-08-20 2389 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2390 "%s: slot %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2391 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2392 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2393 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2394 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2395 case TRB_ADDR_DEV: cbf286e8ef8337 Mathias Nyman 2021-08-20 2396 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2397 "%s: ctx %08x%08x slot %d flags %c:%c", d2561626b9d126 Lu Baolu 2017-04-07 2398 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2399 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2400 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2401 field3 & TRB_BSR ? 'B' : 'b', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2402 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2403 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2404 case TRB_CONFIG_EP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2405 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2406 "%s: ctx %08x%08x slot %d flags %c:%c", d2561626b9d126 Lu Baolu 2017-04-07 2407 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2408 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2409 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2410 field3 & TRB_DC ? 'D' : 'd', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2411 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2412 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2413 case TRB_EVAL_CONTEXT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2414 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2415 "%s: ctx %08x%08x slot %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2416 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2417 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2418 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2419 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2420 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2421 case TRB_RESET_EP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2422 snprintf(str, size, 8a62dff2c0734a Mathias Nyman 2019-08-30 2423 "%s: ctx %08x%08x slot %d ep %d flags %c:%c", d2561626b9d126 Lu Baolu 2017-04-07 2424 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2425 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2426 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2427 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2428 TRB_TO_EP_INDEX(field3) + 1, 8a62dff2c0734a Mathias Nyman 2019-08-30 2429 field3 & TRB_TSP ? 'T' : 't', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2430 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2431 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2432 case TRB_STOP_RING: 1ce69c35b86038 Sergey Shtylyov 2022-06-30 2433 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2434 "%s: slot %d sp %d ep %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2435 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2436 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2437 TRB_TO_SUSPEND_PORT(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2438 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2439 TRB_TO_EP_INDEX(field3) + 1, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2440 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2441 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2442 case TRB_SET_DEQ: cbf286e8ef8337 Mathias Nyman 2021-08-20 2443 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2444 "%s: deq %08x%08x stream %d slot %d ep %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2445 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2446 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2447 TRB_TO_STREAM_ID(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2448 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2449 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2450 TRB_TO_EP_INDEX(field3) + 1, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2451 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2452 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2453 case TRB_RESET_DEV: cbf286e8ef8337 Mathias Nyman 2021-08-20 2454 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2455 "%s: slot %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2456 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2457 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2458 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2459 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2460 case TRB_FORCE_EVENT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2461 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2462 "%s: event %08x%08x vf intr %d vf id %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2463 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2464 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2465 TRB_TO_VF_INTR_TARGET(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2466 TRB_TO_VF_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2467 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2468 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2469 case TRB_SET_LT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2470 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2471 "%s: belt %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2472 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2473 TRB_TO_BELT(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2474 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2475 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2476 case TRB_GET_BW: cbf286e8ef8337 Mathias Nyman 2021-08-20 2477 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2478 "%s: ctx %08x%08x slot %d speed %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2479 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2480 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2481 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2482 TRB_TO_DEV_SPEED(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2483 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2484 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2485 case TRB_FORCE_HEADER: cbf286e8ef8337 Mathias Nyman 2021-08-20 2486 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2487 "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2488 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2489 field2, field1, field0 & 0xffffffe0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2490 TRB_TO_PACKET_TYPE(field0), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2491 TRB_TO_ROOTHUB_PORT(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2492 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2493 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2494 default: cbf286e8ef8337 Mathias Nyman 2021-08-20 2495 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2496 "type '%s' -> raw %08x %08x %08x %08x", d2561626b9d126 Lu Baolu 2017-04-07 2497 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2498 field0, field1, field2, field3); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2499 } a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2500 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2501 return str; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2502 } a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2503 :::::: The code at line 2306 was first introduced by commit :::::: cbf286e8ef8337308c259ff5b9ce2e74d403be5a xhci: fix unsafe memory usage in xhci tracing :::::: TO: Mathias Nyman <mathias.nyman(a)linux.intel.com> :::::: CC: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION c564f68dbcd17a532bedbcd78ee4a0b3a2853a84
by kernel test robot 24 May '24

24 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c564f68dbcd17a532bedbcd78ee4a0b3a2853a84 !7730 v2 sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-004-20240524 | `-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) `-- loongarch-randconfig-001-20240524 `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) clang_recent_errors `-- arm64-allmodconfig |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box `-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create elapsed time: 722m configs tested: 16 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240524 clang arm64 randconfig-002-20240524 clang arm64 randconfig-003-20240524 gcc arm64 randconfig-004-20240524 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240524 gcc loongarch randconfig-002-20240524 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] virtio_ring : keep used_wrap_counter in
by Zheng Zengkai 23 May '24

23 May '24

Backport 5.19-rc5 patch to fix kernel panic caused by netperf/iperf3 test. huangjie.albert (1): virtio_ring : keep used_wrap_counter in vq->last_used_idx drivers/virtio/virtio_ring.c | 76 +++++++++++++++++++++++------------- 1 file changed, 48 insertions(+), 28 deletions(-) -- 2.20.1

2 2

[PATCH v3 OLK-6.6] Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
by liwei 23 May '24

23 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8XMTL CVE: NA ------------------------------------------------------------------ This reverts commit 2eb3daf61b18d620b0624e31ad44ac1c76d94075. To keep CONFIG unchanged, modify ACPI_HOTPLUG_PRESENT_CPU to ACPI_HOTPLUG_CPU. Conflicts: arch/x86/Kconfig drivers/acpi/acpi_processor.c include/linux/acpi.h Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/loongarch/Kconfig | 2 +- arch/loongarch/kernel/acpi.c | 4 ++-- arch/x86/Kconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- arch/x86/kernel/acpi/boot.c | 4 ++-- drivers/acpi/Kconfig | 6 +++--- drivers/acpi/acpi_processor.c | 4 ++-- drivers/acpi/bus.c | 2 +- include/linux/acpi.h | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index edbbf03d29d9..58da6e03ecb5 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -5,7 +5,7 @@ config LOONGARCH select ACPI select ACPI_GENERIC_GSI if ACPI select ACPI_MCFG if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_PPTT if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI select ARCH_BINFMT_ELF_STATE diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c index f453271e6add..58819b017ba8 100644 --- a/arch/loongarch/kernel/acpi.c +++ b/arch/loongarch/kernel/acpi.c @@ -291,7 +291,7 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size) memblock_reserve(addr, size); } -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> @@ -343,4 +343,4 @@ int acpi_unmap_cpu(int cpu) } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 6cfa82a633a6..0ac76a2637f8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -60,7 +60,7 @@ config X86 # select ACPI_LEGACY_TABLES_LOOKUP if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_HOTPLUG_IGNORE_OSC if ACPI && HOTPLUG_CPU select ARCH_32BIT_OFF_T if X86_32 select ARCH_CLOCKSOURCE_INIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..1c1fb626ae9e 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -609,7 +609,7 @@ CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_PRESENT_CPU=y +CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_HOTPLUG_IGNORE_OSC=y CONFIG_ACPI_PROCESSOR_AGGREGATOR=m CONFIG_ACPI_THERMAL=y diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 8202bd2d957d..c55c0ef47a18 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -817,7 +817,7 @@ static void __init acpi_set_irq_model_ioapic(void) /* * ACPI based hotplug support for CPU */ -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid) @@ -866,7 +866,7 @@ int acpi_unmap_cpu(int cpu) return (0); } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base) { diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig index c49978b4b11f..c4746869d67b 100644 --- a/drivers/acpi/Kconfig +++ b/drivers/acpi/Kconfig @@ -305,14 +305,14 @@ config ACPI_IPMI To compile this driver as a module, choose M here: the module will be called as acpi_ipmi. -config ACPI_HOTPLUG_PRESENT_CPU +config ACPI_HOTPLUG_CPU bool depends on ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_CONTAINER config ACPI_HOTPLUG_IGNORE_OSC bool - depends on ACPI_HOTPLUG_PRESENT_CPU + depends on ACPI_HOTPLUG_CPU help Ignore whether firmware acknowledged support for toggling the CPU present bit in _STA. Some architectures predate the _OSC bits, so @@ -408,7 +408,7 @@ config ACPI_PCI_SLOT config ACPI_CONTAINER bool "Container and Module Devices" - default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_PRESENT_CPU) + default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_CPU) help This driver supports ACPI Container and Module devices (IDs ACPI0004, PNP0A05, and PNP0A06). diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c index 5bb207a7a1dd..0ff69af46a50 100644 --- a/drivers/acpi/acpi_processor.c +++ b/drivers/acpi/acpi_processor.c @@ -184,7 +184,7 @@ static void __init acpi_pcc_cpufreq_init(void) {} static bool acpi_processor_hotplug_present_supported(void) { - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) return false; /* x86 systems pre-date the _OSC bit */ @@ -502,7 +502,7 @@ static void acpi_processor_make_not_present(struct acpi_device *device) { struct acpi_processor *pr; - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) { + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) { pr_err_once("Changing CPU present bit is not supported"); return; } diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index b42f17bfbb09..0d2e1de143ef 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -355,7 +355,7 @@ static void acpi_bus_osc_negotiate_platform_control(void) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_APEI_SUPPORT; capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_ENABLED_SUPPORT; - if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_PRESENT_SUPPORT; if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle))) diff --git a/include/linux/acpi.h b/include/linux/acpi.h index a0e96f6e2de2..cc84f370620f 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -651,7 +651,7 @@ static inline u32 acpi_osc_ctx_get_cxl_control(struct acpi_osc_context *context) #define ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS 0x0000000F /* Enable _OST when all relevant hotplug operations are enabled */ -#if defined(CONFIG_ACPI_HOTPLUG_PRESENT_CPU) && \ +#if defined(CONFIG_ACPI_HOTPLUG_CPU) && \ defined(CONFIG_ACPI_HOTPLUG_MEMORY) && \ defined(CONFIG_ACPI_CONTAINER) #define ACPI_HOTPLUG_OST -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
by Ye Bin 23 May '24

23 May '24

From: Chao Yu <yuchao0(a)huawei.com> mainline inclusion from mainline-v5.14-rc1 commit cad83c968c2ebe97905f900326988ed37146c347 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RLZ0 CVE: CVE-2021-47335 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As syzbot reported, there is an use-after-free issue during f2fs recovery: Use-after-free write at 0xffff88823bc16040 (in kfence-#10): kmem_cache_destroy+0x1f/0x120 mm/slab_common.c:486 f2fs_recover_fsync_data+0x75b0/0x8380 fs/f2fs/recovery.c:869 f2fs_fill_super+0x9393/0xa420 fs/f2fs/super.c:3945 mount_bdev+0x26c/0x3a0 fs/super.c:1367 legacy_get_tree+0xea/0x180 fs/fs_context.c:592 vfs_get_tree+0x86/0x270 fs/super.c:1497 do_new_mount fs/namespace.c:2905 [inline] path_mount+0x196f/0x2be0 fs/namespace.c:3235 do_mount fs/namespace.c:3248 [inline] __do_sys_mount fs/namespace.c:3456 [inline] __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3433 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is multi f2fs filesystem instances can race on accessing global fsync_entry_slab pointer, result in use-after-free issue of slab cache, fixes to init/destroy this slab cache only once during module init/destroy procedure to avoid this issue. Reported-by: syzbot+9d90dad32dd9727ed084(a)syzkaller.appspotmail.com Signed-off-by: Chao Yu <yuchao0(a)huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Conflicts: fs/f2fs/recovery.c fs/f2fs/super.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- fs/f2fs/f2fs.h | 2 ++ fs/f2fs/recovery.c | 23 ++++++++++++++--------- fs/f2fs/super.c | 8 +++++++- 3 files changed, 23 insertions(+), 10 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 8cbc9da523dc..5627e02493c7 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -3095,6 +3095,8 @@ void f2fs_build_gc_manager(struct f2fs_sb_info *sbi); */ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only); bool f2fs_space_for_roll_forward(struct f2fs_sb_info *sbi); +int __init f2fs_create_recovery_cache(void); +void f2fs_destroy_recovery_cache(void); /* * debug.c diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c index 733f005b85d6..40afb6a213d8 100644 --- a/fs/f2fs/recovery.c +++ b/fs/f2fs/recovery.c @@ -683,13 +683,6 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only) quota_enabled = f2fs_enable_quota_files(sbi, s_flags & SB_RDONLY); #endif - fsync_entry_slab = f2fs_kmem_cache_create("f2fs_fsync_inode_entry", - sizeof(struct fsync_inode_entry)); - if (!fsync_entry_slab) { - err = -ENOMEM; - goto out; - } - INIT_LIST_HEAD(&inode_list); INIT_LIST_HEAD(&tmp_inode_list); INIT_LIST_HEAD(&dir_list); @@ -747,8 +740,6 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only) } } - kmem_cache_destroy(fsync_entry_slab); -out: #ifdef CONFIG_QUOTA /* Turn quotas off */ if (quota_enabled) @@ -758,3 +749,17 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only) return ret ? ret: err; } + +int __init f2fs_create_recovery_cache(void) +{ + fsync_entry_slab = f2fs_kmem_cache_create("f2fs_fsync_inode_entry", + sizeof(struct fsync_inode_entry)); + if (!fsync_entry_slab) + return -ENOMEM; + return 0; +} + +void f2fs_destroy_recovery_cache(void) +{ + kmem_cache_destroy(fsync_entry_slab); +} diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 7a9cc64f5ca3..cb2579e987aa 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -3305,9 +3305,12 @@ static int __init init_f2fs_fs(void) err = f2fs_create_checkpoint_caches(); if (err) goto free_segment_manager_caches; - err = f2fs_create_extent_cache(); + err = f2fs_create_recovery_cache(); if (err) goto free_checkpoint_caches; + err = f2fs_create_extent_cache(); + if (err) + goto free_recovery_cache; err = f2fs_init_sysfs(); if (err) goto free_extent_cache; @@ -3335,6 +3338,8 @@ static int __init init_f2fs_fs(void) f2fs_exit_sysfs(); free_extent_cache: f2fs_destroy_extent_cache(); +free_recovery_cache: + f2fs_destroy_recovery_cache(); free_checkpoint_caches: f2fs_destroy_checkpoint_caches(); free_segment_manager_caches: @@ -3355,6 +3360,7 @@ static void __exit exit_f2fs_fs(void) unregister_shrinker(&f2fs_shrinker_info); f2fs_exit_sysfs(); f2fs_destroy_extent_cache(); + f2fs_destroy_recovery_cache(); f2fs_destroy_checkpoint_caches(); f2fs_destroy_segment_manager_caches(); f2fs_destroy_node_manager_caches(); -- 2.31.1

