- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ata: libata-sff: Ensure that we cannot write outside the allocated buffer
by Zheng Qixing 06 Mar '25

06 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> stable inclusion from stable-v6.6.78 commit d5e6e3000309359eae2a17117aa6e3c44897bf6c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ CVE: CVE-2025-21738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream. reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer. Cc: stable(a)vger.kernel.org Reported-by: reveliofuzzing <reveliofuzzing(a)gmail.com> Closes: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63… Link: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/ata/libata-sff.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c index 8fcc622fcb3d..9b6529f2dfcb 100644 --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -602,7 +602,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) { struct ata_port *ap = qc->ap; struct page *page; - unsigned int offset; + unsigned int offset, count; if (!qc->cursg) { qc->curbytes = qc->nbytes; @@ -618,25 +618,27 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) page = nth_page(page, (offset >> PAGE_SHIFT)); offset %= PAGE_SIZE; - trace_ata_sff_pio_transfer_data(qc, offset, qc->sect_size); + /* don't overrun current sg */ + count = min(qc->cursg->length - qc->cursg_ofs, qc->sect_size); + + trace_ata_sff_pio_transfer_data(qc, offset, count); /* * Split the transfer when it splits a page boundary. Note that the * split still has to be dword aligned like all ATA data transfers. */ WARN_ON_ONCE(offset % 4); - if (offset + qc->sect_size > PAGE_SIZE) { + if (offset + count > PAGE_SIZE) { unsigned int split_len = PAGE_SIZE - offset; ata_pio_xfer(qc, page, offset, split_len); - ata_pio_xfer(qc, nth_page(page, 1), 0, - qc->sect_size - split_len); + ata_pio_xfer(qc, nth_page(page, 1), 0, count - split_len); } else { - ata_pio_xfer(qc, page, offset, qc->sect_size); + ata_pio_xfer(qc, page, offset, count); } - qc->curbytes += qc->sect_size; - qc->cursg_ofs += qc->sect_size; + qc->curbytes += count; + qc->cursg_ofs += count; if (qc->cursg_ofs == qc->cursg->length) { qc->cursg = sg_next(qc->cursg); -- 2.39.2

2 1

[PATCH OLK-6.6] blk-cgroup: Fix class @block_class's subsystem refcount leakage
by Zheng Qixing 06 Mar '25

06 Mar '25

From: Zijun Hu <quic_zijuhu(a)quicinc.com> stable inclusion from stable-v6.6.78 commit 993121481b5a87829f1e8163f47158b72679f309 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC90 CVE: CVE-2025-21745 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit d1248436cbef1f924c04255367ff4845ccd9025e upstream. blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage. Fix by ending the iterating with class_dev_iter_exit(). Fixes: ef45fe470e1e ("blk-cgroup: show global disk stats in root cgroup io.stat") Reviewed-by: Michal Koutný <mkoutny(a)suse.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: stable(a)vger.kernel.org Acked-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Zijun Hu <quic_zijuhu(a)quicinc.com> Link: https://lore.kernel.org/r/20250105-class_fix-v6-2-3a2f1768d4d4@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-cgroup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 7809546cd418..37e0b92e2e87 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1139,6 +1139,7 @@ static void blkcg_fill_root_iostats(void) blkg_iostat_set(&blkg->iostat.cur, &tmp); u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags); } + class_dev_iter_exit(&iter); } static void blkcg_print_one_stat(struct blkcg_gq *blkg, struct seq_file *s) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] drm/amdkfd: Check for potential null return of kmalloc_array()
by Luo Gengkun 06 Mar '25

06 Mar '25

From: QintaoShen <unSimple1993(a)163.com> stable inclusion from stable-v4.19.239 commit 94869bb0de69a812f70231b0eb480bb2f7ae73a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP16T CVE: CVE-2022-49055 Reference: https://git.kernel.org/stable/c/94869bb0de69a812f70231b0eb480bb2f7ae73a6 -------------------------------- [ Upstream commit ebbb7bb9e80305820dc2328a371c1b35679f2667 ] As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference. Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion. Signed-off-by: QintaoShen <unSimple1993(a)163.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c index e9f0e0a1b41c..892077377339 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c @@ -532,6 +532,8 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events) event_waiters = kmalloc_array(num_events, sizeof(struct kfd_event_waiter), GFP_KERNEL); + if (!event_waiters) + return NULL; for (i = 0; (event_waiters) && (i < num_events) ; i++) { init_wait(&event_waiters[i].wait); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] rtl818x: Prevent using not initialized queues
by Luo Gengkun 06 Mar '25

06 Mar '25

From: Alexander Wetzel <alexander(a)wetzel-home.de> stable inclusion from stable-v4.19.247 commit 9d5e96cc1f1720019ce27b127a31695148d38bb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1BA CVE: CVE-2022-49326 Reference: https://git.kernel.org/stable/c/9d5e96cc1f1720019ce27b127a31695148d38bb0 -------------------------------- commit 746285cf81dc19502ab238249d75f5990bd2d231 upstream. Using not existing queues can panic the kernel with rtl8180/rtl8185 cards. Ignore the skb priority for those cards, they only have one tx queue. Pierre Asselin (pa(a)panix.com) reported the kernel crash in the Gentoo forum: https://forums.gentoo.org/viewtopic-t-1147832-postdays-0-postorder-asc-star… He also confirmed that this patch fixes the issue. In summary this happened: After updating wpa_supplicant from 2.9 to 2.10 the kernel crashed with a "divide error: 0000" when connecting to an AP. Control port tx now tries to use IEEE80211_AC_VO for the priority, which wpa_supplicants starts to use in 2.10. Since only the rtl8187se part of the driver supports QoS, the priority of the skb is set to IEEE80211_AC_BE (2) by mac80211 for rtl8180/rtl8185 cards. rtl8180 is then unconditionally reading out the priority and finally crashes on drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c line 544 without this patch: idx = (ring->idx + skb_queue_len(&ring->queue)) % ring->entries "ring->entries" is zero for rtl8180/rtl8185 cards, tx_ring[2] never got initialized. Cc: stable(a)vger.kernel.org Reported-by: pa(a)panix.com Tested-by: pa(a)panix.com Signed-off-by: Alexander Wetzel <alexander(a)wetzel-home.de> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20220422145228.7567-1-alexander@wetzel-home.de Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c index 225c1c8851cc..77bf8a601ca4 100644 --- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c @@ -460,8 +460,10 @@ static void rtl8180_tx(struct ieee80211_hw *dev, struct rtl8180_priv *priv = dev->priv; struct rtl8180_tx_ring *ring; struct rtl8180_tx_desc *entry; + unsigned int prio = 0; unsigned long flags; - unsigned int idx, prio, hw_prio; + unsigned int idx, hw_prio; + dma_addr_t mapping; u32 tx_flags; u8 rc_flags; @@ -470,7 +472,9 @@ static void rtl8180_tx(struct ieee80211_hw *dev, /* do arithmetic and then convert to le16 */ u16 frame_duration = 0; - prio = skb_get_queue_mapping(skb); + /* rtl8180/rtl8185 only has one useable tx queue */ + if (dev->queues > IEEE80211_AC_BK) + prio = skb_get_queue_mapping(skb); ring = &priv->tx_ring[prio]; mapping = pci_map_single(priv->pdev, skb->data, -- 2.34.1

2 1

[PATCH OLK-6.6] gpiolib: Fix crash on error in gpiochip_get_ngpios()
by Yifan Qiao 06 Mar '25

06 Mar '25

From: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> The gpiochip_get_ngpios() uses chip_*() macros to print messages. However these macros rely on gpiodev to be initialised and set, which is not the case when called via bgpio_init(). In such a case the printing messages will crash on NULL pointer dereference. Replace chip_*() macros by the respective dev_*() ones to avoid such crash. Fixes: 55b2395e4e92 ("gpio: mmio: handle "ngpios" properly in bgpio_init()") Signed-off-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Link: https://lore.kernel.org/r/20250213155646.2882324-1-andriy.shevchenko@linux.… Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpio/gpiolib.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 5c0016c77d2a..efb592b6f6aa 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -723,13 +723,13 @@ int gpiochip_get_ngpios(struct gpio_chip *gc, struct device *dev) } if (gc->ngpio == 0) { - chip_err(gc, "tried to insert a GPIO chip with zero lines\n"); + dev_err(dev, "tried to insert a GPIO chip with zero lines\n"); return -EINVAL; } if (gc->ngpio > FASTPATH_NGPIO) - chip_warn(gc, "line cnt %u is greater than fast path cnt %u\n", - gc->ngpio, FASTPATH_NGPIO); + dev_warn(dev, "line cnt %u is greater than fast path cnt %u\n", + gc->ngpio, FASTPATH_NGPIO); return 0; } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] dm integrity: fix memory corruption when tag_size is less than digest size
by Yuntao Liu 06 Mar '25

06 Mar '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.240 commit 6a95d91c0b315c965198f6ab7dec7c94129e17e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1KX CVE: CVE-2022-49044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 08c1af8f1c13bbf210f1760132f4df24d0ed46d6 upstream. It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array. Cc: stable(a)vger.kernel.org # v4.19+ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/md/dm-integrity.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index 66016ce253ce..db09e8748ec8 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -3509,6 +3509,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) } if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) { + size_t recalc_tags_size; if (!ic->internal_hash) { r = -EINVAL; ti->error = "Recalculate is only valid with internal hash"; @@ -3527,8 +3528,10 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) r = -ENOMEM; goto bad; } - ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block, - ic->tag_size, GFP_KERNEL); + recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size; + if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size) + recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size; + ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL); if (!ic->recalc_tags) { ti->error = "Cannot allocate tags for recalculating"; r = -ENOMEM; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
by Yuntao Liu 06 Mar '25

06 Mar '25

From: Tim Gardner <tim.gardner(a)canonical.com> stable inclusion from stable-v4.19.238 commit 72dd5c46a152136712a55bf026a9aa8c1b12b60d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6T4 CVE: CVE-2021-47642 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 37a1a2e6eeeb101285cd34e12e48a881524701aa ] Coverity complains of a possible buffer overflow. However, given the 'static' scope of nvidia_setup_i2c_bus() it looks like that can't happen after examiniing the call sites. CID 19036 (#1 of 1): Copy into fixed size buffer (STRING_OVERFLOW) 1. fixed_size_dest: You might overrun the 48-character fixed-size string chan->adapter.name by copying name without checking the length. 2. parameter_as_source: Note: This defect has an elevated risk because the source argument is a parameter of the current function. 89 strcpy(chan->adapter.name, name); Fix this warning by using strscpy() which will silence the warning and prevent any future buffer overflows should the names used to identify the channel become much longer. Cc: Antonino Daplas <adaplas(a)gmail.com> Cc: linux-fbdev(a)vger.kernel.org Cc: dri-devel(a)lists.freedesktop.org Cc: linux-kernel(a)vger.kernel.org Signed-off-by: Tim Gardner <tim.gardner(a)canonical.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/fbdev/nvidia/nv_i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c index d7994a173245..0b48965a6420 100644 --- a/drivers/video/fbdev/nvidia/nv_i2c.c +++ b/drivers/video/fbdev/nvidia/nv_i2c.c @@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name, { int rc; - strcpy(chan->adapter.name, name); + strscpy(chan->adapter.name, name, sizeof(chan->adapter.name)); chan->adapter.owner = THIS_MODULE; chan->adapter.class = i2c_class; chan->adapter.algo_data = &chan->algo; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] dm integrity: fix memory corruption when tag_size is less than digest size
by Yuntao Liu 06 Mar '25