2 1

[PATCH v2 OLK-6.6] Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
by liwei 23 May '24

23 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8XMTL CVE: NA ------------------------------------------------------------------ This reverts commit 2eb3daf61b18d620b0624e31ad44ac1c76d94075. To keep CONFIG unchanged, modify ACPI_HOTPLUG_PRESENT_CPU to ACPI_HOTPLUG_CPU. Signed-off-by: liwei <liwei728(a)huawei.com> Conflicts: arch/x86/Kconfig drivers/acpi/acpi_processor.c include/linux/acpi.h --- arch/loongarch/Kconfig | 2 +- arch/loongarch/kernel/acpi.c | 4 ++-- arch/x86/Kconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- arch/x86/kernel/acpi/boot.c | 4 ++-- drivers/acpi/Kconfig | 6 +++--- drivers/acpi/acpi_processor.c | 4 ++-- drivers/acpi/bus.c | 2 +- include/linux/acpi.h | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index edbbf03d29d9..58da6e03ecb5 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -5,7 +5,7 @@ config LOONGARCH select ACPI select ACPI_GENERIC_GSI if ACPI select ACPI_MCFG if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_PPTT if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI select ARCH_BINFMT_ELF_STATE diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c index f453271e6add..58819b017ba8 100644 --- a/arch/loongarch/kernel/acpi.c +++ b/arch/loongarch/kernel/acpi.c @@ -291,7 +291,7 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size) memblock_reserve(addr, size); } -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> @@ -343,4 +343,4 @@ int acpi_unmap_cpu(int cpu) } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 6cfa82a633a6..0ac76a2637f8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -60,7 +60,7 @@ config X86 # select ACPI_LEGACY_TABLES_LOOKUP if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_HOTPLUG_IGNORE_OSC if ACPI && HOTPLUG_CPU select ARCH_32BIT_OFF_T if X86_32 select ARCH_CLOCKSOURCE_INIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..1c1fb626ae9e 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -609,7 +609,7 @@ CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_PRESENT_CPU=y +CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_HOTPLUG_IGNORE_OSC=y CONFIG_ACPI_PROCESSOR_AGGREGATOR=m CONFIG_ACPI_THERMAL=y diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 8202bd2d957d..c55c0ef47a18 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -817,7 +817,7 @@ static void __init acpi_set_irq_model_ioapic(void) /* * ACPI based hotplug support for CPU */ -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid) @@ -866,7 +866,7 @@ int acpi_unmap_cpu(int cpu) return (0); } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base) { diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig index c49978b4b11f..c4746869d67b 100644 --- a/drivers/acpi/Kconfig +++ b/drivers/acpi/Kconfig @@ -305,14 +305,14 @@ config ACPI_IPMI To compile this driver as a module, choose M here: the module will be called as acpi_ipmi. -config ACPI_HOTPLUG_PRESENT_CPU +config ACPI_HOTPLUG_CPU bool depends on ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_CONTAINER config ACPI_HOTPLUG_IGNORE_OSC bool - depends on ACPI_HOTPLUG_PRESENT_CPU + depends on ACPI_HOTPLUG_CPU help Ignore whether firmware acknowledged support for toggling the CPU present bit in _STA. Some architectures predate the _OSC bits, so @@ -408,7 +408,7 @@ config ACPI_PCI_SLOT config ACPI_CONTAINER bool "Container and Module Devices" - default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_PRESENT_CPU) + default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_CPU) help This driver supports ACPI Container and Module devices (IDs ACPI0004, PNP0A05, and PNP0A06). diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c index 5bb207a7a1dd..0ff69af46a50 100644 --- a/drivers/acpi/acpi_processor.c +++ b/drivers/acpi/acpi_processor.c @@ -184,7 +184,7 @@ static void __init acpi_pcc_cpufreq_init(void) {} static bool acpi_processor_hotplug_present_supported(void) { - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) return false; /* x86 systems pre-date the _OSC bit */ @@ -502,7 +502,7 @@ static void acpi_processor_make_not_present(struct acpi_device *device) { struct acpi_processor *pr; - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) { + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) { pr_err_once("Changing CPU present bit is not supported"); return; } diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index b42f17bfbb09..0d2e1de143ef 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -355,7 +355,7 @@ static void acpi_bus_osc_negotiate_platform_control(void) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_APEI_SUPPORT; capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_ENABLED_SUPPORT; - if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_PRESENT_SUPPORT; if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle))) diff --git a/include/linux/acpi.h b/include/linux/acpi.h index a0e96f6e2de2..cc84f370620f 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -651,7 +651,7 @@ static inline u32 acpi_osc_ctx_get_cxl_control(struct acpi_osc_context *context) #define ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS 0x0000000F /* Enable _OST when all relevant hotplug operations are enabled */ -#if defined(CONFIG_ACPI_HOTPLUG_PRESENT_CPU) && \ +#if defined(CONFIG_ACPI_HOTPLUG_CPU) && \ defined(CONFIG_ACPI_HOTPLUG_MEMORY) && \ defined(CONFIG_ACPI_CONTAINER) #define ACPI_HOTPLUG_OST -- 2.25.1

2 1

[PATCH OLK-6.6 0/6] Patch series "mm: memcg: subtree stats flushing and thresholds"
by Lu Jialin 23 May '24

23 May '24

Lu Jialin (1): memcg/kabi: reserve space for memcg_vmstats_percpu related structures Yosry Ahmed (5): mm: memcg: change flush_next_time to flush_last_time mm: memcg: move vmstats structs definition above flushing code mm: memcg: make stats flushing threshold per-memcg mm: workingset: move the stats flush into workingset_test_recent() mm: memcg: restore subtree stats flushing include/linux/memcontrol.h | 8 +- mm/memcontrol.c | 266 +++++++++++++++++++++---------------- mm/vmscan.c | 2 +- mm/workingset.c | 42 ++++-- 4 files changed, 182 insertions(+), 136 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 23 May '24

23 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH openEuler-22.03-LTS-SP1] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 23 May '24

23 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.201 commit 6c71e065befb2fae8f1461559b940c04e1071bd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFE5 CVE: CVE-2023-52840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index 47d1b97ed6cf..a1b2c86ef611 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -276,11 +276,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] backport upstream stmmac related patches.
by Hongchen Zhang 23 May '24

23 May '24

backport upstream stmmac related patches. Russell King (Oracle) (1): net: phylink: provide mac_get_caps() method Serge Semin (2): net: stmmac: Rename phylink_get_caps() callback to update_caps() net: stmmac: Move MAC caps init to phylink MAC caps getter Documentation/networking/sfp-phylink.rst | 7 ++++ .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 ++--- drivers/net/ethernet/stmicro/stmmac/hwif.h | 8 ++--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 36 +++++++++---------- drivers/net/phy/phylink.c | 14 ++++++-- include/linux/phylink.h | 15 ++++++++ 6 files changed, 58 insertions(+), 30 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6] Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
by liwei 23 May '24

23 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8XMTL CVE: NA ------------------------------------------------------------------ This reverts commit 2eb3daf61b18d620b0624e31ad44ac1c76d94075. Signed-off-by: liwei <liwei728(a)huawei.com> Conflicts: arch/x86/Kconfig drivers/acpi/acpi_processor.c include/linux/acpi.h --- arch/loongarch/Kconfig | 2 +- arch/loongarch/kernel/acpi.c | 4 ++-- arch/x86/Kconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- arch/x86/kernel/acpi/boot.c | 4 ++-- drivers/acpi/Kconfig | 6 +++--- drivers/acpi/acpi_processor.c | 4 ++-- drivers/acpi/bus.c | 2 +- include/linux/acpi.h | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index edbbf03d29d9..58da6e03ecb5 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -5,7 +5,7 @@ config LOONGARCH select ACPI select ACPI_GENERIC_GSI if ACPI select ACPI_MCFG if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_PPTT if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI select ARCH_BINFMT_ELF_STATE diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c index f453271e6add..58819b017ba8 100644 --- a/arch/loongarch/kernel/acpi.c +++ b/arch/loongarch/kernel/acpi.c @@ -291,7 +291,7 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size) memblock_reserve(addr, size); } -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> @@ -343,4 +343,4 @@ int acpi_unmap_cpu(int cpu) } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 6cfa82a633a6..0ac76a2637f8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -60,7 +60,7 @@ config X86 # select ACPI_LEGACY_TABLES_LOOKUP if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_HOTPLUG_IGNORE_OSC if ACPI && HOTPLUG_CPU select ARCH_32BIT_OFF_T if X86_32 select ARCH_CLOCKSOURCE_INIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..1c1fb626ae9e 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -609,7 +609,7 @@ CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_PRESENT_CPU=y +CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_HOTPLUG_IGNORE_OSC=y CONFIG_ACPI_PROCESSOR_AGGREGATOR=m CONFIG_ACPI_THERMAL=y diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 8202bd2d957d..c55c0ef47a18 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -817,7 +817,7 @@ static void __init acpi_set_irq_model_ioapic(void) /* * ACPI based hotplug support for CPU */ -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid) @@ -866,7 +866,7 @@ int acpi_unmap_cpu(int cpu) return (0); } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base) { diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig index c49978b4b11f..c4746869d67b 100644 --- a/drivers/acpi/Kconfig +++ b/drivers/acpi/Kconfig @@ -305,14 +305,14 @@ config ACPI_IPMI To compile this driver as a module, choose M here: the module will be called as acpi_ipmi. -config ACPI_HOTPLUG_PRESENT_CPU +config ACPI_HOTPLUG_CPU bool depends on ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_CONTAINER config ACPI_HOTPLUG_IGNORE_OSC bool - depends on ACPI_HOTPLUG_PRESENT_CPU + depends on ACPI_HOTPLUG_CPU help Ignore whether firmware acknowledged support for toggling the CPU present bit in _STA. Some architectures predate the _OSC bits, so @@ -408,7 +408,7 @@ config ACPI_PCI_SLOT config ACPI_CONTAINER bool "Container and Module Devices" - default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_PRESENT_CPU) + default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_CPU) help This driver supports ACPI Container and Module devices (IDs ACPI0004, PNP0A05, and PNP0A06). diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c index 5bb207a7a1dd..0ff69af46a50 100644 --- a/drivers/acpi/acpi_processor.c +++ b/drivers/acpi/acpi_processor.c @@ -184,7 +184,7 @@ static void __init acpi_pcc_cpufreq_init(void) {} static bool acpi_processor_hotplug_present_supported(void) { - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) return false; /* x86 systems pre-date the _OSC bit */ @@ -502,7 +502,7 @@ static void acpi_processor_make_not_present(struct acpi_device *device) { struct acpi_processor *pr; - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) { + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) { pr_err_once("Changing CPU present bit is not supported"); return; } diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index b42f17bfbb09..0d2e1de143ef 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -355,7 +355,7 @@ static void acpi_bus_osc_negotiate_platform_control(void) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_APEI_SUPPORT; capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_ENABLED_SUPPORT; - if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_PRESENT_SUPPORT; if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle))) diff --git a/include/linux/acpi.h b/include/linux/acpi.h index a0e96f6e2de2..cc84f370620f 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -651,7 +651,7 @@ static inline u32 acpi_osc_ctx_get_cxl_control(struct acpi_osc_context *context) #define ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS 0x0000000F /* Enable _OST when all relevant hotplug operations are enabled */ -#if defined(CONFIG_ACPI_HOTPLUG_PRESENT_CPU) && \ +#if defined(CONFIG_ACPI_HOTPLUG_CPU) && \ defined(CONFIG_ACPI_HOTPLUG_MEMORY) && \ defined(CONFIG_ACPI_CONTAINER) #define ACPI_HOTPLUG_OST -- 2.25.1

2 1

[PATCH OLK-6.6 00/15] LoongArch: add GMAC & GNET support
by Hongchen Zhang 23 May '24