06 Mar '25

From: Mikulas Patocka <mpatocka(a)redhat.com> commit 08c1af8f1c13bbf210f1760132f4df24d0ed46d6 upstream. It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array. Cc: stable(a)vger.kernel.org # v4.19+ Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/md/dm-integrity.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index 66016ce253ce..db09e8748ec8 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -3509,6 +3509,7 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) } if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) { + size_t recalc_tags_size; if (!ic->internal_hash) { r = -EINVAL; ti->error = "Recalculate is only valid with internal hash"; @@ -3527,8 +3528,10 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned argc, char **argv) r = -ENOMEM; goto bad; } - ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block, - ic->tag_size, GFP_KERNEL); + recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size; + if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size) + recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size; + ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL); if (!ic->recalc_tags) { ti->error = "Cannot allocate tags for recalculating"; r = -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Mainline Patch
by Xiaomeng Zhang 06 Mar '25

06 Mar '25

Hou Tao (1): bpf: Use preempt_count() directly in bpf_send_signal_common() Puranjay Mohan (1): bpf: Send signals asynchronously if !preemptible kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Mainline Patch
by Xiaomeng Zhang 06 Mar '25

06 Mar '25

Hou Tao (1): bpf: Use preempt_count() directly in bpf_send_signal_common() Puranjay Mohan (1): bpf: Send signals asynchronously if !preemptible kernel/trace/bpf_trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] block: mark GFP_NOIO around sysfs ->store()
by Li Lingfeng 06 Mar '25

06 Mar '25

From: Ming Lei <tom.leiming(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit 7c0be4ead1f8f5f8be0803f347de0de81e3b8e1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKB CVE: CVE-2025-21817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sysfs ->store is called with queue freezed, meantime we have several ->store() callbacks(update_nr_requests, wbt, scheduler) to allocate memory with GFP_KERNEL which may run into direct reclaim code path, then potential deadlock can be caused. Fix the issue by marking NOIO around sysfs ->store() Reported-by: Thomas Hellström <thomas.hellstrom(a)linux.intel.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: John Garry <john.g.garry(a)oracle.com> Link: https://lore.kernel.org/r/20250113015833.698458-1-ming.lei@redhat.com Link: https://lore.kernel.org/linux-block/Z4RkemI9f6N5zoEF@fedora/T/#mc774c65eeca… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-sysfs.c [Commit a16230649ce27f8ac7dd8a5b079d9657aa96de16 ("block: add a store_limit operations for sysfs entries") add check of store_limit in queue_attr_store; commit af2814149883 ("block: freeze the queue in queue_attr_store") move blk_mq_freeze_queue to queue_attr_store.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/blk-sysfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index 2de6c14dfecf..8d1bab14b83a 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -773,13 +773,16 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, struct queue_sysfs_entry *entry = to_queue(attr); struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); struct request_queue *q = disk->queue; + unsigned int noio_flag; ssize_t res; if (!entry->store) return -EIO; mutex_lock(&q->sysfs_lock); + noio_flag = memalloc_noio_save(); res = entry->store(q, page, length); + memalloc_noio_restore(noio_flag); mutex_unlock(&q->sysfs_lock); return res; } -- 2.31.1

2 1

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 06 Mar '25

06 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.12-rc1 commit 2240fed37afbcdb5e8b627bc7ad986891100e05d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC7J CVE: CVE-2025-21776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 498e359119c3e45a3f0b2a869228d2b910836bc0
by kernel test robot 06 Mar '25

06 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 498e359119c3e45a3f0b2a869228d2b910836bc0 !15307 net: sfc: add missing xdp queue reinitialization Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250305 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 760m configs tested: 15 configs skipped: 85 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250305 clang-15 arm64 randconfig-002-20250305 gcc-14.2.0 arm64 randconfig-003-20250305 clang-21 arm64 randconfig-004-20250305 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250305 clang-19 x86_64 buildonly-randconfig-002-20250305 gcc-12 x86_64 buildonly-randconfig-003-20250305 clang-19 x86_64 buildonly-randconfig-004-20250305 gcc-12 x86_64 buildonly-randconfig-005-20250305 clang-19 x86_64 buildonly-randconfig-006-20250305 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3c67b39e386a36efca1f95d96d16cf1a716b5617
by kernel test robot 06 Mar '25

06 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3c67b39e386a36efca1f95d96d16cf1a716b5617 !15314 drm/imx: Fix memory leak in imx_pd_connector_get_modes Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250305 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250305 | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250305 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250305 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-104-20250305 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-161-20250305 |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 931m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250305 gcc-14.2.0 arm64 randconfig-002-20250305 gcc-14.2.0 arm64 randconfig-003-20250305 gcc-14.2.0 arm64 randconfig-004-20250305 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250305 clang-19 x86_64 buildonly-randconfig-002-20250305 gcc-12 x86_64 buildonly-randconfig-003-20250305 clang-19 x86_64 buildonly-randconfig-004-20250305 gcc-12 x86_64 buildonly-randconfig-005-20250305 clang-19 x86_64 buildonly-randconfig-006-20250305 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Cancel pending work at closing a MIDI substream
by Zhang Kunbo 06 Mar '25

06 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.121 commit 40bdb5ec957aca5c5c1924602bef6b0ab18e22d3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6ZR CVE: CVE-2022-49545 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0125de38122f0f66bf61336158d12a1aabfe6425 upstream. At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For fixing the race, make sure to cancel the pending work at closing. Reported-by: syzbot+6912c9592caca7ca0e7d(a)syzkaller.appspotmail.com Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/000000000000e7e75005dfd07cf6@google.com Link: https://lore.kernel.org/r/20220525131203.11299-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- sound/usb/midi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index dcfc546d81b9..4ec7cbdddfd0 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1161,6 +1161,9 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream) static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream) { + struct usbmidi_out_port *port = substream->runtime->private_data; + + cancel_work_sync(&port->ep->work); return substream_open(substream, 0, 0); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipw2x00: Fix potential NULL dereference in libipw_xmit()
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Haowen Bai <baihaowen(a)meizu.com> stable inclusion from stable-v4.19.247 commit 167affc11781d7d35c4c3a7630a549ac74dd0b21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6MY CVE: CVE-2022-49544 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e8366bbabe1d207cf7c5b11ae50e223ae6fc278b ] crypt and crypt->ops could be null, so we need to checking null before dereference Signed-off-by: Haowen Bai <baihaowen(a)meizu.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/1648797055-25730-1-git-send-email-baihaowen@meizu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c index 84205aa508df..daa4f9eb08ff 100644 --- a/drivers/net/wireless/intel/ipw2x00/libipw_tx.c +++ b/drivers/net/wireless/intel/ipw2x00/libipw_tx.c @@ -397,7 +397,7 @@ netdev_tx_t libipw_xmit(struct sk_buff *skb, struct net_device *dev) /* Each fragment may need to have room for encryption * pre/postfix */ - if (host_encrypt) + if (host_encrypt && crypt && crypt->ops) bytes_per_frag -= crypt->ops->extra_mpdu_prefix_len + crypt->ops->extra_mpdu_postfix_len; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
by Zhang Kunbo 05 Mar '25

05 Mar '25

From: Liu Zixian <liuzixian4(a)huawei.com> stable inclusion from stable-v4.19.247 commit edafcad84c4134ebec4bc24b29ca4497a1184eea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1Y3 CVE: CVE-2022-49532 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 194d250cdc4a40ccbd179afd522a9e9846957402 ] drm_cvt_mode may return NULL and we should check it. This bug is found by syzkaller: FAULT_INJECTION stacktrace: [ 168.567394] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 1 [ 168.567403] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567406] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567408] Call trace: [ 168.567414] dump_backtrace+0x0/0x310 [ 168.567418] show_stack+0x28/0x38 [ 168.567423] dump_stack+0xec/0x15c [ 168.567427] should_fail+0x3ac/0x3d0 [ 168.567437] __should_failslab+0xb8/0x120 [ 168.567441] should_failslab+0x28/0xc0 [ 168.567445] kmem_cache_alloc_trace+0x50/0x640 [ 168.567454] drm_mode_create+0x40/0x90 [ 168.567458] drm_cvt_mode+0x48/0xc78 [ 168.567477] virtio_gpu_conn_get_modes+0xa8/0x140 [virtio_gpu] [ 168.567485] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567492] drm_mode_getconnector+0x2e0/0xa70 [ 168.567496] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567514] drm_ioctl+0x558/0x6d0 [ 168.567522] do_vfs_ioctl+0x160/0xf30 [ 168.567525] ksys_ioctl+0x98/0xd8 [ 168.567530] __arm64_sys_ioctl+0x50/0xc8 [ 168.567536] el0_svc_common+0xc8/0x320 [ 168.567540] el0_svc_handler+0xf8/0x160 [ 168.567544] el0_svc+0x10/0x218 KASAN stacktrace: [ 168.567561] BUG: KASAN: null-ptr-deref in virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567565] Read of size 4 at addr 0000000000000054 by task syz/6425 [ 168.567566] [ 168.567571] CPU: 1 PID: 6425 Comm: syz Kdump: loaded Not tainted 4.19.90-vhulk2201.1.0.h1035.kasan.eulerosv2r10.aarch64 #1 [ 168.567573] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 168.567575] Call trace: [ 168.567578] dump_backtrace+0x0/0x310 [ 168.567582] show_stack+0x28/0x38 [ 168.567586] dump_stack+0xec/0x15c [ 168.567591] kasan_report+0x244/0x2f0 [ 168.567594] __asan_load4+0x58/0xb0 [ 168.567607] virtio_gpu_conn_get_modes+0xb4/0x140 [virtio_gpu] [ 168.567612] drm_helper_probe_single_connector_modes+0x3a4/0xd80 [ 168.567617] drm_mode_getconnector+0x2e0/0xa70 [ 168.567621] drm_ioctl_kernel+0x11c/0x1d8 [ 168.567624] drm_ioctl+0x558/0x6d0 [ 168.567628] do_vfs_ioctl+0x160/0xf30 [ 168.567632] ksys_ioctl+0x98/0xd8 [ 168.567636] __arm64_sys_ioctl+0x50/0xc8 [ 168.567641] el0_svc_common+0xc8/0x320 [ 168.567645] el0_svc_handler+0xf8/0x160 [ 168.567649] el0_svc+0x10/0x218 Signed-off-by: Liu Zixian <liuzixian4(a)huawei.com> Link: http://patchwork.freedesktop.org/patch/msgid/20220322091730.1653-1-liuzixia… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_display.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_display.c b/drivers/gpu/drm/virtio/virtgpu_display.c index 25503b933599..7511f416eb67 100644 --- a/drivers/gpu/drm/virtio/virtgpu_display.c +++ b/drivers/gpu/drm/virtio/virtgpu_display.c @@ -180,6 +180,8 @@ static int virtio_gpu_conn_get_modes(struct drm_connector *connector) DRM_DEBUG("add mode: %dx%d\n", width, height); mode = drm_cvt_mode(connector->dev, width, height, 60, false, false, false); + if (!mode) + return count; mode->type |= DRM_MODE_TYPE_PREFERRED; drm_mode_probed_add(connector, mode); count++; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 00/23] Support perf --bpf-counters
by Tengda Wu 05 Mar '25