23 May '24

Yanteng Si (15): net: stmmac: Move the atds flag to the stmmac_dma_cfg structure net: stmmac: Add multi-channel support net: stmmac: Export dwmac1000_dma_ops net: stmmac: dwmac-loongson: Drop useless platform data net: stmmac: dwmac-loongson: Use PCI_DEVICE_DATA() macro for device identification net: stmmac: dwmac-loongson: Split up the platform data initialization net: stmmac: dwmac-loongson: Add ref and ptp clocks for Loongson net: stmmac: dwmac-loongson: Add phy mask for Loongson GMAC net: stmmac: dwmac-loongson: Add phy_interface for Loongson GMAC net: stmmac: dwmac-loongson: Add full PCI support net: stmmac: dwmac-loongson: Add loongson_dwmac_config_legacy net: stmmac: dwmac-loongson: Fixed failure to set network speed to 1000. net: stmmac: dwmac-loongson: Add Loongson GNET support net: stmmac: dwmac-loongson: Move disable_force flag to _gnet_date net: stmmac: dwmac-loongson: Add loongson module author drivers/net/ethernet/stmicro/stmmac/common.h | 1 + .../ethernet/stmicro/stmmac/dwmac-loongson.c | 519 ++++++++++++++++-- .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 4 +- .../ethernet/stmicro/stmmac/dwmac1000_dma.c | 35 +- .../ethernet/stmicro/stmmac/dwmac100_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac4_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac_dma.h | 20 +- .../net/ethernet/stmicro/stmmac/dwmac_lib.c | 30 +- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 5 +- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 6 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 +- include/linux/stmmac.h | 2 + 13 files changed, 536 insertions(+), 103 deletions(-) -- 2.33.0

2 16

[PATCH OLK-6.6 0/3] backport upstream stmmac related patches.
by Hongchen Zhang 23 May '24

23 May '24

backport upstream stmmac related patches. b487717141e8 2024-05-23 net: stmmac: Move MAC caps init to phylink MAC caps getter e345daff0645 2024-05-23 net: stmmac: Rename phylink_get_caps() callback to update_caps() 563ca13a7bf6 2024-05-23 net: phylink: provide mac_get_caps() method Russell King (Oracle) (1): net: phylink: provide mac_get_caps() method Serge Semin (2): net: stmmac: Rename phylink_get_caps() callback to update_caps() net: stmmac: Move MAC caps init to phylink MAC caps getter Documentation/networking/sfp-phylink.rst | 7 ++++ .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 ++--- drivers/net/ethernet/stmicro/stmmac/hwif.h | 8 ++--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 36 +++++++++---------- drivers/net/phy/phylink.c | 14 ++++++-- include/linux/phylink.h | 15 ++++++++ 6 files changed, 58 insertions(+), 30 deletions(-) -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/18] LoongArch: add GMAC & GNET support
by Hongchen Zhang 23 May '24

23 May '24

Russell King (Oracle) (1): net: phylink: provide mac_get_caps() method Serge Semin (2): net: stmmac: Rename phylink_get_caps() callback to update_caps() net: stmmac: Move MAC caps init to phylink MAC caps getter Yanteng Si (15): net: stmmac: Move the atds flag to the stmmac_dma_cfg structure net: stmmac: Add multi-channel support net: stmmac: Export dwmac1000_dma_ops net: stmmac: dwmac-loongson: Drop useless platform data net: stmmac: dwmac-loongson: Use PCI_DEVICE_DATA() macro for device identification net: stmmac: dwmac-loongson: Split up the platform data initialization net: stmmac: dwmac-loongson: Add ref and ptp clocks for Loongson net: stmmac: dwmac-loongson: Add phy mask for Loongson GMAC net: stmmac: dwmac-loongson: Add phy_interface for Loongson GMAC net: stmmac: dwmac-loongson: Add full PCI support net: stmmac: dwmac-loongson: Add loongson_dwmac_config_legacy net: stmmac: dwmac-loongson: Fixed failure to set network speed to 1000. net: stmmac: dwmac-loongson: Add Loongson GNET support net: stmmac: dwmac-loongson: Move disable_force flag to _gnet_date net: stmmac: dwmac-loongson: Add loongson module author Documentation/networking/sfp-phylink.rst | 7 + drivers/net/ethernet/stmicro/stmmac/common.h | 1 + .../ethernet/stmicro/stmmac/dwmac-loongson.c | 519 ++++++++++++++++-- .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 4 +- .../ethernet/stmicro/stmmac/dwmac1000_dma.c | 35 +- .../ethernet/stmicro/stmmac/dwmac100_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 +- .../net/ethernet/stmicro/stmmac/dwmac4_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac_dma.h | 20 +- .../net/ethernet/stmicro/stmmac/dwmac_lib.c | 30 +- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 13 +- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 6 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +- drivers/net/phy/phylink.c | 14 +- include/linux/phylink.h | 15 + include/linux/stmmac.h | 2 + 17 files changed, 594 insertions(+), 133 deletions(-) -- 2.33.0

1 15

[PATCH OLK-5.10 0/2] CVE-2024-35999
by Yifan Qiao 23 May '24

23 May '24

Shyam Prasad N (1): cifs: protect session channel fields with chan_lock Steve French (1): smb3: missing lock when picking channel fs/cifs/cifsglob.h | 5 +++++ fs/cifs/cifs_debug.c | 2 ++ fs/cifs/connect.c | 25 +++++++++++++++++++--- fs/cifs/misc.c | 1 + fs/cifs/sess.c | 50 +++++++++++++++++++++++++++++++++----------- fs/cifs/transport.c | 10 +++++++-- 6 files changed, 76 insertions(+), 17 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 23 May '24

23 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v5.10.215 commit 1ce408f75ccf1e25b3fddef75cca878b55f2ac90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0252c0562dbc..33fb7b6555f4 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -398,7 +398,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->state.y]; unsigned int x = vc->state.x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Load balance fixes
by Zhang Qiao 23 May '24

23 May '24

Zhang Qiao (2): sched/numa: Fix numa imbalance in load_balance() config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 arch/arm64/configs/openeuler_defconfig | 2 +- kernel/sched/fair.c | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH OLK-6.6 v3] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment anouymous mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- Documentation/admin-guide/mm/transhuge.rst | 15 +++++++++------ include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 13 +++++++++++-- mm/mmap.c | 2 +- 4 files changed, 28 insertions(+), 9 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..e66d1d7ee711 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: +The kernel could try to enable mappings for different sizes, eg, 64K on +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K anonymous mapping for arm64 +is dependent on BIT3 being turned on, the above feature are disabled by +default, and could enable the above feature by writing the corresponding +bit to 1:: echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..58ce4efb2019 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() NULL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..63438200f3da 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,16 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (!(val & ANON_MAPPING_PMD_ALIGN) && + (val & ANON_MAPPING_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[PATCH OLK-6.6 v3] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment anouymous mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> Changes since v2: - Modify enable logic and related documentation. Changes since v1: - Fix build error without CONFIG_TRANSPARENT_HUGEPAGE. - delete some unsed define. --- Documentation/admin-guide/mm/transhuge.rst | 15 +++++++++------ include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 13 +++++++++++-- mm/mmap.c | 2 +- 4 files changed, 28 insertions(+), 9 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..e66d1d7ee711 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: +The kernel could try to enable mappings for different sizes, eg, 64K on +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K anonymous mapping for arm64 +is dependent on BIT3 being turned on, the above feature are disabled by +default, and could enable the above feature by writing the corresponding +bit to 1:: echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..58ce4efb2019 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() NULL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..63438200f3da 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,16 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (!(val & ANON_MAPPING_PMD_ALIGN) && + (val & ANON_MAPPING_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[PATCH OLK-5.10] [Backport] drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
by Wang Hai 23 May '24

23 May '24

From: Philip Yang <Philip.Yang(a)amd.com> stable inclusion from stable-v5.15.154 commit 5d5f1a7f3b1039925f79c7894f153c2a905201fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94F CVE: CVE-2024-35817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6c6064cbe58b43533e3451ad6a8ba9736c109ac3 ] Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgpu_ttm_backend_unbind will not clear the gart page table entry and leave valid mapping entry pointing to the stale system page. Then if GPU access the gart address mistakely, it will read undefined value instead page fault, harder to debug and reproduce the real issue. Cc: stable(a)vger.kernel.org Signed-off-by: Philip Yang <Philip.Yang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c [commit 942ab769c51d wasn't merged, which lead to context conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 0b162928a248..7d4a54025e18 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1092,6 +1092,7 @@ static int amdgpu_ttm_gart_bind(struct amdgpu_device *adev, r = amdgpu_gart_bind(adev, gtt->offset, ttm->num_pages, ttm->pages, gtt->ttm.dma_address, flags); } + gtt->bound = true; gart_bind_fail: if (r) -- 2.17.1

2 1

[PATCH OLK-5.10] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 23 May '24

23 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.201 commit 6c71e065befb2fae8f1461559b940c04e1071bd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFE5 CVE: CVE-2023-52840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index 47d1b97ed6cf..a1b2c86ef611 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -276,11 +276,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 23 May '24

23 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v4.19.312 commit fc7dfe3d123f00e720be80b920da287810a1f37d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 163186cbfe79..12ddd82f0dad 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -405,7 +405,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->vc_y]; unsigned int x = vc->vc_x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH OLK-5.10 v3 0/4] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 23 May '24

23 May '24

Changelog: v1->v2: change __setup() to early_param() v2->v3: fix kabi because #include <linux/sched/isolation.h> modify defconfig Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 ++ include/linux/cpu.h | 5 +++- include/linux/sched/isolation.h | 5 ++++ kernel/sched/isolation.c | 39 +++++++++++++++++++++++--- kernel/smp.c | 4 +++ kernel/time/tick-sched.c | 5 +++- 7 files changed, 57 insertions(+), 6 deletions(-) -- 2.30.0

2 5

[PATCH OLK-5.10 v4] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.217 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 v3] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-35999
by Yifan Qiao 23 May '24

23 May '24

Shyam Prasad N (1): cifs: protect session channel fields with chan_lock Steve French (1): smb3: missing lock when picking channel fs/cifs/cifsglob.h | 5 +++++ fs/cifs/cifs_debug.c | 2 ++ fs/cifs/connect.c | 25 +++++++++++++++++++--- fs/cifs/misc.c | 1 + fs/cifs/sess.c | 50 +++++++++++++++++++++++++++++++++----------- fs/cifs/transport.c | 10 +++++++-- 6 files changed, 76 insertions(+), 17 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
by Zhao Mengmeng 23 May '24

23 May '24

From: Jiri Benc <jbenc(a)redhat.com> stable inclusion from stable-v5.10.216 commit 3fb02ec57ead2891a2306af8c51a306bc5945e70 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRPL CVE: CVE-2024-35969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ] Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK> Fixes: 5c578aedcb21d ("IPv6: convert addrconf hash list to RCU") Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Jiri Benc <jbenc(a)redhat.com> Link: https://lore.kernel.org/r/8ab821e36073a4a406c50ec83c9e8dc586c539e4.17125858… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- include/net/addrconf.h | 4 ++++ net/ipv6/addrconf.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index edba74a53683..a24c65e9a994 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -429,6 +429,10 @@ static inline void in6_ifa_hold(struct inet6_ifaddr *ifp) refcount_inc(&ifp->refcnt); } +static inline bool in6_ifa_hold_safe(struct inet6_ifaddr *ifp) +{ + return refcount_inc_not_zero(&ifp->refcnt); +} /* * compute link-local solicited-node multicast address diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5e42149b954f..821aa81dec47 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2033,9 +2033,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add if (ipv6_addr_equal(&ifp->addr, addr)) { if (!dev || ifp->idev->dev == dev || !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) { - result = ifp; - in6_ifa_hold(ifp); - break; + if (in6_ifa_hold_safe(ifp)) { + result = ifp; + break; + } } } } -- 2.33.0

2 1

[PATCH OLK-6.6] Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.9 commit 4d7b41c0e43995b0e992b9f8903109275744b658 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMPS CVE: CVE-2024-36013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311 Fixes: 73ffa904b782 ("Bluetooth: Move conf_{req,rsp} stuff to struct l2cap_chan") Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/l2cap_core.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 706d2478ddb3..edf83e886b82 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3902,13 +3902,12 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, return 0; } -static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, - struct l2cap_cmd_hdr *cmd, - u8 *data, u8 rsp_code, u8 amp_id) +static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, + u8 *data, u8 rsp_code, u8 amp_id) { struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; struct l2cap_conn_rsp rsp; - struct l2cap_chan *chan = NULL, *pchan; + struct l2cap_chan *chan = NULL, *pchan = NULL; int result, status = L2CAP_CS_NO_INFO; u16 dcid = 0, scid = __le16_to_cpu(req->scid); @@ -3921,7 +3920,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, &conn->hcon->dst, ACL_LINK); if (!pchan) { result = L2CAP_CR_BAD_PSM; - goto sendresp; + goto response; } mutex_lock(&conn->chan_lock); @@ -4008,17 +4007,15 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, } response: - l2cap_chan_unlock(pchan); - mutex_unlock(&conn->chan_lock); - l2cap_chan_put(pchan); - -sendresp: rsp.scid = cpu_to_le16(scid); rsp.dcid = cpu_to_le16(dcid); rsp.result = cpu_to_le16(result); rsp.status = cpu_to_le16(status); l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); + if (!pchan) + return; + if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { struct l2cap_info_req info; info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); @@ -4041,7 +4038,9 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, chan->num_conf_req++; } - return chan; + l2cap_chan_unlock(pchan); + mutex_unlock(&conn->chan_lock); + l2cap_chan_put(pchan); } static int l2cap_connect_req(struct l2cap_conn *conn, -- 2.33.0