05 Mar '25

This is a minimal patch series to enable '--bpf-counters' options for perf tool in 5.10 kernel version. How to compile? =============== 1. Download openEuler kernel source code: git clone https://gitee.com/openeuler/kernel.git 2. Download these patches, apply them in kernel/ directory: cd kernel/ git am --reject /path/to/*.patch 3. Prepare some requirements before compiling perf tool: Not list one by one here, please refer to [1]. [1] https://medium.com/@manas.marwah/building-perf-tool-fc838f084f71 4. Compile perf tool: cd tools/perf make BUILD_BPF_SKEL=1 If successful, you will see a binary file named 'perf' under tools/perf/ directory. How to use? =========== 1. Use bperf to sample a process: $ perf stat --bpf-counters -e cycles,instructions \ perf bench sched messaging -g 1 -l 100 -t # Running 'sched/messaging' benchmark: # 20 sender and receiver threads per group # 1 groups == 40 threads run Total time: 0.011 [sec] Performance counter stats for 'perf bench sched messaging -g 1 -l 100 -t': 639,816,606 cycles 284,102,919 instructions # 0.44 insn per cycle 0.018093452 seconds time elapsed 0.023612000 seconds user 0.255643000 seconds sys 2. Use bperf to sample a container: $ perf stat --bpf-counters -e cycles,instructions --timeout 1000 \ --for-each-cgroup docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 Performance counter stats for 'system wide': 7,402,983 cycles docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 6,036,926 instructions docker/66166578dd7d17655923862792a0b9d60c8785fdc1bb8da8b76daedb205c4b10 # 0.82 insn per cycle 1.004999462 seconds time elapsed How to integrate via bpf? ======================== If you are interested in process sampling, please check the following bpf progs: tools/perf/util/bpf_skel/bperf_leader.bpf.c tools/perf/util/bpf_skel/bperf_follower.bpf.c And if you are interested in container sampling, please check the following bpf prog: tools/perf/util/bpf_skel/bperf_cgroup.bpf.c There have some documents in tools/perf/util/bpf_counter.c, search the keywords 'bperf: share hardware PMCs with BPF' in it and see how bperf works. That's all. Enjoy. Namhyung Kim (9): bpf: Allow bpf_get_current_ancestor_cgroup_id for tracing perf core: Factor out __perf_sw_event_sched perf core: Add PERF_COUNT_SW_CGROUP_SWITCHES event perf tools: Add 'cgroup-switches' software event perf tools: Add read_cgroup_id() function perf tools: Add cgroup_is_v2() helper perf bpf_counter: Move common functions to bpf_counter.h perf stat: Enable BPF counter with --for-each-cgroup perf stat: Fix BPF program section name Song Liu (12): bpftool: Add Makefile target bootstrap perf build: Support build BPF skeletons with perf perf stat: Enable counting events for BPF programs perf stat: Introduce 'bperf' to share hardware PMCs with BPF perf stat: Measure 't0' and 'ref_time' after enable_counters() perf util: Move bpf_perf definitions to a libperf header perf bpf: check perf_attr_map is compatible with the perf binary perf stat: Introduce config stat.bpf-counter-events perf stat: Introduce ':b' modifier perf stat: Introduce bpf_counter_ops->disable() perf bpf: Fix building perf with BUILD_BPF_SKEL=1 by default in more distros perf bpf_skel: Do not use typedef to avoid error on old clang Tengda Wu (1): perf stat: Support inherit events during fork() for bperf Xiaomeng Zhang (1): perf stat: Increase perf_attr_map entries include/linux/perf_event.h | 40 +- include/uapi/linux/perf_event.h | 1 + kernel/trace/bpf_trace.c | 2 + tools/bpf/bpftool/Makefile | 2 + tools/build/Makefile.feature | 4 +- tools/include/uapi/linux/perf_event.h | 7 + tools/lib/perf/include/perf/bpf_perf.h | 31 + tools/perf/Documentation/perf-stat.txt | 31 + tools/perf/Makefile.config | 9 + tools/perf/Makefile.perf | 65 +- tools/perf/builtin-stat.c | 111 ++- tools/perf/util/Build | 2 + tools/perf/util/bpf_counter.c | 828 ++++++++++++++++++ tools/perf/util/bpf_counter.h | 131 +++ tools/perf/util/bpf_counter_cgroup.c | 307 +++++++ tools/perf/util/bpf_skel/.gitignore | 3 + tools/perf/util/bpf_skel/bperf_cgroup.bpf.c | 191 ++++ tools/perf/util/bpf_skel/bperf_follower.bpf.c | 162 ++++ tools/perf/util/bpf_skel/bperf_leader.bpf.c | 55 ++ tools/perf/util/bpf_skel/bperf_u.h | 19 + .../util/bpf_skel/bpf_prog_profiler.bpf.c | 93 ++ tools/perf/util/cgroup.c | 47 + tools/perf/util/cgroup.h | 13 + tools/perf/util/config.c | 4 + tools/perf/util/evlist.c | 4 + tools/perf/util/evsel.c | 27 + tools/perf/util/evsel.h | 32 + tools/perf/util/parse-events.c | 12 +- tools/perf/util/parse-events.l | 3 +- tools/perf/util/python.c | 27 + tools/perf/util/stat-display.c | 4 +- tools/perf/util/stat.c | 2 +- tools/perf/util/target.c | 34 +- tools/perf/util/target.h | 8 + tools/scripts/Makefile.include | 1 + 35 files changed, 2266 insertions(+), 46 deletions(-) create mode 100644 tools/lib/perf/include/perf/bpf_perf.h create mode 100644 tools/perf/util/bpf_counter.c create mode 100644 tools/perf/util/bpf_counter.h create mode 100644 tools/perf/util/bpf_counter_cgroup.c create mode 100644 tools/perf/util/bpf_skel/.gitignore create mode 100644 tools/perf/util/bpf_skel/bperf_cgroup.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_follower.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_leader.bpf.c create mode 100644 tools/perf/util/bpf_skel/bperf_u.h create mode 100644 tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c -- 2.34.1

2 24

[PATCH OLK-6.6] btrfs: fix use-after-free when attempting to join an aborted transaction
by Long Li 05 Mar '25

05 Mar '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.10-rc2 commit e2f0943cf37305dbdeaf9846e3c941451bcdef63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA5 CVE: CVE-2025-21753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction. This was reported by syzbot and Dmitry with the following stack traces from KASAN: ================================================================== BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 Read of size 4 at addr ffff888011839024 by task kworker/u4:9/1128 CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_data_space Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs/space-info.c:1321 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5315: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 lookup_open fs/namei.c:3649 [inline] open_last_lookups fs/namei.c:3748 [inline] path_openat+0x1c03/0x3590 fs/namei.c:3984 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [inline] __do_sys_creat fs/open.c:1495 [inline] __se_sys_creat fs/open.c:1489 [inline] __x64_sys_creat+0x123/0x170 fs/open.c:1489 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5336: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 cleanup_transaction fs/btrfs/transaction.c:2063 [inline] btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c:3757 btrfs_balance+0x992/0x10c0 fs/btrfs/volumes.c:4633 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3670 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888011839000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 36 bytes inside of freed 2048-byte region [ffff888011839000, ffff888011839800) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11838 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 raw: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42000 ffffea0000493400 dead000000000002 head: 0000000000000000 0000000000080008 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea0000460e01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 57, tgid 57 (kworker/0:2), ts 67248182943, free_ts 67229742023 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x3e1/0x780 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] alloc_skb_with_frags+0xc3/0x820 net/core/skbuff.c:6612 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2884 sock_alloc_send_skb include/net/sock.h:1803 [inline] mld_newpack+0x1c3/0xaf0 net/ipv6/mcast.c:1747 add_grhead net/ipv6/mcast.c:1850 [inline] add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1988 mld_send_cr net/ipv6/mcast.c:2114 [inline] mld_ifc_work+0x691/0xd90 net/ipv6/mcast.c:2651 page last free pid 5300 tgid 5300 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2659 __slab_free+0x2c2/0x380 mm/slub.c:4524 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_noprof+0x236/0x4c0 mm/slub.c:4310 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] fib_create_info+0xc14/0x25b0 net/ipv4/fib_semantics.c:1435 fib_table_insert+0x1f6/0x1f20 net/ipv4/fib_trie.c:1231 fib_magic+0x3d8/0x620 net/ipv4/fib_frontend.c:1112 fib_add_ifaddr+0x40c/0x5e0 net/ipv4/fib_frontend.c:1156 fib_netdev_event+0x375/0x490 net/ipv4/fib_frontend.c:1494 notifier_call_chain+0x1a5/0x3f0 kernel/notifier.c:85 __dev_notify_flags+0x207/0x400 dev_change_flags+0xf0/0x1a0 net/core/dev.c:9045 do_setlink+0xc90/0x4210 net/core/rtnetlink.c:3109 rtnl_changelink net/core/rtnetlink.c:3723 [inline] __rtnl_newlink net/core/rtnetlink.c:3875 [inline] rtnl_newlink+0x1bb6/0x2210 net/core/rtnetlink.c:4012 Memory state around the buggy address: ffff888011838f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888011838f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888011839000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888011839080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888011839100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: syzbot+45212e9d87a98c3f5b42(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/678e7da5.050a0220.303755.007c.GAE@googl… Reported-by: Dmitry Vyukov <dvyukov(a)google.com> Link: https://lore.kernel.org/linux-btrfs/CACT4Y+ZFBdo7pT8L2AzM=vegZwjp-wNkVJZQf0… Fixes: 871383be592b ("btrfs: add missing unlocks to transaction abort paths") Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/transaction.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index 0548072c642f..aa03db69a016 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -278,8 +278,10 @@ static noinline int join_transaction(struct btrfs_fs_info *fs_info, cur_trans = fs_info->running_transaction; if (cur_trans) { if (TRANS_ABORTED(cur_trans)) { + const int abort_error = cur_trans->aborted; + spin_unlock(&fs_info->trans_lock); - return cur_trans->aborted; + return abort_error; } if (btrfs_blocked_trans_types[cur_trans->state] & type) { spin_unlock(&fs_info->trans_lock); -- 2.39.2

2 1

[PATCH OLK-6.6] partitions: mac: fix handling of bogus partition table
by Long Li 05 Mar '25

05 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index 7b521df00a39..6415213cd184 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] net: tipc: fix possible refcount leak in tipc_sk_create()
by Wang Liang 05 Mar '25

05 Mar '25

From: Hangyu Hua <hbh25y(a)gmail.com> stable inclusion from stable-v4.19.253 commit ef488669b2652bde5b6ee5a409a5b048a2a50db4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP398 CVE: CVE-2022-49620 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 00aff3590fc0a73bddd3b743863c14e76fd35c0c ] Free sk in case tipc_sk_insert() fails. Signed-off-by: Hangyu Hua <hbh25y(a)gmail.com> Reviewed-by: Tung Nguyen <tung.q.nguyen(a)dektech.com.au> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/tipc/socket.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/tipc/socket.c b/net/tipc/socket.c index 6a1e7ff667ad..f8a555def98f 100644 --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -453,6 +453,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock, sock_init_data(sock, sk); tipc_set_sk_state(sk, TIPC_OPEN); if (tipc_sk_insert(tsk)) { + sk_free(sk); pr_warn("Socket create failed; port number exhausted\n"); return -EINVAL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-21702
by Wang Liang 05 Mar '25

05 Mar '25

Eric Dumazet (1): net_sched: sch_fifo: implement lockless __fifo_dump() Quang Le (1): pfifo_tail_enqueue: Drop new packet when sch->limit == 0 net/sched/sch_fifo.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net: sched: Disallow replacing of child qdisc from one parent to another
by Wang Liang 05 Mar '25

05 Mar '25

From: Jamal Hadi Salim <jhs(a)mojatatu.com> mainline inclusion from mainline-v6.14-rc1 commit bc50835e83f60f56e9bec2b392fb5544f250fb6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBM687 CVE: CVE-2025-21700 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo root handle 1:0 drr step2. a class for packet aggregation do demonstrate uaf tc class add dev lo classid 1:1 drr step3. a class for nesting tc class add dev lo classid 1:2 drr step4. a class to graft qdisc to tc class add dev lo classid 1:3 drr step5. tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024 step6. tc qdisc add dev lo parent 1:2 handle 3:0 drr step7. tc class add dev lo classid 3:1 drr step 8. tc qdisc add dev lo parent 3:1 handle 4:0 pfifo step 9. Display the class/qdisc layout tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 limit 1000p qdisc drr 3: dev lo parent 1:2 step10. trigger the bug <=== prevented by this patch tc qdisc replace dev lo parent 1:3 handle 4:0 step 11. Redisplay again the qdiscs/classes tc class ls dev lo class drr 1:1 root leaf 2: quantum 64Kb class drr 1:2 root leaf 3: quantum 64Kb class drr 1:3 root leaf 4: quantum 64Kb class drr 3:1 root leaf 4: quantum 64Kb tc qdisc ls qdisc drr 1: dev lo root refcnt 2 qdisc plug 2: dev lo parent 1:1 qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p qdisc drr 3: dev lo parent 1:2 Observe that a) parent for 4:0 does not change despite the replace request. There can only be one parent. b) refcount has gone up by two for 4:0 and c) both class 1:3 and 3:1 are pointing to it. Step 12. send one packet to plug echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001)) step13. send one packet to the grafted fifo echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003)) step14. lets trigger the uaf tc class delete dev lo classid 1:3 tc class delete dev lo classid 1:1 The semantics of "replace" is for a del/add _on the same node_ and not a delete from one node(3:1) and add to another node (1:3) as in step10. While we could "fix" with a more complex approach there could be consequences to expectations so the patch takes the preventive approach of "disallow such config". Joint work with Lion Ackermann <nnamrec(a)gmail.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 36a5d3ceead2..489d8213e305 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1519,6 +1519,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, q = qdisc_lookup(dev, tcm->tcm_handle); if (!q) goto create_n_graft; + if (q->parent != tcm->tcm_parent) { + NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent"); + return -EINVAL; + } if (n->nlmsg_flags & NLM_F_EXCL) { NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override"); return -EEXIST; -- 2.34.1

2 1

[PATCH OLK-6.6] perf/core: Save raw sample data conditionally based on sample type
by Luo Gengkun 05 Mar '25

05 Mar '25

From: Yabin Cui <yabinc(a)google.com> stable inclusion from stable-v6.6.76 commit c0dbecb204cfb91999d0b785048be4a95bbc8c9c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBQXZY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b9c44b91476b67327a521568a854babecc4070ab ] Currently, space for raw sample data is always allocated within sample records for both BPF output and tracepoint events. This leads to unused space in sample records when raw sample data is not requested. This patch enforces checking sample type of an event in perf_sample_save_raw_data(). So raw sample data will only be saved if explicitly requested, reducing overhead when it is not needed. Fixes: 0a9081cf0a11 ("perf/core: Add perf_sample_save_raw_data() helper") Signed-off-by: Yabin Cui <yabinc(a)google.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Ian Rogers <irogers(a)google.com> Acked-by: Namhyung Kim <namhyung(a)kernel.org> Link: https://lore.kernel.org/r/20240515193610.2350456-2-yabinc@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/s390/kernel/perf_cpum_cf.c | 2 +- arch/s390/kernel/perf_pai_crypto.c | 2 +- arch/s390/kernel/perf_pai_ext.c | 2 +- arch/x86/events/amd/ibs.c | 2 +- include/linux/perf_event.h | 6 +++++ kernel/events/core.c | 35 +++++++++++++++--------------- kernel/trace/bpf_trace.c | 11 +++++----- 7 files changed, 34 insertions(+), 26 deletions(-) diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c index 5466e7bada03..65a66df5bb86 100644 --- a/arch/s390/kernel/perf_cpum_cf.c +++ b/arch/s390/kernel/perf_cpum_cf.c @@ -977,7 +977,7 @@ static int cfdiag_push_sample(struct perf_event *event, if (event->attr.sample_type & PERF_SAMPLE_RAW) { raw.frag.size = cpuhw->usedss; raw.frag.data = cpuhw->stop; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } overflow = perf_event_overflow(event, &data, &regs); diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c index 4a4e914c283c..044fba8332b2 100644 --- a/arch/s390/kernel/perf_pai_crypto.c +++ b/arch/s390/kernel/perf_pai_crypto.c @@ -365,7 +365,7 @@ static int paicrypt_push_sample(void) if (event->attr.sample_type & PERF_SAMPLE_RAW) { raw.frag.size = rawsize; raw.frag.data = cpump->save; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } overflow = perf_event_overflow(event, &data, &regs); diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c index b5febe22d054..089bd3104b39 100644 --- a/arch/s390/kernel/perf_pai_ext.c +++ b/arch/s390/kernel/perf_pai_ext.c @@ -454,7 +454,7 @@ static int paiext_push_sample(void) if (event->attr.sample_type & PERF_SAMPLE_RAW) { raw.frag.size = rawsize; raw.frag.data = cpump->save; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } overflow = perf_event_overflow(event, &data, &regs); diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c index e91970b01d62..c3a2f6f57770 100644 --- a/arch/x86/events/amd/ibs.c +++ b/arch/x86/events/amd/ibs.c @@ -1118,7 +1118,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) .data = ibs_data.data, }, }; - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); } if (perf_ibs == &perf_ibs_op) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index fe692e9bd0b2..420f15ddce39 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -1287,12 +1287,18 @@ static inline void perf_sample_save_callchain(struct perf_sample_data *data, } static inline void perf_sample_save_raw_data(struct perf_sample_data *data, + struct perf_event *event, struct perf_raw_record *raw) { struct perf_raw_frag *frag = &raw->frag; u32 sum = 0; int size; + if (!(event->attr.sample_type & PERF_SAMPLE_RAW)) + return; + if (WARN_ON_ONCE(data->sample_flags & PERF_SAMPLE_RAW)) + return; + do { sum += frag->size; if (perf_raw_frag_last(frag)) diff --git a/kernel/events/core.c b/kernel/events/core.c index f53d7c6ad513..ca4f20005586 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -10168,9 +10168,9 @@ static struct pmu perf_tracepoint = { }; static int perf_tp_filter_match(struct perf_event *event, - struct perf_sample_data *data) + struct perf_raw_record *raw) { - void *record = data->raw->frag.data; + void *record = raw->frag.data; /* only top level events have filters set */ if (event->parent) @@ -10182,7 +10182,7 @@ static int perf_tp_filter_match(struct perf_event *event, } static int perf_tp_event_match(struct perf_event *event, - struct perf_sample_data *data, + struct perf_raw_record *raw, struct pt_regs *regs) { if (event->hw.state & PERF_HES_STOPPED) @@ -10193,7 +10193,7 @@ static int perf_tp_event_match(struct perf_event *event, if (event->attr.exclude_kernel && !user_mode(regs)) return 0; - if (!perf_tp_filter_match(event, data)) + if (!perf_tp_filter_match(event, raw)) return 0; return 1; @@ -10219,6 +10219,7 @@ EXPORT_SYMBOL_GPL(perf_trace_run_bpf_submit); static void __perf_tp_event_target_task(u64 count, void *record, struct pt_regs *regs, struct perf_sample_data *data, + struct perf_raw_record *raw, struct perf_event *event) { struct trace_entry *entry = record; @@ -10228,13 +10229,17 @@ static void __perf_tp_event_target_task(u64 count, void *record, /* Cannot deliver synchronous signal to other task. */ if (event->attr.sigtrap) return; - if (perf_tp_event_match(event, data, regs)) + if (perf_tp_event_match(event, raw, regs)) { + perf_sample_data_init(data, 0, 0); + perf_sample_save_raw_data(data, event, raw); perf_swevent_event(event, count, data, regs); + } } static void perf_tp_event_target_task(u64 count, void *record, struct pt_regs *regs, struct perf_sample_data *data, + struct perf_raw_record *raw, struct perf_event_context *ctx) { unsigned int cpu = smp_processor_id(); @@ -10242,15 +10247,15 @@ static void perf_tp_event_target_task(u64 count, void *record, struct perf_event *event, *sibling; perf_event_groups_for_cpu_pmu(event, &ctx->pinned_groups, cpu, pmu) { - __perf_tp_event_target_task(count, record, regs, data, event); + __perf_tp_event_target_task(count, record, regs, data, raw, event); for_each_sibling_event(sibling, event) - __perf_tp_event_target_task(count, record, regs, data, sibling); + __perf_tp_event_target_task(count, record, regs, data, raw, sibling); } perf_event_groups_for_cpu_pmu(event, &ctx->flexible_groups, cpu, pmu) { - __perf_tp_event_target_task(count, record, regs, data, event); + __perf_tp_event_target_task(count, record, regs, data, raw, event); for_each_sibling_event(sibling, event) - __perf_tp_event_target_task(count, record, regs, data, sibling); + __perf_tp_event_target_task(count, record, regs, data, raw, sibling); } } @@ -10268,15 +10273,10 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, }, }; - perf_sample_data_init(&data, 0, 0); - perf_sample_save_raw_data(&data, &raw); - perf_trace_buf_update(record, event_type); hlist_for_each_entry_rcu(event, head, hlist_entry) { - if (perf_tp_event_match(event, &data, regs)) { - perf_swevent_event(event, count, &data, regs); - + if (perf_tp_event_match(event, &raw, regs)) { /* * Here use the same on-stack perf_sample_data, * some members in data are event-specific and @@ -10286,7 +10286,8 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, * because data->sample_flags is set. */ perf_sample_data_init(&data, 0, 0); - perf_sample_save_raw_data(&data, &raw); + perf_sample_save_raw_data(&data, event, &raw); + perf_swevent_event(event, count, &data, regs); } } @@ -10303,7 +10304,7 @@ void perf_tp_event(u16 event_type, u64 count, void *record, int entry_size, goto unlock; raw_spin_lock(&ctx->lock); - perf_tp_event_target_task(count, record, regs, &data, ctx); + perf_tp_event_target_task(count, record, regs, &data, &raw, ctx); raw_spin_unlock(&ctx->lock); unlock: rcu_read_unlock(); diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 4485f5f383cc..560563536e8e 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -616,7 +616,8 @@ static const struct bpf_func_proto bpf_perf_event_read_value_proto = { static __always_inline u64 __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, - u64 flags, struct perf_sample_data *sd) + u64 flags, struct perf_raw_record *raw, + struct perf_sample_data *sd) { struct bpf_array *array = container_of(map, struct bpf_array, map); unsigned int cpu = smp_processor_id(); @@ -641,6 +642,8 @@ __bpf_perf_event_output(struct pt_regs *regs, struct bpf_map *map, if (unlikely(event->oncpu != cpu)) return -EOPNOTSUPP; + perf_sample_save_raw_data(sd, event, raw); + return perf_event_output(event, sd, regs); } @@ -684,9 +687,8 @@ BPF_CALL_5(bpf_perf_event_output, struct pt_regs *, regs, struct bpf_map *, map, } perf_sample_data_init(sd, 0, 0); - perf_sample_save_raw_data(sd, &raw); - err = __bpf_perf_event_output(regs, map, flags, sd); + err = __bpf_perf_event_output(regs, map, flags, &raw, sd); out: this_cpu_dec(bpf_trace_nest_level); preempt_enable(); @@ -745,9 +747,8 @@ u64 bpf_event_output(struct bpf_map *map, u64 flags, void *meta, u64 meta_size, perf_fetch_caller_regs(regs); perf_sample_data_init(sd, 0, 0); - perf_sample_save_raw_data(sd, &raw); - ret = __bpf_perf_event_output(regs, map, flags, sd); + ret = __bpf_perf_event_output(regs, map, flags, &raw, sd); out: this_cpu_dec(bpf_event_output_nest_level); preempt_enable(); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/1] Fix CVE-2022-49253
by Hongbo Li 05 Mar '25