2 1

[PATCH OLK-5.10 v2] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.15.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] CVE-2024-35995
by liwei 23 May '24

23 May '24

CVE-2024-35995 Jarred White (2): ACPI: CPPC: Use access_width over bit_width for system memory accesses ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro Rafael J. Wysocki (1): ACPI: CPPC: Fix up I/O port access in cpc_read() Steven Noonan (1): ACPI: CPPC: Implement support for SystemIO registers Vanshidhar Konda (1): ACPI: CPPC: Fix access width used for PCC registers drivers/acpi/cppc_acpi.c | 174 +++++++++++++++++++++++++++++---------- 1 file changed, 132 insertions(+), 42 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6] Bluetooth: HCI: Fix potential null-ptr-deref
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> stable inclusion from stable-v6.6.31 commit 1f7ebb69c1d65732bcac2fda9d15421f76f01e81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMQS CVE: CVE-2024-36011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d2706004a1b8b526592e823d7e52551b518a7941 ] Fix potential null-ptr-deref in hci_le_big_sync_established_evt(). Fixes: f777d8827817 (Bluetooth: ISO: Notify user space about failed bis connections) Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/hci_event.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 1b4abf8e90f6..9274d3255049 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -7200,6 +7200,8 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, u16 handle = le16_to_cpu(ev->bis[i]); bis = hci_conn_hash_lookup_handle(hdev, handle); + if (!bis) + continue; set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags); hci_connect_cfm(bis, ev->status); -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/5] CVE-2024-35995
by liwei 23 May '24

23 May '24

CVE-2024-35995 Jarred White (2): ACPI: CPPC: Use access_width over bit_width for system memory accesses ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro Rafael J. Wysocki (1): ACPI: CPPC: Fix up I/O port access in cpc_read() Steven Noonan (1): ACPI: CPPC: Implement support for SystemIO registers Vanshidhar Konda (1): ACPI: CPPC: Fix access width used for PCC registers drivers/acpi/cppc_acpi.c | 174 +++++++++++++++++++++++++++++---------- 1 file changed, 132 insertions(+), 42 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-1.0-LTS] media: bttv: fix use after free error due to btv->timeout timer
by Ye Bin 23 May '24

23 May '24

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.7-rc1 commit bd5b50b329e850d467e7bcc07b2b6bde3752fbda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFON CVE: CVE-2023-52847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv Fixes: 162e6376ac58 ("media: pci: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/media/pci/bt8xx/bttv-driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c index cf05e11da01b..00400f58d9c4 100644 --- a/drivers/media/pci/bt8xx/bttv-driver.c +++ b/drivers/media/pci/bt8xx/bttv-driver.c @@ -4293,6 +4293,7 @@ static void bttv_remove(struct pci_dev *pci_dev) /* free resources */ free_irq(btv->c.pci->irq,btv); + del_timer_sync(&btv->timeout); iounmap(btv->bt848_mmio); release_mem_region(pci_resource_start(btv->c.pci,0), pci_resource_len(btv->c.pci,0)); -- 2.31.1

2 1

[PATCH OLK-6.6] Bluetooth: msft: fix slab-use-after-free in msft_do_close()
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> stable inclusion from stable-v6.6.31 commit a85a60e62355e3bf4802dead7938966824b23940 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMR9 CVE: CVE-2024-36012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10f9f426ac6e752c8d87bf4346930ba347aaabac ] Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309 Fixes: bf6a4e30ffbd ("Bluetooth: disable advertisement filters during suspend") Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/hci_core.c | 3 +-- net/bluetooth/msft.c | 2 +- net/bluetooth/msft.h | 4 ++-- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 0592369579ab..befe645d3f9b 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -2736,8 +2736,6 @@ void hci_unregister_dev(struct hci_dev *hdev) hci_unregister_suspend_notifier(hdev); - msft_unregister(hdev); - hci_dev_do_close(hdev); if (!test_bit(HCI_INIT, &hdev->flags) && @@ -2791,6 +2789,7 @@ void hci_release_dev(struct hci_dev *hdev) hci_discovery_filter_clear(hdev); hci_blocked_keys_clear(hdev); hci_codec_list_clear(&hdev->local_codecs); + msft_release(hdev); hci_dev_unlock(hdev); ida_destroy(&hdev->unset_handle_ida); diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c index 9612c5d1b13f..d039683d3bdd 100644 --- a/net/bluetooth/msft.c +++ b/net/bluetooth/msft.c @@ -769,7 +769,7 @@ void msft_register(struct hci_dev *hdev) mutex_init(&msft->filter_lock); } -void msft_unregister(struct hci_dev *hdev) +void msft_release(struct hci_dev *hdev) { struct msft_data *msft = hdev->msft_data; diff --git a/net/bluetooth/msft.h b/net/bluetooth/msft.h index 2a63205b377b..fe538e9c91c0 100644 --- a/net/bluetooth/msft.h +++ b/net/bluetooth/msft.h @@ -14,7 +14,7 @@ bool msft_monitor_supported(struct hci_dev *hdev); void msft_register(struct hci_dev *hdev); -void msft_unregister(struct hci_dev *hdev); +void msft_release(struct hci_dev *hdev); void msft_do_open(struct hci_dev *hdev); void msft_do_close(struct hci_dev *hdev); void msft_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb); @@ -35,7 +35,7 @@ static inline bool msft_monitor_supported(struct hci_dev *hdev) } static inline void msft_register(struct hci_dev *hdev) {} -static inline void msft_unregister(struct hci_dev *hdev) {} +static inline void msft_release(struct hci_dev *hdev) {} static inline void msft_do_open(struct hci_dev *hdev) {} static inline void msft_do_close(struct hci_dev *hdev) {} static inline void msft_vendor_evt(struct hci_dev *hdev, void *data, -- 2.33.0

2 1

[PATCH OLK-5.10] drm/i915/gt: Reset queue_priority_hint on parking
by Wenyu Huang 23 May '24

23 May '24

From: Chris Wilson <chris(a)chris-wilson.co.uk> stable inclusion from stable-v5.10.216 commit fe34587acc995e7b1d7a5d3444a0736721ec32b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5FX CVE: CVE-2024-26937 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4a3859ea5240365d21f6053ee219bb240d520895 upstream. Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of an active request that may complete before the preemption is processed by HW. If that happens, the request is retired from the queue, but the queue_priority_hint remains set, preventing direct submission until after the next CS interrupt is processed. This preempt-to-busy race can be triggered by the heartbeat, which will also act as the power-management barrier and upon completion allow us to idle the HW. We may process the completion of the heartbeat, and begin parking the engine before the CS event that restores the queue_priority_hint, causing us to fail the assertion that it is MIN. <3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 166.210781] Dumping ftrace buffer: <0>[ 166.210795] --------------------------------- ... <0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 } <0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646 <0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0 <0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659 <0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40 <0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 } <0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2 <0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin <0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2 <0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin <0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660 <0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns } <0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked <0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040 <0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns } <0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns } <0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 167.303811] --------------------------------- <4>[ 167.304722] ------------[ cut here ]------------ <2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283! <4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1 <4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 <4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915] <4>[ 167.304839] RIP: 0010:__engine_park+0x3fd/0x680 [i915] <4>[ 167.304937] Code: 00 48 c7 c2 b0 e5 86 a0 48 8d 3d 00 00 00 00 e8 79 48 d4 e0 bf 01 00 00 00 e8 ef 0a d4 e0 31 f6 bf 09 00 00 00 e8 03 49 c0 e0 <0f> 0b 0f 0b be 01 00 00 00 e8 f5 61 fd ff 31 c0 e9 34 fd ff ff 48 <4>[ 167.304940] RSP: 0018:ffffc9000059fce0 EFLAGS: 00010246 <4>[ 167.304942] RAX: 0000000000000200 RBX: 0000000000000000 RCX: 0000000000000006 <4>[ 167.304944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 <4>[ 167.304946] RBP: ffff8881330ca1b0 R08: 0000000000000001 R09: 0000000000000001 <4>[ 167.304947] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881330ca000 <4>[ 167.304948] R13: ffff888110f02aa0 R14: ffff88812d1d0205 R15: ffff88811277d4f0 <4>[ 167.304950] FS: 0000000000000000(0000) GS:ffff88844f780000(0000) knlGS:0000000000000000 <4>[ 167.304952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 167.304953] CR2: 00007fc362200c40 CR3: 000000013306e003 CR4: 0000000000770ef0 <4>[ 167.304955] PKRU: 55555554 <4>[ 167.304957] Call Trace: <4>[ 167.304958] <TASK> <4>[ 167.305573] ____intel_wakeref_put_last+0x1d/0x80 [i915] <4>[ 167.305685] i915_request_retire.part.0+0x34f/0x600 [i915] <4>[ 167.305800] retire_requests+0x51/0x80 [i915] <4>[ 167.305892] intel_gt_retire_requests_timeout+0x27f/0x700 [i915] <4>[ 167.305985] process_scheduled_works+0x2db/0x530 <4>[ 167.305990] worker_thread+0x18c/0x350 <4>[ 167.305993] kthread+0xfe/0x130 <4>[ 167.305997] ret_from_fork+0x2c/0x50 <4>[ 167.306001] ret_from_fork_asm+0x1b/0x30 <4>[ 167.306004] </TASK> It is necessary for the queue_priority_hint to be lower than the next request submission upon waking up, as we rely on the hint to decide when to kick the tasklet to submit that first request. Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy") Closes: https://gitlab.freedesktop.org/drm/intel/issues/10154 Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # v5.4+ Reviewed-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240318135906.716055-2-janus… (cherry picked from commit 98850e96cf811dc2d0a7d0af491caff9f5d49c1e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_pm.c | 3 --- drivers/gpu/drm/i915/gt/intel_lrc.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_pm.c b/drivers/gpu/drm/i915/gt/intel_engine_pm.c index f7b2e07e2229..f9fdbd79c0f3 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_pm.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_pm.c @@ -250,9 +250,6 @@ static int __engine_park(struct intel_wakeref *wf) intel_engine_park_heartbeat(engine); intel_breadcrumbs_park(engine->breadcrumbs); - /* Must be reset upon idling, or we may miss the busy wakeup. */ - GEM_BUG_ON(engine->execlists.queue_priority_hint != INT_MIN); - if (engine->park) engine->park(engine); diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c index ee9b33c3aff8..5a414d989dca 100644 --- a/drivers/gpu/drm/i915/gt/intel_lrc.c +++ b/drivers/gpu/drm/i915/gt/intel_lrc.c @@ -5032,6 +5032,9 @@ static void execlists_park(struct intel_engine_cs *engine) { cancel_timer(&engine->execlists.timer); cancel_timer(&engine->execlists.preempt); + + /* Reset upon idling, or we may delay the busy wakeup. */ + WRITE_ONCE(engine->execlists.queue_priority_hint, INT_MIN); } void intel_execlists_set_default_submission(struct intel_engine_cs *engine) -- 2.34.1

2 1

[PATCH OLK-5.10] netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
by Zhao Wenhui 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit d1261bde59a3a087ab0c81181821e194278d9264 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q91I CVE: CVE-2024-27428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 119cae5ea3f9e35cdada8e572cc067f072fa825a ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- net/netrom/nr_dev.c | 2 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_subr.c | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c index 29e418c8c6c3..4caee8754b79 100644 --- a/net/netrom/nr_dev.c +++ b/net/netrom/nr_dev.c @@ -81,7 +81,7 @@ static int nr_header(struct sk_buff *skb, struct net_device *dev, buff[6] |= AX25_SSSID_SPARE; buff += AX25_ADDR_LEN; - *buff++ = sysctl_netrom_network_ttl_initialiser; + *buff++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); *buff++ = NR_PROTO_IP; *buff++ = NR_PROTO_IP; diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c index 44929657f5b7..5e531394a724 100644 --- a/net/netrom/nr_out.c +++ b/net/netrom/nr_out.c @@ -204,7 +204,7 @@ void nr_transmit_buffer(struct sock *sk, struct sk_buff *skb) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (!nr_route_frame(skb, NULL)) { kfree_skb(skb); diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c index e2d2af924cff..c3bbd5880850 100644 --- a/net/netrom/nr_subr.c +++ b/net/netrom/nr_subr.c @@ -182,7 +182,8 @@ void nr_write_internal(struct sock *sk, int frametype) *dptr++ = nr->my_id; *dptr++ = frametype; *dptr++ = nr->window; - if (nr->bpqext) *dptr++ = sysctl_netrom_network_ttl_initialiser; + if (nr->bpqext) + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); break; case NR_DISCREQ: @@ -236,7 +237,7 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (mine) { *dptr++ = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
by Zhao Wenhui 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit d1261bde59a3a087ab0c81181821e194278d9264 category: bugfix bugzilla: 189802 CVE: CVE-2024-27428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 119cae5ea3f9e35cdada8e572cc067f072fa825a ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- net/netrom/nr_dev.c | 2 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_subr.c | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c index 29e418c8c6c3..4caee8754b79 100644 --- a/net/netrom/nr_dev.c +++ b/net/netrom/nr_dev.c @@ -81,7 +81,7 @@ static int nr_header(struct sk_buff *skb, struct net_device *dev, buff[6] |= AX25_SSSID_SPARE; buff += AX25_ADDR_LEN; - *buff++ = sysctl_netrom_network_ttl_initialiser; + *buff++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); *buff++ = NR_PROTO_IP; *buff++ = NR_PROTO_IP; diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c index 44929657f5b7..5e531394a724 100644 --- a/net/netrom/nr_out.c +++ b/net/netrom/nr_out.c @@ -204,7 +204,7 @@ void nr_transmit_buffer(struct sock *sk, struct sk_buff *skb) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (!nr_route_frame(skb, NULL)) { kfree_skb(skb); diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c index e2d2af924cff..c3bbd5880850 100644 --- a/net/netrom/nr_subr.c +++ b/net/netrom/nr_subr.c @@ -182,7 +182,8 @@ void nr_write_internal(struct sock *sk, int frametype) *dptr++ = nr->my_id; *dptr++ = frametype; *dptr++ = nr->window; - if (nr->bpqext) *dptr++ = sysctl_netrom_network_ttl_initialiser; + if (nr->bpqext) + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); break; case NR_DISCREQ: @@ -236,7 +237,7 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (mine) { *dptr++ = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.15.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-6.6 v2] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> Changes since v1: - Fix build error without CONFIG_TRANSPARENT_HUGEPAGE. - delete some unsed define. --- Documentation/admin-guide/mm/transhuge.rst | 19 +++++++++++-------- include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 12 ++++++++++-- mm/mmap.c | 2 +- 4 files changed, 29 insertions(+), 11 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..aeff60881fd0 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: - - echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align +The kernel could try to enable mappings for different sizes, eg, 64K for +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K for arm64 is dependent on +BIT3 being turned on, the above feature are disabled by default, and +could enable the above feature by writing the corresponding bit to 1:: + + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x5 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x7 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..3a15b8417199 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() 0UL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..c090e6cbef3b 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,15 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (val && !(val & ANON_MAPPING_PMD_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