05 Mar '25

Fix CVE-2022-49253. Dan Carpenter (1): media: usb: go7007: s2250-board: fix leak in probe() drivers/media/usb/go7007/s2250-board.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] Fixes CVE-2025-21767
by Yang Yingliang 05 Mar '25

05 Mar '25

Waiman Long (2): clocksource: Use pr_info() for "Checking clocksource synchronization" message clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context kernel/time/clocksource.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2022-49308
by Hongbo Li 05 Mar '25

05 Mar '25

Fix CVE-2022-49308. Dinghao Liu (1): extcon: Fix error handling in extcon_dev_register bumwoo lee (1): extcon: Modify extcon device to be created after driver data is set drivers/extcon/extcon.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/1] Fix Fix CVE-2022-49351
by Hongbo Li 05 Mar '25

05 Mar '25

Fix Fix CVE-2022-49351. Miaoqian Lin (1): net: altera: Fix refcount leak in altera_tse_mdio_create drivers/net/ethernet/altera/altera_tse_main.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-25.03 v6 0/4] Add TrIO support in EROFS
by Hongbo Li 05 Mar '25

05 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v6: - Add folio_put after filemap_get_folio. - Filter trace with lowerdir v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 +++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++++ tools/trio/README.md | 446 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 +++ tools/trio/bpf/iotracker/iotracker.c | 57 +++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 370 +++++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++++ 16 files changed, 1825 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] can: m_can: m_can_tx_handler(): fix use after free of skb
by Xiangwei Li 05 Mar '25

05 Mar '25

From: Marc Kleine-Budde <mkl(a)pengutronix.de> stable inclusion from stable-v4.19.253 commit 7728d937ec403a1ceff9483023252d2cb8777f81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6AL CVE: CVE-2022-49275 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2e8e79c416aae1de224c0f1860f2e3350fa171f8 upstream. can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch. Fixes: 80646733f11c ("can: m_can: update to support CAN FD features") Link: https://lore.kernel.org/all/20220317081305.739554-1-mkl@pengutronix.de Cc: stable(a)vger.kernel.org Reported-by: Hangyu Hua <hbh25y(a)gmail.com> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> [sudip: adjust context] Signed-off-by: Sudip Mukherjee <sudipm.mukherjee(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/net/can/m_can/m_can.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c index deb274a19ba0..3e0084ff3c9c 100644 --- a/drivers/net/can/m_can/m_can.c +++ b/drivers/net/can/m_can/m_can.c @@ -1443,8 +1443,6 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb, M_CAN_FIFO_DATA(i / 4), *(u32 *)(cf->data + i)); - can_put_echo_skb(skb, dev, 0); - if (priv->can.ctrlmode & CAN_CTRLMODE_FD) { cccr = m_can_read(priv, M_CAN_CCCR); cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT); @@ -1461,6 +1459,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb, m_can_write(priv, M_CAN_CCCR, cccr); } m_can_write(priv, M_CAN_TXBTIE, 0x1); + + can_put_echo_skb(skb, dev, 0); + m_can_write(priv, M_CAN_TXBAR, 0x1); /* End of xmit function for version 3.0.x */ } else { -- 2.25.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 2fb29dd60fee873c8d757037e478fa2c03ac8bd3
by kernel test robot 05 Mar '25

05 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2fb29dd60fee873c8d757037e478fa2c03ac8bd3 !15293 ras: ACPI: HED: Always initialize before evged Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250304 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250304 | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250304 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250304 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 743m configs tested: 16 configs skipped: 119 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250304 clang-21 arm64 randconfig-002-20250304 gcc-14.2.0 arm64 randconfig-003-20250304 gcc-14.2.0 arm64 randconfig-004-20250304 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250304 clang-19 x86_64 buildonly-randconfig-002-20250304 gcc-12 x86_64 buildonly-randconfig-003-20250304 gcc-12 x86_64 buildonly-randconfig-004-20250304 gcc-12 x86_64 buildonly-randconfig-005-20250304 gcc-12 x86_64 buildonly-randconfig-006-20250304 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
by Xiaomeng Zhang 05 Mar '25

05 Mar '25

From: Kuan-Wei Chiu <visitorckw(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit 3d6f83df8ff2d5de84b50377e4f0d45e25311c7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBQPCU Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Shifting 1 << 31 on a 32-bit int causes signed integer overflow, which leads to undefined behavior. To prevent this, cast 1 to u32 before performing the shift, ensuring well-defined behavior. This change explicitly avoids any potential overflow by ensuring that the shift occurs on an unsigned 32-bit integer. Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> Acked-by: Petr Mladek <pmladek(a)suse.com> Link: https://lore.kernel.org/r/20240928113608.1438087-1-visitorckw@gmail.com Signed-off-by: Petr Mladek <pmladek(a)suse.com> Conflicts: kernel/printk/printk.c [Fix context conflicts.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/printk/printk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c index f6b48484a300..8d324657bbda 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c @@ -476,7 +476,7 @@ static struct latched_seq clear_seq = { /* record buffer */ #define LOG_ALIGN __alignof__(unsigned long) #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT) -#define LOG_BUF_LEN_MAX (u32)(1 << 31) +#define LOG_BUF_LEN_MAX ((u32)1 << 31) static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN); static char *log_buf = __log_buf; static u32 log_buf_len = __LOG_BUF_LEN; -- 2.34.1

2 1

[PATCH openEuler-25.03 v6 0/4] Add TrIO support in EROFS
by Hongbo Li 05 Mar '25

05 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v6: - Add folio_put after filemap_get_folio. v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 ++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++ tools/trio/README.md | 517 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 ++ tools/trio/bpf/iotracker/iotracker.c | 57 ++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 370 +++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++ 16 files changed, 1896 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 05 Mar '25

05 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.12-rc1 commit 2240fed37afbcdb5e8b627bc7ad986891100e05d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC7J CVE: CVE-2025-21776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 05 Mar '25

05 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..62e73ac32a3b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1551,6 +1551,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1

[PATCH openEuler-25.03 v5 0/4] Add TrIO support in EROFS
by Hongbo Li 04 Mar '25

04 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 +++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++++ tools/trio/README.md | 444 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 +++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 +++ tools/trio/bpf/iotracker/iotracker.c | 57 +++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 365 +++++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++++ 16 files changed, 1818 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
by Xiangwei Li 04 Mar '25

04 Mar '25

From: Junxiao Bi via Ocfs2-devel <ocfs2-devel(a)oss.oracle.com> stable inclusion from stable-v4.19.247 commit 733a35c00ef363a1c774d7ea486e0735b7c13a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP72J CVE: CVE-2022-49337 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 863e0d81b6683c4cbc588ad831f560c90e494bef upstream. When user_dlm_destroy_lock failed, it didn't clean up the flags it set before exit. For USER_LOCK_IN_TEARDOWN, if this function fails because of lock is still in used, next time when unlink invokes this function, it will return succeed, and then unlink will remove inode and dentry if lock is not in used(file closed), but the dlm lock is still linked in dlm lock resource, then when bast come in, it will trigger a panic due to user-after-free. See the following panic call trace. To fix this, USER_LOCK_IN_TEARDOWN should be reverted if fail. And also error should be returned if USER_LOCK_IN_TEARDOWN is set to let user know that unlink fail. For the case of ocfs2_dlm_unlock failure, besides USER_LOCK_IN_TEARDOWN, USER_LOCK_BUSY is also required to be cleared. Even though spin lock is released in between, but USER_LOCK_IN_TEARDOWN is still set, for USER_LOCK_BUSY, if before every place that waits on this flag, USER_LOCK_IN_TEARDOWN is checked to bail out, that will make sure no flow waits on the busy flag set by user_dlm_destroy_lock(), then we can simplely revert USER_LOCK_BUSY when ocfs2_dlm_unlock fails. Fix user_dlm_cluster_lock() which is the only function not following this. [ 941.336392] (python,26174,16):dlmfs_unlink:562 ERROR: unlink 004fb0000060000b5a90b8c847b72e1, error -16 from destroy [ 989.757536] ------------[ cut here ]------------ [ 989.757709] kernel BUG at fs/ocfs2/dlmfs/userdlm.c:173! [ 989.757876] invalid opcode: 0000 [#1] SMP [ 989.758027] Modules linked in: ksplice_2zhuk2jr_ib_ipoib_new(O) ksplice_2zhuk2jr(O) mptctl mptbase xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn cdc_ether usbnet mii ocfs2 jbd2 rpcsec_gss_krb5 auth_rpcgss nfsv4 nfsv3 nfs_acl nfs fscache lockd grace ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc scsi_transport_fc sunrpc ipmi_devintf bridge stp llc rds_rdma rds bonding ib_sdp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm falcon_lsm_serviceable(PE) falcon_nf_netcontain(PE) mlx4_vnic falcon_kal(E) falcon_lsm_pinned_13402(E) mlx4_ib ib_sa ib_mad ib_core ib_addr xenfs xen_privcmd dm_multipath iTCO_wdt iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 lpc_ich mfd_core ipmi_ssif i2c_core ipmi_si ipmi_msghandler [ 989.760686] ioatdma sg ext3 jbd mbcache sd_mod ahci libahci ixgbe dca ptp pps_core vxlan udp_tunnel ip6_udp_tunnel megaraid_sas mlx4_core crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3 mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ksplice_2zhuk2jr_ib_ipoib_old] [ 989.761987] CPU: 10 PID: 19102 Comm: dlm_thread Tainted: P OE 4.1.12-124.57.1.el6uek.x86_64 #2 [ 989.762290] Hardware name: Oracle Corporation ORACLE SERVER X5-2/ASM,MOTHERBOARD,1U, BIOS 30350100 06/17/2021 [ 989.762599] task: ffff880178af6200 ti: ffff88017f7c8000 task.ti: ffff88017f7c8000 [ 989.762848] RIP: e030:[<ffffffffc07d4316>] [<ffffffffc07d4316>] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.763185] RSP: e02b:ffff88017f7cbcb8 EFLAGS: 00010246 [ 989.763353] RAX: 0000000000000000 RBX: ffff880174d48008 RCX: 0000000000000003 [ 989.763565] RDX: 0000000000120012 RSI: 0000000000000003 RDI: ffff880174d48170 [ 989.763778] RBP: ffff88017f7cbcc8 R08: ffff88021f4293b0 R09: 0000000000000000 [ 989.763991] R10: ffff880179c8c000 R11: 0000000000000003 R12: ffff880174d48008 [ 989.764204] R13: 0000000000000003 R14: ffff880179c8c000 R15: ffff88021db7a000 [ 989.764422] FS: 0000000000000000(0000) GS:ffff880247480000(0000) knlGS:ffff880247480000 [ 989.764685] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 989.764865] CR2: ffff8000007f6800 CR3: 0000000001ae0000 CR4: 0000000000042660 [ 989.765081] Stack: [ 989.765167] 0000000000000003 ffff880174d48040 ffff88017f7cbd18 ffffffffc07d455f [ 989.765442] ffff88017f7cbd88 ffffffff816fb639 ffff88017f7cbd38 ffff8800361b5600 [ 989.765717] ffff88021db7a000 ffff88021f429380 0000000000000003 ffffffffc0453020 [ 989.765991] Call Trace: [ 989.766093] [<ffffffffc07d455f>] user_bast+0x5f/0xf0 [ocfs2_dlmfs] [ 989.766287] [<ffffffff816fb639>] ? schedule_timeout+0x169/0x2d0 [ 989.766475] [<ffffffffc0453020>] ? o2dlm_lock_ast_wrapper+0x20/0x20 [ocfs2_stack_o2cb] [ 989.766738] [<ffffffffc045303a>] o2dlm_blocking_ast_wrapper+0x1a/0x20 [ocfs2_stack_o2cb] [ 989.767010] [<ffffffffc0864ec6>] dlm_do_local_bast+0x46/0xe0 [ocfs2_dlm] [ 989.767217] [<ffffffffc084f5cc>] ? dlm_lockres_calc_usage+0x4c/0x60 [ocfs2_dlm] [ 989.767466] [<ffffffffc08501f1>] dlm_thread+0xa31/0x1140 [ocfs2_dlm] [ 989.767662] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.767834] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768006] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768178] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768349] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768521] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.768693] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.768893] [<ffffffff816f78ce>] ? __schedule+0x23e/0x810 [ 989.769067] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.769241] [<ffffffff810ce4d0>] ? wait_woken+0x90/0x90 [ 989.769411] [<ffffffffc084f7c0>] ? dlm_kick_thread+0x80/0x80 [ocfs2_dlm] [ 989.769617] [<ffffffff810a8bbb>] kthread+0xcb/0xf0 [ 989.769774] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.769945] [<ffffffff816f78da>] ? __schedule+0x24a/0x810 [ 989.770117] [<ffffffff810a8af0>] ? kthread_create_on_node+0x180/0x180 [ 989.770321] [<ffffffff816fdaa1>] ret_from_fork+0x61/0x90 [ 989.770492] [<ffffffff810a8af0>] ? kthread_create_on_node+0x180/0x180 [ 989.770689] Code: d0 00 00 00 f0 45 7d c0 bf 00 20 00 00 48 89 83 c0 00 00 00 48 89 83 c8 00 00 00 e8 55 c1 8c c0 83 4b 04 10 48 83 c4 08 5b 5d c3 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 83 [ 989.771892] RIP [<ffffffffc07d4316>] __user_dlm_queue_lockres.part.4+0x76/0x80 [ocfs2_dlmfs] [ 989.772174] RSP <ffff88017f7cbcb8> [ 989.772704] ---[ end trace ebd1e38cebcc93a8 ]--- [ 989.772907] Kernel panic - not syncing: Fatal exception [ 989.773173] Kernel Offset: disabled Link: https://lkml.kernel.org/r/20220518235224.87100-2-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi <junxiao.bi(a)oracle.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Joseph Qi <jiangqi903(a)gmail.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Gang He <ghe(a)suse.com> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/ocfs2/dlmfs/userdlm.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/dlmfs/userdlm.c b/fs/ocfs2/dlmfs/userdlm.c index 9cecf4857195..24dbbbf13827 100644 --- a/fs/ocfs2/dlmfs/userdlm.c +++ b/fs/ocfs2/dlmfs/userdlm.c @@ -449,6 +449,11 @@ int user_dlm_cluster_lock(struct user_lock_res *lockres, } spin_lock(&lockres->l_lock); + if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) { + spin_unlock(&lockres->l_lock); + status = -EAGAIN; + goto bail; + } /* We only compare against the currently granted level * here. If the lock is blocked waiting on a downconvert, @@ -615,7 +620,7 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres) spin_lock(&lockres->l_lock); if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) { spin_unlock(&lockres->l_lock); - return 0; + goto bail; } lockres->l_flags |= USER_LOCK_IN_TEARDOWN; @@ -629,12 +634,17 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres) } if (lockres->l_ro_holders || lockres->l_ex_holders) { + lockres->l_flags &= ~USER_LOCK_IN_TEARDOWN; spin_unlock(&lockres->l_lock); goto bail; } status = 0; if (!(lockres->l_flags & USER_LOCK_ATTACHED)) { + /* + * lock is never requested, leave USER_LOCK_IN_TEARDOWN set + * to avoid new lock request coming in. + */ spin_unlock(&lockres->l_lock); goto bail; } @@ -645,6 +655,10 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres) status = ocfs2_dlm_unlock(conn, &lockres->l_lksb, DLM_LKF_VALBLK); if (status) { + spin_lock(&lockres->l_lock); + lockres->l_flags &= ~USER_LOCK_IN_TEARDOWN; + lockres->l_flags &= ~USER_LOCK_BUSY; + spin_unlock(&lockres->l_lock); user_log_dlm_error("ocfs2_dlm_unlock", status, lockres); goto bail; } -- 2.25.1

2 1

[PATCH openEuler-25.03 v5 0/4] Add TrIO support in EROFS
by Hongbo Li 04 Mar '25

04 Mar '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v5: - Adapt to the large folio tracepoint in erofs. - Adapt to the multiple type of page size (4k and 64k). v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 ++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++ tools/trio/README.md | 517 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 52 ++ tools/trio/bpf/iotracker/iotracker.c | 57 ++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 366 +++++++++++++ tools/trio/scripts/trace_parser.py | 287 ++++++++++ 16 files changed, 1892 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] drm/imx: Fix memory leak in imx_pd_connector_get_modes
by Yang Yingliang 04 Mar '25

04 Mar '25

From: José Expósito <jose.exposito89(a)gmail.com> stable inclusion from stable-v4.19.238 commit 41624d7c0c3df71dee170c610744aaa5909327b8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1KE CVE: CVE-2022-49091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bce81feb03a20fca7bbdd1c4af16b4e9d5c0e1d3 ] Avoid leaking the display mode variable if of_get_drm_display_mode fails. Fixes: 76ecd9c9fb24 ("drm/imx: parallel-display: check return code from of_get_drm_display_mode()") Addresses-Coverity-ID: 1443943 ("Resource leak") Signed-off-by: José Expósito <jose.exposito89(a)gmail.com> Signed-off-by: Philipp Zabel <p.zabel(a)pengutronix.de> Link: https://lore.kernel.org/r/20220108165230.44610-1-jose.exposito89@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/imx/parallel-display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c index aefd04e18f93..e9dff31b377c 100644 --- a/drivers/gpu/drm/imx/parallel-display.c +++ b/drivers/gpu/drm/imx/parallel-display.c @@ -77,8 +77,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) ret = of_get_drm_display_mode(np, &imxpd->mode, &imxpd->bus_flags, OF_USE_NATIVE_MODE); - if (ret) + if (ret) { + drm_mode_destroy(connector->dev, mode); return ret; + } drm_mode_copy(mode, &imxpd->mode); mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] video: fbdev: smscufx: Fix null-ptr-deref in ufx_usb_probe()
by Yang Yingliang 04 Mar '25

04 Mar '25

From: Wang Hai <wanghai38(a)huawei.com> stable inclusion from stable-v4.19.238 commit dd3a6cc7385b89ec2303f39dfc3bafa4e24cec4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6B9 CVE: CVE-2021-47652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1791f487f877a9e83d81c8677bd3e7b259e7cb27 ] I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:fb_destroy_modelist+0x38/0x100 ... Call Trace: ufx_usb_probe.cold+0x2b5/0xac1 [smscufx] usb_probe_interface+0x1aa/0x3c0 [usbcore] really_probe+0x167/0x460 ... ret_from_fork+0x1f/0x30 If fb_alloc_cmap() fails in ufx_usb_probe(), fb_destroy_modelist() will be called to destroy modelist in the error handling path. But modelist has not been initialized yet, so it will result in null-ptr-deref. Initialize modelist before calling fb_alloc_cmap() to fix this bug. Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/fbdev/smscufx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c index 2256e5816090..8d31b0806cb7 100644 --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -1670,6 +1670,7 @@ static int ufx_usb_probe(struct usb_interface *interface, info->par = dev; info->pseudo_palette = dev->pseudo_palette; info->fbops = &ufx_ops; + INIT_LIST_HEAD(&info->modelist); retval = fb_alloc_cmap(&info->cmap, 256, 0); if (retval < 0) { @@ -1680,8 +1681,6 @@ static int ufx_usb_probe(struct usb_interface *interface, INIT_DELAYED_WORK(&dev->free_framebuffer_work, ufx_free_framebuffer_work); - INIT_LIST_HEAD(&info->modelist); - retval = ufx_reg_read(dev, 0x3000, &id_rev); check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); -- 2.25.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS 9d22d5b77cca4df43e85e93e7748def7e4d35cae
by kernel test robot 04 Mar '25

04 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 9d22d5b77cca4df43e85e93e7748def7e4d35cae !15278 tracing/osnoise: Fix resetting of tracepoints Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250304 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250304 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250304 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 720m configs tested: 19 configs skipped: 104 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250304 clang-21 arm64 randconfig-002-20250304 gcc-14.2.0 arm64 randconfig-003-20250304 gcc-14.2.0 arm64 randconfig-004-20250304 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250304 gcc-14.2.0 loongarch randconfig-002-20250304 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250304 clang-19 x86_64 buildonly-randconfig-002-20250304 gcc-12 x86_64 buildonly-randconfig-003-20250304 gcc-12 x86_64 buildonly-randconfig-004-20250304 gcc-12 x86_64 buildonly-randconfig-005-20250304 gcc-12 x86_64 buildonly-randconfig-006-20250304 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 04 Mar '25

04 Mar '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ CVE: NA ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..62e73ac32a3b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1551,6 +1551,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
by Xiangwei Li 04 Mar '25

04 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 86c3c5f8e4bd1325e24f6fba9017cade29933377 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3U4 CVE: CVE-2022-49367 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 02ded5a173619b11728b8bf75a3fd995a2c1ff28 ] of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. mv88e6xxx_mdio_register() pass the device node to of_mdiobus_register(). We don't need the device node after it. Add missing of_node_put() to avoid refcount leak. Fixes: a3c53be55c95 ("net: dsa: mv88e6xxx: Support multiple MDIO busses") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Marek Behún <kabel(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- drivers/net/dsa/mv88e6xxx/chip.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 93c893731acb..db02240af1dd 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -2778,6 +2778,7 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip, */ child = of_get_child_by_name(np, "mdio"); err = mv88e6xxx_mdio_register(chip, child, false); + of_node_put(child); if (err) return err; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/imx: Fix memory leak in imx_pd_connector_get_modes
by Yang Yingliang 04 Mar '25

04 Mar '25

From: José Expósito <jose.exposito89(a)gmail.com> stable inclusion from stable-v4.19.238 commit 515d077ee3085ae343b6bea7fd031f9906645f38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1KE CVE: CVE-2022-49091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bce81feb03a20fca7bbdd1c4af16b4e9d5c0e1d3 ] Avoid leaking the display mode variable if of_get_drm_display_mode fails. Fixes: 76ecd9c9fb24 ("drm/imx: parallel-display: check return code from of_get_drm_display_mode()") Addresses-Coverity-ID: 1443943 ("Resource leak") Signed-off-by: José Expósito <jose.exposito89(a)gmail.com> Signed-off-by: Philipp Zabel <p.zabel(a)pengutronix.de> Link: https://lore.kernel.org/r/20220108165230.44610-1-jose.exposito89@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/imx/parallel-display.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c index aefd04e18f93..e9dff31b377c 100644 --- a/drivers/gpu/drm/imx/parallel-display.c +++ b/drivers/gpu/drm/imx/parallel-display.c @@ -77,8 +77,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) ret = of_get_drm_display_mode(np, &imxpd->mode, &imxpd->bus_flags, OF_USE_NATIVE_MODE); - if (ret) + if (ret) { + drm_mode_destroy(connector->dev, mode); return ret; + } drm_mode_copy(mode, &imxpd->mode); mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, -- 2.25.1