3 2

[PATCH openEuler-22.03-LTS-SP1] clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
by Li Huafei 23 May '24

23 May '24

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v5.10.201 commit 96e9544a0c4faca616b3f9f4034dcd83a14e7f22 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RG0J CVE: CVE-2023-52876 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0884393c63cc9a1772f7121a6645ba7bd76feeb9 ] Add the check for the return value of mtk_alloc_clk_data() in order to avoid NULL pointer dereference. Fixes: 3b5e748615e7 ("clk: mediatek: add clock support for MT7629 SoC") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Link: https://lore.kernel.org/r/20230912093407.21505-4-jiasheng@iscas.ac.cn Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/clk/mediatek/clk-mt7629-eth.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/clk/mediatek/clk-mt7629-eth.c b/drivers/clk/mediatek/clk-mt7629-eth.c index 88279d0ea1a76..3ab7b672f8c70 100644 --- a/drivers/clk/mediatek/clk-mt7629-eth.c +++ b/drivers/clk/mediatek/clk-mt7629-eth.c @@ -83,6 +83,8 @@ static int clk_mt7629_ethsys_init(struct platform_device *pdev) int r; clk_data = mtk_alloc_clk_data(CLK_ETH_NR_CLK); + if (!clk_data) + return -ENOMEM; mtk_clk_register_gates(node, eth_clks, CLK_ETH_NR_CLK, clk_data); @@ -105,6 +107,8 @@ static int clk_mt7629_sgmiisys_init(struct platform_device *pdev) int r; clk_data = mtk_alloc_clk_data(CLK_SGMII_NR_CLK); + if (!clk_data) + return -ENOMEM; mtk_clk_register_gates(node, sgmii_clks[id++], CLK_SGMII_NR_CLK, clk_data); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] *** load balance fixes ***
by Zhang Qiao 23 May '24

23 May '24

Zhang Qiao (2): sched/numa: Fix numa imbalance in load_balance() config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 arch/arm64/configs/openeuler_defconfig | 2 +- kernel/sched/fair.c | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH openEuler-1.0-LTS] net/mlx5e: fix a double-free in arfs_create_groups
by Chen Zhongjin 23 May '24

23 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.8-rc2 commit 3c6d5189246f590e4e1f167991558bdb72a4738b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9IE CVE: CVE-2024-35835 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again. Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c [fix context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index 37dbe27391695..8a4fbb89820cf 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -233,11 +233,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS, sizeof(*ft->g), GFP_KERNEL); - in = kvzalloc(inlen, GFP_KERNEL); - if (!in || !ft->g) { - kvfree(ft->g); - kvfree(in); + if (!ft->g) return -ENOMEM; + + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + err = -ENOMEM; + goto err_free_g; } mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); @@ -257,7 +259,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } switch (type) { @@ -279,7 +281,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); @@ -288,7 +290,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; memset(in, 0, inlen); @@ -297,18 +299,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; kvfree(in); return 0; -err: +err_clean_group: err = PTR_ERR(ft->g[ft->num_groups]); ft->g[ft->num_groups] = NULL; -out: +err_free_in: kvfree(in); - +err_free_g: + kfree(ft->g); + ft->g = NULL; return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 1/2] sched/numa: Fix numa imbalance in load_balance()
by Zhang Qiao 23 May '24

23 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RMHW CVE: NA -------------------------------- When perform load balance, a NUMA imbalance is allowed if busy CPUs is less than the maximum threshold, it keeps a pair of communication tasks on the current node when the destination is lightly loaded. 1. But, calculate_imbalance() use local->sum_nr_running, it may not be accurate, because communication tasks is on busiest group, so should be busiest->sum_nr_running. 2. At the same time, idles cpus are used to calculate imbalance, but the group_weight may not be the same between local and busiest groups. In this case, even if both groups are very idle, imbalance will be calculated very large, so the imbalance is calculated by calculating the difference of busy cpus between groups. Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/fair.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 3dcbf50b677f..a650f1a4f4b2 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1493,7 +1493,7 @@ adjust_numa_imbalance(int imbalance, int dst_running, int imb_numa_nr) * Allow a small imbalance based on a simple pair of communicating * tasks that remain local when the destination is lightly loaded. */ - if (imbalance <= NUMA_IMBALANCE_MIN) + if (imbalance <= imb_numa_nr) return 0; return imbalance; @@ -12077,6 +12077,8 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p, int this_cpu) #ifdef CONFIG_NUMA if (sd->flags & SD_NUMA) { int imb_numa_nr = sd->imb_numa_nr; + int local_buys_cpus = local_sgs.group_weight - local_sgs.idle_cpus; + int idlest_buys_cpus = idlest_sgs.group_weight - idlest_sgs.idle_cpus; #ifdef CONFIG_NUMA_BALANCING int idlest_cpu; /* @@ -12106,7 +12108,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p, int this_cpu) imb_numa_nr = min(cpumask_weight(cpus), sd->imb_numa_nr); } - imbalance = abs(local_sgs.idle_cpus - idlest_sgs.idle_cpus); + imbalance = abs(idlest_buys_cpus - local_buys_cpus); if (!adjust_numa_imbalance(imbalance, local_sgs.sum_nr_running + 1, imb_numa_nr)) { @@ -12382,18 +12384,19 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s /* * If there is no overload, we just want to even the number of - * idle cpus. + * busy cpus. */ env->migration_type = migrate_task; env->imbalance = max_t(long, 0, - (local->idle_cpus - busiest->idle_cpus)); + ((busiest->group_weight - busiest->idle_cpus) + - (local->group_weight - local->idle_cpus))); } #ifdef CONFIG_NUMA /* Consider allowing a small imbalance between NUMA groups */ if (env->sd->flags & SD_NUMA) { env->imbalance = adjust_numa_imbalance(env->imbalance, - local->sum_nr_running + 1, + busiest->sum_nr_running, env->sd->imb_numa_nr); } #endif -- 2.18.0.huawei.25

1 1

[PATCH OLK-5.10] net/mlx5e: fix a double-free in arfs_create_groups
by Chen Zhongjin 23 May '24

23 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.8-rc2 commit 3c6d5189246f590e4e1f167991558bdb72a4738b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9IE CVE: CVE-2024-35835 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again. Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c index 2e800d730231d..113269802961a 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -214,11 +214,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS, sizeof(*ft->g), GFP_KERNEL); - in = kvzalloc(inlen, GFP_KERNEL); - if (!in || !ft->g) { - kfree(ft->g); - kvfree(in); + if (!ft->g) return -ENOMEM; + + in = kvzalloc(inlen, GFP_KERNEL); + if (!in) { + err = -ENOMEM; + goto err_free_g; } mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); @@ -238,7 +240,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } switch (type) { @@ -260,7 +262,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, break; default: err = -EINVAL; - goto out; + goto err_free_in; } MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); @@ -269,7 +271,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; memset(in, 0, inlen); @@ -278,18 +280,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, MLX5_SET_CFG(in, end_flow_index, ix - 1); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); if (IS_ERR(ft->g[ft->num_groups])) - goto err; + goto err_clean_group; ft->num_groups++; kvfree(in); return 0; -err: +err_clean_group: err = PTR_ERR(ft->g[ft->num_groups]); ft->g[ft->num_groups] = NULL; -out: +err_free_in: kvfree(in); - +err_free_g: + kfree(ft->g); + ft->g = NULL; return err; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2021-47407
by Yongqiang Liu 23 May '24

23 May '24

Haimin Zhang (1): KVM: x86: Handle SRCU initialization failure during page track init arch/x86/include/asm/kvm_page_track.h | 2 +- arch/x86/kvm/page_track.c | 4 ++-- arch/x86/kvm/x86.c | 7 ++++++- 3 files changed, 9 insertions(+), 4 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser
by Zhao Wenhui 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v4.19.310 commit acc653e8a3aaab1b7103f98645f2cce7be89e3d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q91I CVE: CVE-2024-27428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 119cae5ea3f9e35cdada8e572cc067f072fa825a ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> --- net/netrom/nr_dev.c | 2 +- net/netrom/nr_out.c | 2 +- net/netrom/nr_subr.c | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c index 988f542481a8..fa845edad7bf 100644 --- a/net/netrom/nr_dev.c +++ b/net/netrom/nr_dev.c @@ -84,7 +84,7 @@ static int nr_header(struct sk_buff *skb, struct net_device *dev, buff[6] |= AX25_SSSID_SPARE; buff += AX25_ADDR_LEN; - *buff++ = sysctl_netrom_network_ttl_initialiser; + *buff++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); *buff++ = NR_PROTO_IP; *buff++ = NR_PROTO_IP; diff --git a/net/netrom/nr_out.c b/net/netrom/nr_out.c index 00fbf1419ec6..213bddab6e74 100644 --- a/net/netrom/nr_out.c +++ b/net/netrom/nr_out.c @@ -207,7 +207,7 @@ void nr_transmit_buffer(struct sock *sk, struct sk_buff *skb) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (!nr_route_frame(skb, NULL)) { kfree_skb(skb); diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c index 029c8bb90f4c..c97c427622ee 100644 --- a/net/netrom/nr_subr.c +++ b/net/netrom/nr_subr.c @@ -184,7 +184,8 @@ void nr_write_internal(struct sock *sk, int frametype) *dptr++ = nr->my_id; *dptr++ = frametype; *dptr++ = nr->window; - if (nr->bpqext) *dptr++ = sysctl_netrom_network_ttl_initialiser; + if (nr->bpqext) + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); break; case NR_DISCREQ: @@ -238,7 +239,7 @@ void __nr_transmit_reply(struct sk_buff *skb, int mine, unsigned char cmdflags) dptr[6] |= AX25_SSSID_SPARE; dptr += AX25_ADDR_LEN; - *dptr++ = sysctl_netrom_network_ttl_initialiser; + *dptr++ = READ_ONCE(sysctl_netrom_network_ttl_initialiser); if (mine) { *dptr++ = 0; -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/3] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 23 May '24

23 May '24

Changelog: change __setup() to early_param() Xiongfeng Wang (3): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arch/arm64/Kconfig | 3 +++ include/linux/cpu.h | 3 ++- include/linux/sched/isolation.h | 5 +++++ kernel/sched/isolation.c | 39 +++++++++++++++++++++++++++++---- kernel/smp.c | 4 ++++ kernel/time/tick-sched.c | 3 ++- 6 files changed, 51 insertions(+), 6 deletions(-) -- 2.30.0

2 4

[PATCH OLK-5.10] netrom: Fix a data-race around sysctl_netrom_transport_timeout
by Hui Tang 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v5.10.213 commit 291d36d772f5ea5c68a263ee440f2c9eade371c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q95M CVE: CVE-2024-27427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 60a7a152abd494ed4f69098cf0f322e6bb140612 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 24747163122b..685751096744 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -453,7 +453,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr_init_timers(sk); nr->t1 = - msecs_to_jiffies(sysctl_netrom_transport_timeout); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_timeout)); nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = -- 2.34.1

2 1

[OLK-5.10 v3 0/4] Some bugfixes for openeuler 22.03 sp4
by Chengchang Tang 23 May '24

23 May '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Some bugfixes for openeuler 22.03 sp4. Chengchang Tang (3): RDMA/hns: Fix missing resetting notify RDMA/hns: Use mutex to protect uconctext RDMA/hns: Fix allocating POE channels after IB device registeration wenglianfa (1): RDMA/hns : Fix scc delay_work to execute after sysfs shutdown drivers/infiniband/core/ib_core_uverbs.c | 85 ++++++++++++++++++++ drivers/infiniband/core/rdma_core.h | 1 - drivers/infiniband/core/uverbs_main.c | 64 --------------- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 6 +- drivers/infiniband/hw/hns/hns_roce_device.h | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 14 ++-- drivers/infiniband/hw/hns/hns_roce_main.c | 14 ++-- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 5 ++ include/rdma/ib_verbs.h | 2 + 9 files changed, 110 insertions(+), 83 deletions(-) -- 2.33.0