2 1

[PATCH OLK-6.6] usb: xhci: Fix NULL pointer dereference on certain command aborts
by Li Lingfeng 04 Mar '25

04 Mar '25

From: Michal Pecio <michal.pecio(a)gmail.com> stable inclusion from stable-v6.6.76 commit b649f0d5bc256f691c7d234c3986685d54053de1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJC CVE: CVE-2024-57981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e0a19912adb68a4b2b74fd77001c96cd83eb073 upstream. If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB and no further. If the command is later aborted, when the abort completion is handled the dequeue pointer is advanced to the first TRB of the next segment. If no further commands are queued, xhci_handle_stopped_cmd_ring() sees the ring pointers unequal and assumes that there is a pending command, so it calls xhci_mod_cmd_timer() which crashes if cur_cmd was NULL. Don't attempt timer setup if cur_cmd is NULL. The subsequent doorbell ring likely is unnecessary too, but it's harmless. Leave it alone. This is probably Bug 219532, but no confirmation has been received. The issue has been independently reproduced and confirmed fixed using a USB MCU programmed to NAK the Status stage of SET_ADDRESS forever. Everything continued working normally after several prevented crashes. Link: https://bugzilla.kernel.org/show_bug.cgi?id=219532 Fixes: c311e391a7ef ("xhci: rework command timeout and cancellation,") CC: stable(a)vger.kernel.org Signed-off-by: Michal Pecio <michal.pecio(a)gmail.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20241227120142.1035206-4-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index b0641f51fcb8..73cd26d349f0 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -419,7 +419,8 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci, if ((xhci->cmd_ring->dequeue != xhci->cmd_ring->enqueue) && !(xhci->xhc_state & XHCI_STATE_DYING)) { xhci->current_cmd = cur_cmd; - xhci_mod_cmd_timer(xhci); + if (cur_cmd) + xhci_mod_cmd_timer(xhci); xhci_ring_cmd_db(xhci); } } -- 2.31.1

2 1

[PATCH OLK-6.6 0/3] CVE-2025-21732
by Ye Bin 04 Mar '25

04 Mar '25

From: Ye Bin <yebin(a)huaweicloud.com> Jason Gunthorpe (1): RDMA/mlx5: Ensure created mkeys always have a populated rb_key Or Har-Toov (1): RDMA/mlx5: Change check for cacheable mkeys Yishai Hadas (1): RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + drivers/infiniband/hw/mlx5/mr.c | 46 ++++++++++++++++++++++------ drivers/infiniband/hw/mlx5/odp.c | 2 ++ 3 files changed, 39 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] net: sfc: add missing xdp queue reinitialization
by Yang Yingliang 04 Mar '25

04 Mar '25

From: Taehee Yoo <ap420073(a)gmail.com> mainline inclusion from mainline-v5.18-rc2 commit 059a47f1da93811d37533556d67e72f2261b1127 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5MU CVE: CVE-2022-49096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After rx/tx ring buffer size is changed, kernel panic occurs when it acts XDP_TX or XDP_REDIRECT. When tx/rx ring buffer size is changed(ethtool -G), sfc driver reallocates and reinitializes rx and tx queues and their buffer (tx_queue->buffer). But it misses reinitializing xdp queues(efx->xdp_tx_queues). So, while it is acting XDP_TX or XDP_REDIRECT, it uses the uninitialized tx_queue->buffer. A new function efx_set_xdp_channels() is separated from efx_set_channels() to handle only xdp queues. Splat looks like: BUG: kernel NULL pointer dereference, address: 000000000000002a #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#4] PREEMPT SMP NOPTI RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G D 5.17.0+ #55 e8beeee8289528f11357029357cf Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 RSP: 0018:ffff92f121e45c60 EFLAGS: 00010297 RIP: 0010:efx_tx_map_chunk+0x54/0x90 [sfc] RAX: 0000000000000040 RBX: ffff92ea506895c0 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001139b10ce RDI: ffff92ea506895c0 RBP: ffffffffc0358a80 R08: 00000001139b110d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001139b10ce R15: ffff92ea506895c0 FS: 0000000000000000(0000) GS:ffff92f121ec0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Code: 48 8b 8d a8 01 00 00 48 8d 14 52 4c 8d 2c d0 44 89 e0 48 85 c9 74 0e 44 89 e2 4c 89 f6 48 80 CR2: 000000000000002a CR3: 00000003e6810004 CR4: 00000000007706e0 RSP: 0018:ffff92f121e85c60 EFLAGS: 00010297 PKRU: 55555554 RAX: 0000000000000040 RBX: ffff92ea50689700 RCX: ffffffffc0330870 RDX: 0000000000000001 RSI: 00000001145a90ce RDI: ffff92ea50689700 RBP: ffffffffc0358a80 R08: 00000001145a910d R09: 0000000000000000 R10: 0000000000000001 R11: ffff92ea414c0088 R12: 0000000000000040 R13: 0000000000000018 R14: 00000001145a90ce R15: ffff92ea50689700 FS: 0000000000000000(0000) GS:ffff92f121e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000002a CR3: 00000003e6810005 CR4: 00000000007706e0 PKRU: 55555554 Call Trace: <IRQ> efx_xdp_tx_buffers+0x12b/0x3d0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] __efx_rx_packet+0x5c3/0x930 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_rx_packet+0x28c/0x2e0 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] efx_ef10_ev_process+0x5f8/0xf40 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] ? enqueue_task_fair+0x95/0x550 efx_poll+0xc4/0x360 [sfc 84c94b8e32d44d296c17e10a634d3ad454de4ba5] Fixes: 3990a8fffbda ("sfc: allocate channels for XDP tx queues") Signed-off-by: Taehee Yoo <ap420073(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: drivers/net/ethernet/sfc/efx_channels.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/sfc/efx_channels.c | 85 ++++++++++++++----------- 1 file changed, 47 insertions(+), 38 deletions(-) diff --git a/drivers/net/ethernet/sfc/efx_channels.c b/drivers/net/ethernet/sfc/efx_channels.c index c49168ba7a4d..5beb2eed297c 100644 --- a/drivers/net/ethernet/sfc/efx_channels.c +++ b/drivers/net/ethernet/sfc/efx_channels.c @@ -744,6 +744,51 @@ void efx_remove_channels(struct efx_nic *efx) kfree(efx->xdp_tx_queues); } +static void efx_set_xdp_channels(struct efx_nic *efx) +{ + struct efx_tx_queue *tx_queue; + struct efx_channel *channel; + unsigned int next_queue = 0; + int xdp_queue_number = 0; + + /* We need to mark which channels really have RX and TX + * queues, and adjust the TX queue numbers if we have separate + * RX-only and TX-only channels. + */ + efx_for_each_channel(channel, efx) { + if (channel->channel < efx->tx_channel_offset) + continue; + + if (efx_channel_is_xdp_tx(channel)) { + efx_for_each_channel_tx_queue(tx_queue, channel) { + tx_queue->queue = next_queue++; + + /* We may have a few left-over XDP TX + * queues owing to xdp_tx_queue_count + * not dividing evenly by EFX_MAX_TXQ_PER_CHANNEL. + * We still allocate and probe those + * TXQs, but never use them. + */ + if (xdp_queue_number < efx->xdp_tx_queue_count) { + netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is XDP %u, HW %u\n", + channel->channel, tx_queue->label, + xdp_queue_number, tx_queue->queue); + efx->xdp_tx_queues[xdp_queue_number] = tx_queue; + xdp_queue_number++; + } + } + } else { + efx_for_each_channel_tx_queue(tx_queue, channel) { + tx_queue->queue = next_queue++; + netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is HW %u\n", + channel->channel, tx_queue->label, + tx_queue->queue); + } + } + } + WARN_ON(xdp_queue_number != efx->xdp_tx_queue_count); +} + int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) { struct efx_channel *other_channel[EFX_MAX_CHANNELS], *channel, @@ -817,6 +862,7 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) efx_init_napi_channel(efx->channel[i]); } + efx_set_xdp_channels(efx); out: efx->ptp_data = NULL; /* Destroy unused channel structures */ @@ -854,10 +900,7 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) int efx_set_channels(struct efx_nic *efx) { - struct efx_tx_queue *tx_queue; struct efx_channel *channel; - unsigned int next_queue = 0; - int xdp_queue_number; int rc; if (efx->xdp_tx_queue_count) { @@ -871,47 +914,13 @@ int efx_set_channels(struct efx_nic *efx) return -ENOMEM; } - /* We need to mark which channels really have RX and TX - * queues, and adjust the TX queue numbers if we have separate - * RX-only and TX-only channels. - */ - xdp_queue_number = 0; efx_for_each_channel(channel, efx) { if (channel->channel < efx->n_rx_channels) channel->rx_queue.core_index = channel->channel; else channel->rx_queue.core_index = -1; - - if (channel->channel >= efx->tx_channel_offset) { - if (efx_channel_is_xdp_tx(channel)) { - efx_for_each_channel_tx_queue(tx_queue, channel) { - tx_queue->queue = next_queue++; - - /* We may have a few left-over XDP TX - * queues owing to xdp_tx_queue_count - * not dividing evenly by EFX_MAX_TXQ_PER_CHANNEL. - * We still allocate and probe those - * TXQs, but never use them. - */ - if (xdp_queue_number < efx->xdp_tx_queue_count) { - netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is XDP %u, HW %u\n", - channel->channel, tx_queue->label, - xdp_queue_number, tx_queue->queue); - efx->xdp_tx_queues[xdp_queue_number] = tx_queue; - xdp_queue_number++; - } - } - } else { - efx_for_each_channel_tx_queue(tx_queue, channel) { - tx_queue->queue = next_queue++; - netif_dbg(efx, drv, efx->net_dev, "Channel %u TXQ %u is HW %u\n", - channel->channel, tx_queue->label, - tx_queue->queue); - } - } - } } - WARN_ON(xdp_queue_number != efx->xdp_tx_queue_count); + efx_set_xdp_channels(efx); rc = netif_set_real_num_tx_queues(efx->net_dev, efx->n_tx_channels); if (rc) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] um: Fix out-of-bounds read in LDT setup
by Xiangwei Li 04 Mar '25

04 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> mainline inclusion from mainline-v5.19-rc1 commit 2a4a62a14be1947fa945c5c11ebf67326381a568 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP73Y CVE: CVE-2022-49395 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace: show_stack.cold+0x166/0x2a7 __dump_stack+0x3a/0x43 dump_stack_lvl+0x1f/0x27 print_report.cold+0xdb/0xf81 kasan_report+0x119/0x1f0 kasan_check_range+0x3a3/0x440 memcpy+0x52/0x140 syscall_stub_data+0x70/0xe0 write_ldt_entry+0xac/0x190 init_new_ldt+0x515/0x960 init_new_context+0x2c4/0x4d0 mm_init.constprop.0+0x5ed/0x760 mm_alloc+0x118/0x170 0x60033f48 do_one_initcall+0x1d7/0x860 0x60003e7b kernel_init+0x6e/0x3d4 new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1 and is located at offset 64 in frame: init_new_ldt+0x0/0x960 This frame has 2 objects: [32, 40) 'addr' [64, 80) 'desc' ================================================================== Fixes: 858259cf7d1c443c83 ("uml: maintain own LDT entries") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Cc: stable(a)vger.kernel.org Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- arch/x86/um/ldt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/um/ldt.c b/arch/x86/um/ldt.c index 3ee234b6234d..255a44dd415a 100644 --- a/arch/x86/um/ldt.c +++ b/arch/x86/um/ldt.c @@ -23,9 +23,11 @@ static long write_ldt_entry(struct mm_id *mm_idp, int func, { long res; void *stub_addr; + + BUILD_BUG_ON(sizeof(*desc) % sizeof(long)); + res = syscall_stub_data(mm_idp, (unsigned long *)desc, - (sizeof(*desc) + sizeof(long) - 1) & - ~(sizeof(long) - 1), + sizeof(*desc) / sizeof(long), addr, &stub_addr); if (!res) { unsigned long args[] = { func, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 04 Mar '25