1 4

[openeuler:OLK-6.6 9705/9710] drivers/irqchip/irq-loongson-eiointc.c:378:58: error: 'NODES_PER_FLATMODE_NODE' undeclared
by kernel test robot 23 May '24

23 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c542a3e5830d4d587bcc2b51a185b671a6c64853 commit: 30affb08c584efdc07b3c68015b5902ea02ec86a [9705/9710] irqchip/loongson-eiointc: fix gsi register error config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20240523/202405231321.wKWdnTl4-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240523/202405231321.wKWdnTl4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405231321.wKWdnTl4-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/irqchip/irq-loongson-eiointc.c:357:12: warning: no previous prototype for 'pch_pic_parse_madt' [-Wmissing-prototypes] 357 | int __init pch_pic_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:370:12: warning: no previous prototype for 'pch_msi_parse_madt' [-Wmissing-prototypes] 370 | int __init pch_msi_parse_madt(union acpi_subtable_headers *header, | ^~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c: In function 'pch_msi_parse_madt': >> drivers/irqchip/irq-loongson-eiointc.c:378:58: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 378 | node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-loongson-eiointc.c:378:58: note: each undeclared identifier is reported only once for each function it appears in drivers/irqchip/irq-loongson-eiointc.c: In function 'eiointc_acpi_init': drivers/irqchip/irq-loongson-eiointc.c:481:45: error: 'NODES_PER_FLATMODE_NODE' undeclared (first use in this function) 481 | node = acpi_eiointc->node / NODES_PER_FLATMODE_NODE; | ^~~~~~~~~~~~~~~~~~~~~~~ vim +/NODES_PER_FLATMODE_NODE +378 drivers/irqchip/irq-loongson-eiointc.c 369 370 int __init pch_msi_parse_madt(union acpi_subtable_headers *header, 371 const unsigned long end) 372 { 373 struct irq_domain *parent; 374 struct acpi_madt_msi_pic *pchmsi_entry = (struct acpi_madt_msi_pic *)header; 375 int node; 376 377 if (cpu_has_flatmode) > 378 node = eiointc_priv[nr_pics - 1]->node / NODES_PER_FLATMODE_NODE; 379 else 380 node = eiointc_priv[nr_pics - 1]->node; 381 382 parent = acpi_get_vec_parent(node, msi_group); 383 384 if (parent) 385 return pch_msi_acpi_init(parent, pchmsi_entry); 386 387 return 0; 388 } 389 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter()
by Zizhi Wo 23 May '24

23 May '24

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v6.1-rc3 commit f950c85e782f90702468bba8243cc97a8d0d04b0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RJQB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There is a kmemleak when writedata alloc failed: unreferenced object 0xffff888175ae4000 (size 4096): comm "dd", pid 19419, jiffies 4296028749 (age 739.396s) hex dump (first 32 bytes): 80 02 b0 04 00 ea ff ff c0 02 b0 04 00 ea ff ff ................ 80 22 4c 04 00 ea ff ff c0 22 4c 04 00 ea ff ff ."L......"L..... backtrace: [<0000000072fdbb86>] __kmalloc_node+0x50/0x150 [<0000000039faf56f>] __iov_iter_get_pages_alloc+0x605/0xdd0 [<00000000f862a9d4>] iov_iter_get_pages_alloc2+0x3b/0x80 [<000000008f226067>] cifs_write_from_iter+0x2ae/0xe40 [<000000001f78f2f1>] __cifs_writev+0x337/0x5c0 [<00000000257fcef5>] vfs_write+0x503/0x690 [<000000008778a238>] ksys_write+0xb9/0x150 [<00000000ed82047c>] do_syscall_64+0x35/0x80 [<000000003365551d>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 __iov_iter_get_pages_alloc+0x605/0xdd0 is: want_pages_array at lib/iov_iter.c:1304 (inlined by) __iov_iter_get_pages_alloc at lib/iov_iter.c:1457 If writedata allocate failed, the pages and pagevec should be cleanup. Fixes: 8c5f9c1ab7cb ("CIFS: Add support for direct I/O write") Reviewed-by: Paulo Alcantara (SUSE) <pc(a)cjr.nz> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/file.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index a56738244f3a..e914f4f5cc83 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -2982,6 +2982,9 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from, cifs_uncached_writev_complete); if (!wdata) { rc = -ENOMEM; + for (i = 0; i < nr_pages; i++) + put_page(pagevec[i]); + kvfree(pagevec); add_credits_and_wake_if(server, credits, 0); break; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] netrom: Fix a data-race around sysctl_netrom_transport_timeout
by Hui Tang 23 May '24

23 May '24

From: Jason Xing <kernelxing(a)tencent.com> stable inclusion from stable-v4.19.310 commit 500936692ccca8617a955652d1929f079b17a201 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q95M CVE: CVE-2024-27427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 60a7a152abd494ed4f69098cf0f322e6bb140612 ] We need to protect the reader reading the sysctl value because the value can be changed concurrently. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jason Xing <kernelxing(a)tencent.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 8f18fea17cfc..82daed1296f5 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -456,7 +456,7 @@ static int nr_create(struct net *net, struct socket *sock, int protocol, nr_init_timers(sk); nr->t1 = - msecs_to_jiffies(sysctl_netrom_transport_timeout); + msecs_to_jiffies(READ_ONCE(sysctl_netrom_transport_timeout)); nr->t2 = msecs_to_jiffies(sysctl_netrom_transport_acknowledge_delay); nr->n2 = -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/4] LoongArch: fix kdump not work when legacy mode disabled
by Hongchen Zhang 23 May '24

23 May '24

Hongchen Zhang (4): Revert "LoongArch: kdump: Add high memory reservation" Revert "LoongArch: Fix kdump failure on v40 interface specification" Revert "LoongArch: kdump: Add memory reservation for old kernel" LoongArch: fix efi map page table error arch/loongarch/kernel/efi.c | 39 ++++++++++++--- arch/loongarch/kernel/setup.c | 94 +++++------------------------------ 2 files changed, 44 insertions(+), 89 deletions(-) -- 2.33.0

2 5

[PATCH OLK-6.6] LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors
by Hongchen Zhang 23 May '24

23 May '24

From: Juxin Gao <gaojuxin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7M9 ------------------------------------------ When we test wangxun network card ,we get failed. The reason is wangxun driver request a large minvec (33 or bigger), and it failed on LoongArch machine. Usually, it is not necessary to set the minimum number of MSI-X interrupts used to such a large number, so we limit it Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- drivers/pci/msi/msi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index cde8c4e264b7..7078200be11f 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -424,8 +424,10 @@ int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, int rc; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { maxvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (!pci_msi_supported(dev, minvec) || dev->current_state != PCI_D0) @@ -810,8 +812,10 @@ int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int int hwsize, rc, nvec = maxvec; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { nvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (maxvec < minvec) -- 2.33.0

2 1

[PATCH] LoongArch: limit min pci msi-x/msi vector number when request more than 32 vectors
by Hongchen Zhang 23 May '24

23 May '24

From: Juxin Gao <gaojuxin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7M9 ------------------------------------------ When we test wangxun network card ,we get failed. The reason is wangxun driver request a large minvec (33 or bigger), and it failed on LoongArch machine. Usually, it is not necessary to set the minimum number of MSI-X interrupts used to such a large number, so we limit it Signed-off-by: Juxin Gao <gaojuxin(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- drivers/pci/msi/msi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index cde8c4e264b7..7078200be11f 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -424,8 +424,10 @@ int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, int rc; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { maxvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (!pci_msi_supported(dev, minvec) || dev->current_state != PCI_D0) @@ -810,8 +812,10 @@ int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int int hwsize, rc, nvec = maxvec; #ifdef CONFIG_LOONGARCH - if (maxvec > 32) + if (maxvec > 32) { nvec = pci_irq_numbers; + minvec = min_t(int, pci_irq_numbers, minvec); + } #endif if (maxvec < minvec) -- 2.33.0

1 0

[PATCH OLK-6.6] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- Documentation/admin-guide/mm/transhuge.rst | 19 +++++++++++-------- include/linux/huge_mm.h | 5 +++++ mm/huge_memory.c | 14 ++++++++++++-- mm/mmap.c | 2 +- 4 files changed, 29 insertions(+), 11 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..aeff60881fd0 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: - - echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align +The kernel could try to enable mappings for different sizes, eg, 64K for +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K for arm64 is dependent on +BIT3 being turned on, the above feature are disabled by default, and +could enable the above feature by writing the corresponding bit to 1:: + + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x5 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x7 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..6dcdcc47dd5e 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..67e09693215c 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,11 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_64K_ALIGN \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +537,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +552,15 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (val & THP_MAPPING_64K_ALIGN)) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[openeuler:OLK-6.6 9677/9706] arch/arm64/kernel/cpufeature.c:2129:13: warning: unused variable 'enable_pseudo_nmi'
by kernel test robot 23 May '24

23 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b51533d469099a915373a13041776b93b232ff65 commit: c6ce2becb89528f83c1ad3c0607ad05baecebc0a [9677/9706] arm64/cpufeature: Fix pseudo nmi identifier undeclaration complilation error config: arm64-randconfig-001-20240523 (https://download.01.org/0day-ci/archive/20240523/202405230925.19JMExYE-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project fa9b1be45088dce1e4b602d451f118128b94237b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240523/202405230925.19JMExYE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405230925.19JMExYE-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/cpufeature.c:67: In file included from include/linux/crash_dump.h:5: In file included from include/linux/kexec.h:18: In file included from include/linux/crash_core.h:6: In file included from include/linux/elfcore.h:11: In file included from include/linux/ptrace.h:10: In file included from include/linux/pid_namespace.h:7: In file included from include/linux/mm.h:2234: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/cpufeature.c:2129:13: warning: unused variable 'enable_pseudo_nmi' [-Wunused-variable] 2129 | static bool enable_pseudo_nmi; | ^~~~~~~~~~~~~~~~~ 5 warnings generated. vim +/enable_pseudo_nmi +2129 arch/arm64/kernel/cpufeature.c 3e6c69a058deaa Mark Brown 2019-12-09 2127 f72387e1f8bc99 Mark Brown 2022-11-03 2128 #if IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) || IS_ENABLED(CONFIG_ARM64_NMI) bc3c03ccb4641f Julien Thierry 2019-01-31 @2129 static bool enable_pseudo_nmi; f72387e1f8bc99 Mark Brown 2022-11-03 2130 #endif bc3c03ccb4641f Julien Thierry 2019-01-31 2131 :::::: The code at line 2129 was first introduced by commit :::::: bc3c03ccb4641fb940b27a0d369431876923a8fe arm64: Enable the support of pseudo-NMIs :::::: TO: Julien Thierry <julien.thierry(a)arm.com> :::::: CC: Catalin Marinas <catalin.marinas(a)arm.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 19459/22464] mm/memory_hotplug.c:1278:30: warning: 'start' may be used uninitialized
by kernel test robot 23 May '24

23 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 80ab23a867e779b7d5f818a57bd578a57143becb commit: 5f0e34d2aceec67c169be7599d82f0e8519c37f7 [19459/22464] mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning config: x86_64-buildonly-randconfig-003-20240523 (https://download.01.org/0day-ci/archive/20240523/202405230933.fLM0leXg-lkp@…) compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240523/202405230933.fLM0leXg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405230933.fLM0leXg-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): mm/memory_hotplug.c: In function '__remove_section': mm/memory_hotplug.c:481:23: warning: variable 'start_pfn' set but not used [-Wunused-but-set-variable] 481 | unsigned long start_pfn; | ^~~~~~~~~ mm/memory_hotplug.c: In function 'test_pages_in_a_zone': >> mm/memory_hotplug.c:1278:30: warning: 'start' may be used uninitialized [-Wmaybe-uninitialized] 1278 | *valid_start = start; | ~~~~~~~~~~~~~^~~~~~~ mm/memory_hotplug.c:1245:23: note: 'start' was declared here 1245 | unsigned long start, end; | ^~~~~ vim +/start +1278 mm/memory_hotplug.c 5c755e9fd81381 Badari Pulavarty 2008-07-23 1236 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1237 /* deb88a2a19e858 Toshi Kani 2017-02-03 1238 * Confirm all pages in a range [start, end) belong to the same zone. a96dfddbcc0433 Toshi Kani 2017-02-03 1239 * When true, return its valid [start, end). 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1240 */ a96dfddbcc0433 Toshi Kani 2017-02-03 1241 int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, a96dfddbcc0433 Toshi Kani 2017-02-03 1242 unsigned long *valid_start, unsigned long *valid_end) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1243 { 5f0f2887f4de95 Andrew Banman 2015-12-29 1244 unsigned long pfn, sec_end_pfn; a96dfddbcc0433 Toshi Kani 2017-02-03 1245 unsigned long start, end; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1246 struct zone *zone = NULL; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1247 struct page *page; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1248 int i; deb88a2a19e858 Toshi Kani 2017-02-03 1249 for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1); 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1250 pfn < end_pfn; deb88a2a19e858 Toshi Kani 2017-02-03 1251 pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) { 5f0f2887f4de95 Andrew Banman 2015-12-29 1252 /* Make sure the memory section is present first */ 5f0f2887f4de95 Andrew Banman 2015-12-29 1253 if (!present_section_nr(pfn_to_section_nr(pfn))) 5f0f2887f4de95 Andrew Banman 2015-12-29 1254 continue; 5f0f2887f4de95 Andrew Banman 2015-12-29 1255 for (; pfn < sec_end_pfn && pfn < end_pfn; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1256 pfn += MAX_ORDER_NR_PAGES) { 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1257 i = 0; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1258 /* This is just a CONFIG_HOLES_IN_ZONE check.*/ 5f0f2887f4de95 Andrew Banman 2015-12-29 1259 while ((i < MAX_ORDER_NR_PAGES) && 5f0f2887f4de95 Andrew Banman 2015-12-29 1260 !pfn_valid_within(pfn + i)) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1261 i++; d6d8c8a48291b9 zhong jiang 2017-02-24 1262 if (i == MAX_ORDER_NR_PAGES || pfn + i >= end_pfn) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1263 continue; 65e9b09942c6df Mikhail Zaslonko 2019-02-13 1264 /* Check if we got outside of the zone */ 65e9b09942c6df Mikhail Zaslonko 2019-02-13 1265 if (zone && !zone_spans_pfn(zone, pfn + i)) 65e9b09942c6df Mikhail Zaslonko 2019-02-13 1266 return 0; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1267 page = pfn_to_page(pfn + i); 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1268 if (zone && page_zone(page) != zone) 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1269 return 0; a96dfddbcc0433 Toshi Kani 2017-02-03 1270 if (!zone) a96dfddbcc0433 Toshi Kani 2017-02-03 1271 start = pfn + i; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1272 zone = page_zone(page); a96dfddbcc0433 Toshi Kani 2017-02-03 1273 end = pfn + MAX_ORDER_NR_PAGES; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1274 } 5f0f2887f4de95 Andrew Banman 2015-12-29 1275 } deb88a2a19e858 Toshi Kani 2017-02-03 1276 a96dfddbcc0433 Toshi Kani 2017-02-03 1277 if (zone) { a96dfddbcc0433 Toshi Kani 2017-02-03 @1278 *valid_start = start; d6d8c8a48291b9 zhong jiang 2017-02-24 1279 *valid_end = min(end, end_pfn); 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1280 return 1; a96dfddbcc0433 Toshi Kani 2017-02-03 1281 } else { deb88a2a19e858 Toshi Kani 2017-02-03 1282 return 0; 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1283 } a96dfddbcc0433 Toshi Kani 2017-02-03 1284 } 0c0e6195896535 KAMEZAWA Hiroyuki 2007-10-16 1285 :::::: The code at line 1278 was first introduced by commit :::::: a96dfddbcc04336bbed50dc2b24823e45e09e80c base/memory, hotplug: fix a kernel oops in show_valid_zones() :::::: TO: Toshi Kani <toshi.kani(a)hpe.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS db8faa5982edf652cdab6a767183575299a2be5b
by kernel test robot 23 May '24

23 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: db8faa5982edf652cdab6a767183575299a2be5b !7743 netrom: Fix data-races around sysctl_net_busy_read Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 829m configs tested: 11 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240523 clang arm64 randconfig-002-20240523 gcc arm64 randconfig-003-20240523 clang arm64 randconfig-004-20240523 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION b51533d469099a915373a13041776b93b232ff65
by kernel test robot 23 May '24

23 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: b51533d469099a915373a13041776b93b232ff65 !7771 ext4: default enable iomap for buffered IO and large folio Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used `-- arm64-randconfig-002-20240523 `-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used clang_recent_errors `-- arm64-allmodconfig |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box `-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create elapsed time: 821m configs tested: 15 configs skipped: 104 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-002-20240523 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240523 gcc x86_64 buildonly-randconfig-002-20240523 gcc x86_64 buildonly-randconfig-003-20240523 gcc x86_64 buildonly-randconfig-004-20240523 clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 80ab23a867e779b7d5f818a57bd578a57143becb
by kernel test robot 23 May '24

23 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 80ab23a867e779b7d5f818a57bd578a57143becb !7742 netrom: Fix data-races around sysctl_net_busy_read Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-003-20240523 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- arm64-randconfig-004-20240523 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension `-- x86_64-buildonly-randconfig-004-20240521 `-- drivers-spi-spi-phytium-plat.o:warning:objtool:missing-symbol-for-section-.init.text elapsed time: 797m configs tested: 15 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240523 gcc arm64 randconfig-002-20240523 gcc arm64 randconfig-003-20240523 gcc arm64 randconfig-004-20240523 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240523 gcc x86_64 buildonly-randconfig-002-20240523 gcc x86_64 buildonly-randconfig-003-20240523 gcc x86_64 buildonly-randconfig-004-20240523 clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] netfilter: nft_flow_offload: reset dst in route object after setting up flow
by Liu Jian 22 May '24

22 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8-rc6 commit 9e0f0430389be7696396c62f037be4bf72cf93e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LQ CVE: CVE-2024-27403 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow. Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_flow_table.h net/netfilter/nf_flow_table_core.c [This is because we did not backport f1363e058b84, fa502c865666, 8b9229d15877, 7a27f6ab4135] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nf_flow_table_core.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index b3957fe7eced..4f4869853cbe 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -21,6 +21,16 @@ struct flow_offload_entry { static DEFINE_MUTEX(flowtable_lock); static LIST_HEAD(flowtables); +static struct dst_entry *nft_route_dst_fetch(struct nf_flow_route *route, + enum flow_offload_tuple_dir dir) +{ + struct dst_entry *dst = route->tuple[dir].dst; + + route->tuple[dir].dst = NULL; + + return dst; +} + static void flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, struct nf_flow_route *route, @@ -29,7 +39,7 @@ flow_offload_fill_dir(struct flow_offload *flow, struct nf_conn *ct, struct flow_offload_tuple *ft = &flow->tuplehash[dir].tuple; struct nf_conntrack_tuple *ctt = &ct->tuplehash[dir].tuple; struct dst_entry *other_dst = route->tuple[!dir].dst; - struct dst_entry *dst = route->tuple[dir].dst; + struct dst_entry *dst = nft_route_dst_fetch(route, dir); ft->dir = dir; -- 2.34.1

2 1

[PATCH OLK-5.10] f2fs: fix to wait on block writeback for post_read case
by Zizhi Wo 22 May '24

22 May '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.1.75 commit 9bfd5ea71521d0e522ba581c6ccc5db93759c0c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I6 CVE: CVE-2023-52682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00 ] If inode is compressed, but not encrypted, it missed to call f2fs_wait_on_block_writeback() to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fs_gc - do_garbage_collect - gc_data_segment - move_data_block - f2fs_submit_page_write migrate normal cluster's block via meta_inode's page cache - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_submit_page_bio IRQ - f2fs_read_end_io IRQ old data overrides new data due to out-of-order GC and common IO. - f2fs_read_end_io Fixes: 4c8ff7095bef ("f2fs: support data compression") Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/data.c [f2fs_handle_error function does not exist. The conflict is not related to the patch] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/data.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 18c031a0bf56..67eaddc47717 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2541,9 +2541,6 @@ int f2fs_encrypt_one_page(struct f2fs_io_info *fio) page = fio->compressed_page ? fio->compressed_page : fio->page; - /* wait for GCed page writeback via META_MAPPING */ - f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); - if (fscrypt_inode_uses_inline_crypto(inode)) return 0; @@ -2702,6 +2699,11 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio) err = -EFSCORRUPTED; goto out_writepage; } + + /* wait for GCed page writeback via META_MAPPING */ + if (fio->post_read) + f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); + /* * If current allocation needs SSR, * it had better in-place writes for updated data. -- 2.39.2

2 1

[PATCH OLK-5.10] f2fs: fix to wait on block writeback for post_read case
by Zizhi Wo 22 May '24

22 May '24

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.1.75 commit 9bfd5ea71521d0e522ba581c6ccc5db93759c0c3 category: bugfix bugzilla: 189947 CVE: CVE-2023-52682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00 ] If inode is compressed, but not encrypted, it missed to call f2fs_wait_on_block_writeback() to wait for GCed page writeback in IPU write path. Thread A GC-Thread - f2fs_gc - do_garbage_collect - gc_data_segment - move_data_block - f2fs_submit_page_write migrate normal cluster's block via meta_inode's page cache - f2fs_write_single_data_page - f2fs_do_write_data_page - f2fs_inplace_write_data - f2fs_submit_page_bio IRQ - f2fs_read_end_io IRQ old data overrides new data due to out-of-order GC and common IO. - f2fs_read_end_io Fixes: 4c8ff7095bef ("f2fs: support data compression") Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/f2fs/data.c [f2fs_handle_error function does not exist. The conflict is not related to the patch] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/f2fs/data.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c index 18c031a0bf56..67eaddc47717 100644 --- a/fs/f2fs/data.c +++ b/fs/f2fs/data.c @@ -2541,9 +2541,6 @@ int f2fs_encrypt_one_page(struct f2fs_io_info *fio) page = fio->compressed_page ? fio->compressed_page : fio->page; - /* wait for GCed page writeback via META_MAPPING */ - f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); - if (fscrypt_inode_uses_inline_crypto(inode)) return 0; @@ -2702,6 +2699,11 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio) err = -EFSCORRUPTED; goto out_writepage; } + + /* wait for GCed page writeback via META_MAPPING */ + if (fio->post_read) + f2fs_wait_on_block_writeback(inode, fio->old_blkaddr); + /* * If current allocation needs SSR, * it had better in-place writes for updated data. -- 2.39.2

2 1

[PATCH OLK-5.10 0/1] Fix allmodconfig build error
by Shuai Wu 22 May '24

22 May '24

Fix allmodconfig build error in hiroce3 driver. Fixes: ae52f9c522dd ("infiniband/hw/hiroce3: Add Huawei Intelligent Network Card RDMA Driver") Shuai Wu (1): net/ethernet/huawei/hiroce3: Fix allmodconfig build error .../hw/hiroce3/bond/roce_bond_common.c | 38 +- .../hw/hiroce3/cq/roce_cq_destroy.c | 15 +- .../hw/hiroce3/host/hmm/hmm_comp_mtt.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_mw_mr.c | 1 + .../hw/hiroce3/host/hmm/hmm_comp_res.c | 1 + .../infiniband/hw/hiroce3/host/hmm/hmm_mr.c | 98 +---- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.c | 4 +- .../infiniband/hw/hiroce3/host/hmm/hmm_umem.h | 2 +- .../include/rdma/rdma_context_format.h | 4 +- .../include/rdma/rdma_ext_ctx_format.h | 5 +- .../hw/hiroce3/include/rdma/roce_ccf_format.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_attr.h | 4 +- .../include/rdma/roce_verbs_attr_qpc_chip.h | 4 +- .../hiroce3/include/rdma/roce_verbs_cq_attr.h | 4 +- .../include/rdma/roce_verbs_ext_attr.h | 4 +- .../include/rdma/roce_verbs_gid_attr.h | 4 +- .../hiroce3/include/rdma/roce_verbs_mr_attr.h | 4 +- .../hw/hiroce3/include/rdma/roce_verbs_pub.h | 4 +- .../include/rdma/roce_verbs_srq_attr.h | 4 +- drivers/infiniband/hw/hiroce3/mr/roce_mr.c | 37 -- drivers/infiniband/hw/hiroce3/roce.h | 1 - drivers/infiniband/hw/hiroce3/roce_main.c | 7 +- .../ethernet/huawei/hinic3/bond/hinic3_bond.c | 1 - .../ethernet/huawei/hinic3/bond/hinic3_bond.h | 4 +- .../ethernet/huawei/hinic3/cqm/cqm_bat_cla.c | 198 +++------ .../huawei/hinic3/cqm/cqm_bitmap_table.c | 10 +- .../huawei/hinic3/cqm/cqm_bloomfilter.c | 69 +--- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.c | 139 ++----- .../net/ethernet/huawei/hinic3/cqm/cqm_cmd.h | 2 - .../net/ethernet/huawei/hinic3/cqm/cqm_db.c | 192 +++------ .../ethernet/huawei/hinic3/cqm/cqm_define.h | 4 - .../net/ethernet/huawei/hinic3/cqm/cqm_main.c | 178 +++------ .../ethernet/huawei/hinic3/cqm/cqm_object.c | 378 +++++------------- .../huawei/hinic3/cqm/cqm_object_intern.c | 194 +++------ .../ethernet/huawei/hinic3/hw/hinic3_hw_cfg.c | 2 +- .../ethernet/huawei/hinic3/hw/hinic3_hwif.c | 38 -- .../huawei/hinic3/hw/hinic3_multi_host_mgmt.c | 56 ++- .../hinic3/include/bond/bond_common_defs.h | 4 +- .../huawei/hinic3/include/hinic3_common.h | 2 - .../huawei/hinic3/include/hinic3_cqm.h | 11 - .../huawei/hinic3/include/hinic3_cqm_define.h | 4 - .../include/mpu/mpu_outband_ncsi_cmd_defs.h | 4 +- 42 files changed, 474 insertions(+), 1266 deletions(-) -- 2.33.0

2 2

[PATCH OLK-5.10] kobject: Fix global-out-of-bounds in kobject_action_type()
by Xia Fukun 22 May '24

22 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9REGZ CVE: NA -------------------------------- The following c language code can trigger KASAN's global variable out-of-bounds access error in kobject_action_type(): int main() { int fd; char *filename = "/sys/block/ram12/uevent"; char str[86] = "offline"; int len = 86; fd = open(filename, O_WRONLY); if (fd == -1) { printf("open"); exit(1); } if (write(fd, str, len) == -1) { printf("write"); exit(1); } close(fd); return 0; } Function kobject_action_type() receives the input parameters buf and count, where count is the length of the string buf. In the use case we provided, count is 86, the count_first is 85. Buf points to a string with a length of 86, and its first seven characters are "offline". In line 87 of the code, kobject_actions[action] is the string "offline" with the length of 7,an out-of-boundary access will appear: kobject_actions[action][85]. Modify the judgment logic in line 87. If the length of the string kobject_actions[action] is greater than count_first(e.g. buf is "off", count is 3), continue the loop. Otherwise, the match is considered successful. This change means that our test case will be successfully parsed as an offline event and no out-of-bounds access error will occur. Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents") Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- lib/kobject_uevent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index c87d5b6a8a55..8056def4c028 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -84,7 +84,7 @@ static int kobject_action_type(const char *buf, size_t count, for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) { if (strncmp(kobject_actions[action], buf, count_first) != 0) continue; - if (kobject_actions[action][count_first] != '\0') + if (strlen(kobject_actions[action]) > count_first) continue; if (args) *args = args_start; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 22 May '24

22 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.299 commit 2f236d8638f5b43e0c72919a6a27fe286c32053f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RDP6 CVE: CVE-2023-52840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index bd0d5ff01b08..02408487b442 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -279,11 +279,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] Bluetooth: L2CAP: Fix not validating setsockopt user input
by Zhao Mengmeng 22 May '24

22 May '24

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.9-rc4 commit 4f3951242ace5efc7131932e2e01e6ac6baed846 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRQE CVE: CVE-2024-35965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Check user input length before copying data. Fixes: 33575df7be67 ("Bluetooth: move l2cap_sock_setsockopt() to l2cap_sock.c") Fixes: 3ee7b7cd8390 ("Bluetooth: Add BT_MODE socket option") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/l2cap_sock.c | 52 +++++++++++++++----------------------- 1 file changed, 20 insertions(+), 32 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index d647bd15d500..006ace2c0f95 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -727,7 +727,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, struct sock *sk = sock->sk; struct l2cap_chan *chan = l2cap_pi(sk)->chan; struct l2cap_options opts; - int len, err = 0; + int err = 0; u32 opt; BT_DBG("sk %p", sk); @@ -754,11 +754,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, opts.max_tx = chan->max_tx; opts.txwin_size = chan->tx_win; - len = min_t(unsigned int, sizeof(opts), optlen); - if (copy_from_sockptr(&opts, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen); + if (err) break; - } if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) { err = -EINVAL; @@ -801,10 +799,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, break; case L2CAP_LM: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt & L2CAP_LM_FIPS) { err = -EINVAL; @@ -885,7 +882,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, struct bt_security sec; struct bt_power pwr; struct l2cap_conn *conn; - int len, err = 0; + int err = 0; u32 opt; u16 mtu; u8 mode; @@ -911,11 +908,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, sec.level = BT_SECURITY_LOW; - len = min_t(unsigned int, sizeof(sec), optlen); - if (copy_from_sockptr(&sec, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen); + if (err) break; - } if (sec.level < BT_SECURITY_LOW || sec.level > BT_SECURITY_FIPS) { @@ -960,10 +955,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt) { set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags); @@ -975,10 +969,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_FLUSHABLE: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } if (opt > BT_FLUSHABLE_ON) { err = -EINVAL; @@ -1010,11 +1003,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, pwr.force_active = BT_POWER_FORCE_ACTIVE_ON; - len = min_t(unsigned int, sizeof(pwr), optlen); - if (copy_from_sockptr(&pwr, optval, len)) { - err = -EFAULT; + err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen); + if (err) break; - } if (pwr.force_active) set_bit(FLAG_FORCE_ACTIVE, &chan->flags); @@ -1023,10 +1014,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; case BT_CHANNEL_POLICY: - if (copy_from_sockptr(&opt, optval, sizeof(u32))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen); + if (err) break; - } err = -EOPNOTSUPP; break; @@ -1055,10 +1045,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mtu, optval, sizeof(u16))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen); + if (err) break; - } if (chan->mode == L2CAP_MODE_EXT_FLOWCTL && sk->sk_state == BT_CONNECTED) @@ -1086,10 +1075,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, break; } - if (copy_from_sockptr(&mode, optval, sizeof(u8))) { - err = -EFAULT; + err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen); + if (err) break; - } BT_DBG("mode %u", mode); -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 22 May '24

22 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v4.19.299 commit 2f236d8638f5b43e0c72919a6a27fe286c32053f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RDP6 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index bd0d5ff01b08..02408487b442 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -279,11 +279,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH v2 openEuler-22.03-LTS-SP2] selinux: avoid dereference of garbage after mount failure
by felix 22 May '24

22 May '24

From: Christian Göttsche <cgzones(a)googlemail.com> stable inclusion from stable-v6.6.26 commit 477ed6789eb9f3f4d3568bb977f90c863c12724e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG73 CVE: CVE-2024-35904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 37801a36b4d68892ce807264f784d818f8d0d39b upstream. In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount. Cc: stable(a)vger.kernel.org Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state") Signed-off-by: Christian Göttsche <cgzones(a)googlemail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: security/selinux/selinuxfs.c [selinuxfs_mount still in use because of SECURITY_SELINUX_DISABLE, so we reserve it, only deal with kern_mount failure issue] Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/selinux/selinuxfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index d893c2280f59..97d169679265 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -2232,13 +2232,17 @@ static int __init init_sel_fs(void) pr_err("selinuxfs: could not mount!\n"); err = PTR_ERR(selinuxfs_mount); selinuxfs_mount = NULL; + selinux_null.mnt = NULL; + return err; } + selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root, &null_name); if (IS_ERR(selinux_null.dentry)) { pr_err("selinuxfs: could not lookup null!\n"); err = PTR_ERR(selinux_null.dentry); selinux_null.dentry = NULL; + return err; } return err; -- 2.34.1

2 1

[PATCH OLK-5.10] drm/client: Fully protect modes[] with dev->mode_config.mutex
by Zhao Mengmeng 22 May '24

22 May '24

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> stable inclusion from stable-v5.10.216 commit 41586487769eede64ab1aa6c65c74cbf76c12ef0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRRC CVE: CVE-2024-35950 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3eadd887dbac1df8f25f701e5d404d1b90fd0fea upstream. The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time we use it the elements may already be pointing to freed/reused memory. Cc: stable(a)vger.kernel.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/10583 Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240404203336.10454-2-ville.… Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Reviewed-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- drivers/gpu/drm/drm_client_modeset.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c index d5fd41823624..7872a04e9a72 100644 --- a/drivers/gpu/drm/drm_client_modeset.c +++ b/drivers/gpu/drm/drm_client_modeset.c @@ -774,6 +774,7 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, unsigned int total_modes_count = 0; struct drm_client_offset *offsets; unsigned int connector_count = 0; + /* points to modes protected by mode_config.mutex */ struct drm_display_mode **modes; struct drm_crtc **crtcs; int i, ret = 0; @@ -842,7 +843,6 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, drm_client_pick_crtcs(client, connectors, connector_count, crtcs, modes, 0, width, height); } - mutex_unlock(&dev->mode_config.mutex); drm_client_modeset_release(client); @@ -872,6 +872,7 @@ int drm_client_modeset_probe(struct drm_client_dev *client, unsigned int width, modeset->y = offset->y; } } + mutex_unlock(&dev->mode_config.mutex); mutex_unlock(&client->modeset_mutex); out: -- 2.33.0

2 1

[PATCH v2 openEuler-1.0-LTS] selinux: avoid dereference of garbage after mount failure
by felix 22 May '24

22 May '24

From: Christian Göttsche <cgzones(a)googlemail.com> stable inclusion from stable-v6.6.26 commit 477ed6789eb9f3f4d3568bb977f90c863c12724e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG73 CVE: CVE-2024-35904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 37801a36b4d68892ce807264f784d818f8d0d39b upstream. In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount. Cc: stable(a)vger.kernel.org Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state") Signed-off-by: Christian Göttsche <cgzones(a)googlemail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: security/selinux/selinuxfs.c [selinuxfs_mount still in use because of SECURITY_SELINUX_DISABLE, so we reserve it, only deal with kern_mount failure issue] Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/selinux/selinuxfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index d893c2280f59..97d169679265 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -2232,13 +2232,17 @@ static int __init init_sel_fs(void) pr_err("selinuxfs: could not mount!\n"); err = PTR_ERR(selinuxfs_mount); selinuxfs_mount = NULL; + selinux_null.mnt = NULL; + return err; } + selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root, &null_name); if (IS_ERR(selinux_null.dentry)) { pr_err("selinuxfs: could not lookup null!\n"); err = PTR_ERR(selinux_null.dentry); selinux_null.dentry = NULL; + return err; } return err; -- 2.34.1

2 1

[PATCH v2 OLK-5.10] selinux: avoid dereference of garbage after mount failure
by felix 22 May '24

22 May '24

From: Christian Göttsche <cgzones(a)googlemail.com> stable inclusion from stable-v6.6.26 commit 477ed6789eb9f3f4d3568bb977f90c863c12724e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QG73 CVE: CVE-2024-35904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 37801a36b4d68892ce807264f784d818f8d0d39b upstream. In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount. Cc: stable(a)vger.kernel.org Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state") Signed-off-by: Christian Göttsche <cgzones(a)googlemail.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: security/selinux/selinuxfs.c [selinuxfs_mount still in use because of SECURITY_SELINUX_DISABLE, so we reserve it, only deal with kern_mount failure issue] Signed-off-by: Felix Fu <fuzhen5(a)huawei.com> --- security/selinux/selinuxfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index d893c2280f59..97d169679265 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -2232,13 +2232,17 @@ static int __init init_sel_fs(void) pr_err("selinuxfs: could not mount!\n"); err = PTR_ERR(selinuxfs_mount); selinuxfs_mount = NULL; + selinux_null.mnt = NULL; + return err; } + selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root, &null_name); if (IS_ERR(selinux_null.dentry)) { pr_err("selinuxfs: could not lookup null!\n"); err = PTR_ERR(selinux_null.dentry); selinux_null.dentry = NULL; + return err; } return err; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 13 ++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] netfilter: nft_flow_offload: reset dst in route object after setting up flow
by Liu Jian 22 May '24

22 May '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.8-rc6 commit 9e0f0430389be7696396c62f037be4bf72cf93e3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8LQ CVE: CVE-2024-27403 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise if flow_offload_add() fails, error path releases dst twice, leading to a refcount underflow. Fixes: a3c90f7a2323 ("netfilter: nf_tables: flow offload expression") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/net/netfilter/nf_flow_table.h net/netfilter/nf_flow_table_core.c [This is because we did not backport fa502c865666, 8b9229d15877, 7a27f6ab4135] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/netfilter/nf_flow_table.h | 2 +- net/netfilter/nf_flow_table_core.c | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/include/net/netfilter/nf_flow_table.h b/include/net/netfilter/nf_flow_table.h index b338638f2279..b49dfb415bad 100644 --- a/include/net/netfilter/nf_flow_table.h +++ b/include/net/netfilter/nf_flow_table.h @@ -207,7 +207,7 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table, } int flow_offload_route_init(struct flow_offload *flow, - const struct nf_flow_route *route); + struct nf_flow_route *route); int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow); void flow_offload_refresh(struct nf_flowtable *flow_table, diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c index d091d51b5e19..5a5faefb181d 100644 --- a/net/netfilter/nf_flow_table_core.c +++ b/net/netfilter/nf_flow_table_core.c @@ -74,13 +74,23 @@ struct flow_offload *flow_offload_alloc(struct nf_conn *ct) } EXPORT_SYMBOL_GPL(flow_offload_alloc); +static struct dst_entry *nft_route_dst_fetch(struct nf_flow_route *route, + enum flow_offload_tuple_dir dir) +{ + struct dst_entry *dst = route->tuple[dir].dst; + + route->tuple[dir].dst = NULL; + + return dst; +} + static int flow_offload_fill_route(struct flow_offload *flow, - const struct nf_flow_route *route, + struct nf_flow_route *route, enum flow_offload_tuple_dir dir) { struct flow_offload_tuple *flow_tuple = &flow->tuplehash[dir].tuple; struct dst_entry *other_dst = route->tuple[!dir].dst; - struct dst_entry *dst = route->tuple[dir].dst; + struct dst_entry *dst = nft_route_dst_fetch(route, dir); if (!dst_hold_safe(route->tuple[dir].dst)) return -1; @@ -101,7 +111,7 @@ static int flow_offload_fill_route(struct flow_offload *flow, } int flow_offload_route_init(struct flow_offload *flow, - const struct nf_flow_route *route) + struct nf_flow_route *route) { int err; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS 0/1] net-memcg: Fix scope of sockmem pressure indicators
by Chen Ridong 22 May '24

22 May '24

*** BLURB HERE *** Abel Wu (1): net-memcg: Fix scope of sockmem pressure indicators include/linux/memcontrol.h | 9 +++++++-- mm/vmpressure.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 3 deletions(-) -- 2.34.1

2 2