04 Mar '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..62e73ac32a3b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1551,6 +1551,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md: bypass block throttle for superblock update
by Zheng Qixing 04 Mar '25

04 Mar '25

From: Junxiao Bi <junxiao.bi(a)oracle.com> mainline inclusion from mainline-v6.8-rc1 commit d6e035aad6c09991da1c667fb83419329a3baed8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBLD3D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ commit 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") introduced a hung bug and will be reverted in next patch, since the issue that commit is fixing is due to md superblock write is throttled by wbt, to fix it, we can have superblock write bypass block layer throttle. Fixes: 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d") Cc: stable(a)vger.kernel.org # v5.19+ Suggested-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Junxiao Bi <junxiao.bi(a)oracle.com> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Song Liu <song(a)kernel.org> Link: https://lore.kernel.org/r/20231108182216.73611-1-junxiao.bi@oracle.com Conflicts: drivers/md/md.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80f7b58c202e..b9748a0a0e30 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -871,7 +871,8 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, test_bit(FailFast, &rdev->flags) && !test_bit(LastDev, &rdev->flags)) ff = MD_FAILFAST; - bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_PREFLUSH | REQ_FUA | ff; + bio->bi_opf = REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META + | REQ_PREFLUSH | REQ_FUA | ff; atomic_inc(&mddev->pending_writes); submit_bio(bio); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1: fix memory leak in raid1_run() if no active rdev
by Zheng Qixing 04 Mar '25

04 Mar '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKXOB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux.git/commit/?h=… ---------------------- When `raid1_set_limits()` fails or when the array has no active `rdev`, the allocated memory for `conf` is not properly freed. Add raid1_free() call to properly free the conf in error path. Fixes: 799af947ed13 ("md/raid1: don't free conf on raid0_run failure") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> Conflicts: drivers/md/raid1.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index ee3826db193d..3113184f4d99 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -77,6 +77,7 @@ static int max_queued_requests = 1024; static void allow_barrier(struct r1conf *conf, sector_t sector_nr); static void lower_barrier(struct r1conf *conf, sector_t sector_nr); +static void raid1_free(struct mddev *mddev, void *priv); #define raid1_log(md, fmt, args...) \ do { if ((md)->queue) blk_add_trace_msg((md)->queue, "raid1 " fmt, ##args); } while (0) @@ -3148,6 +3149,8 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(&conf->thread); + if (!mddev->private) + raid1_free(mddev, conf); return -EINVAL; } -- 2.39.2

2 1

[PATCH OLK-6.6] USB: hub: Ignore non-compliant devices with too many configs or interfaces
by Bowen You 04 Mar '25

04 Mar '25

From: Alan Stern <stern(a)rowland.harvard.edu> Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate pointer: Oops: general protection fault, probably for non-canonical address 0xcccccccccccccccc: 0000 [#1] SMP DEBUG_PAGEALLOC PTI CPU: 7 UID: 0 PID: 117 Comm: kworker/7:1 Not tainted 6.13.0-rc3-00017-gf44d154d6e3d #14 Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_hub_adjust_deviceremovable+0x78/0x110 ... Call Trace: <TASK> ? die_addr+0x31/0x80 ? exc_general_protection+0x1b4/0x3c0 ? asm_exc_general_protection+0x26/0x30 ? usb_hub_adjust_deviceremovable+0x78/0x110 hub_probe+0x7c7/0xab0 usb_probe_interface+0x14b/0x350 really_probe+0xd0/0x2d0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x6e/0x110 driver_probe_device+0x1a/0x90 __device_attach_driver+0x7e/0xc0 bus_for_each_drv+0x7f/0xd0 __device_attach+0xaa/0x1a0 bus_probe_device+0x8b/0xa0 device_add+0x62e/0x810 usb_set_configuration+0x65d/0x990 usb_generic_driver_probe+0x4b/0x70 usb_probe_device+0x36/0xd0 The cause of this error is that the device has two interfaces, and the hub driver binds to interface 1 instead of interface 0, which is where usb_hub_to_struct_hub() looks. We can prevent the problem from occurring by refusing to accept hub devices that violate the USB spec by having more than one configuration or interface. Reported-and-tested-by: Robert Morris <rtm(a)csail.mit.edu> Cc: stable <stable(a)kernel.org> Closes: https://lore.kernel.org/linux-usb/95564.1737394039@localhost/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/r/c27f3bf4-63d8-4fb5-ac82-09e3cd19f61c@rowland.harv… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/usb/core/hub.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1ba3feb5e190..f295609649b1 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1818,6 +1818,17 @@ static int hub_probe(struct usb_interface *intf, const struct usb_device_id *id) desc = intf->cur_altsetting; hdev = interface_to_usbdev(intf); + /* + * The USB 2.0 spec prohibits hubs from having more than one + * configuration or interface, and we rely on this prohibition. + * Refuse to accept a device that violates it. + */ + if (hdev->descriptor.bNumConfigurations > 1 || + hdev->actconfig->desc.bNumInterfaces > 1) { + dev_err(&intf->dev, "Invalid hub with more than one config or interface\n"); + return -EINVAL; + } + /* * Set default autosuspend delay as 0 to speedup bus suspend, * based on the below considerations: -- 2.34.1

2 1

[PATCH OLK-6.6] ptp: Ensure info->enable callback is always set
by Pu Lehui 04 Mar '25

04 Mar '25

From: Thomas Weißschuh <linux(a)weissschuh.net> stable inclusion from stable-v6.6.78 commit 81846070cba17125a866e8023c01d3465b153339 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLLG CVE: CVE-2025-21814 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fd53aa40e65f518453115b6f56183b0c201db26b upstream. The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c. Instead use a dummy callback if no better was specified by the driver. Fixes: d94ba80ebbea ("ptp: Added a brand new class driver for ptp clocks.") Cc: stable(a)vger.kernel.org Signed-off-by: Thomas Weißschuh <linux(a)weissschuh.net> Acked-by: Richard Cochran <richardcochran(a)gmail.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Link: https://patch.msgid.link/20250123-ptp-enable-v1-1-b015834d3a47@weissschuh.n… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/ptp/ptp_clock.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c index b586da2e3002..6b7e8b7ebcef 100644 --- a/drivers/ptp/ptp_clock.c +++ b/drivers/ptp/ptp_clock.c @@ -189,6 +189,11 @@ static int ptp_getcycles64(struct ptp_clock_info *info, struct timespec64 *ts) return info->gettime64(info, ts); } +static int ptp_enable(struct ptp_clock_info *ptp, struct ptp_clock_request *request, int on) +{ + return -EOPNOTSUPP; +} + static void ptp_aux_kworker(struct kthread_work *work) { struct ptp_clock *ptp = container_of(work, struct ptp_clock, @@ -251,6 +256,9 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, ptp->info->getcrosscycles = ptp->info->getcrosststamp; } + if (!ptp->info->enable) + ptp->info->enable = ptp_enable; + if (ptp->info->do_aux_work) { kthread_init_delayed_work(&ptp->aux_work, ptp_aux_kworker); ptp->kworker = kthread_create_worker(0, "ptp%d", ptp->index); -- 2.34.1

2 1

[PATCH OLK-6.6] usbnet: ipheth: fix possible overflow in DPE length check
by Pu Lehui 04 Mar '25

04 Mar '25

From: Foster Snowhill <forst(a)pen.gy> stable inclusion from stable-v6.6.78 commit 18bf6f5cce3172cb303c3f0551aa9443d5ed74f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC69 CVE: CVE-2025-21743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c219427ed296f94bb4b91d08626776dc7719ee27 upstream. Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB read. Move the wDatagramIndex term to the other side of the inequality. An existing condition ensures that wDatagramIndex < urb->actual_length. Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support") Cc: stable(a)vger.kernel.org Signed-off-by: Foster Snowhill <forst(a)pen.gy> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/usb/ipheth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index 46afb95ffabe..45daae234cb8 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -243,8 +243,8 @@ static int ipheth_rcvbulk_callback_ncm(struct urb *urb) while (le16_to_cpu(dpe->wDatagramIndex) != 0 && le16_to_cpu(dpe->wDatagramLength) != 0) { if (le16_to_cpu(dpe->wDatagramIndex) >= urb->actual_length || - le16_to_cpu(dpe->wDatagramIndex) + - le16_to_cpu(dpe->wDatagramLength) > urb->actual_length) { + le16_to_cpu(dpe->wDatagramLength) > urb->actual_length - + le16_to_cpu(dpe->wDatagramIndex)) { dev->net->stats.rx_length_errors++; return retval; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] af_packet: avoid erroring out after sock_init_data() in packet_create()
by Zhang Changzhong 04 Mar '25

04 Mar '25

From: Ignat Korchagin <ignat(a)cloudflare.com> mainline inclusion from mainline-v6.13-rc1 commit 46f2a11cb82b657fd15bab1c47821b635e03838b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJZ2Y CVE: CVE-2024-56606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free. Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-2-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/packet/af_packet.c [commit 89ed5b519004 ("af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index e26ee04..98b9e4f 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -3276,18 +3276,18 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, if (sock->type == SOCK_PACKET) sock->ops = &packet_ops_spkt; + po = pkt_sk(sk); + err = packet_alloc_pending(po); + if (err) + goto out_sk_free; + sock_init_data(sock, sk); - po = pkt_sk(sk); init_completion(&po->skb_completion); sk->sk_family = PF_PACKET; po->num = proto; po->xmit = dev_queue_xmit; - err = packet_alloc_pending(po); - if (err) - goto out2; - packet_cached_dev_reset(po); sk->sk_destruct = packet_sock_destruct; @@ -3322,7 +3322,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, preempt_enable(); return 0; -out2: +out_sk_free: sk_free(sk); out: return err; -- 2.9.5

2 1

[PATCH OLK-5.10] netfilter: nf_set_pipapo: fix initial map fill
by Zhang Changzhong 04 Mar '25

04 Mar '25

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.11-rc1 commit 791a615b7ad2258c560f91852be54b0480837c93 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJKDJ CVE: CVE-2024-57947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size. After each round in the map search step, the result and the fill map are swapped, so if we have a set where f->bsize of the first element is smaller than m->bsize_max, those one-bits are leaked into future rounds result map. This makes pipapo find an incorrect matching results for sets where first field size is not the largest. Followup patch adds a test case to nft_concat_range.sh selftest script. Thanks to Stefano Brivio for pointing out that we need to zero out the remainder explicitly, only correcting memset() argument isn't enough. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Yi Chen <yiche(a)redhat.com> Cc: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_set_pipapo_avx2.c [commit f04df573faf9 ("netfilter: nft_set_pipapo: constify lookup fn args where possible") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 4 ++-- net/netfilter/nft_set_pipapo.h | 21 +++++++++++++++++++++ net/netfilter/nft_set_pipapo_avx2.c | 10 ++++++---- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 65ecf486..1a76c9b 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -432,7 +432,7 @@ bool nft_pipapo_lookup(const struct net *net, const struct nft_set *set, res_map = scratch->map + (map_index ? m->bsize_max : 0); fill_map = scratch->map + (map_index ? 0 : m->bsize_max); - memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); + pipapo_resmap_init(m, res_map); nft_pipapo_for_each_field(f, i, m) { bool last = i == m->field_count - 1; @@ -536,7 +536,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, goto out; } - memset(res_map, 0xff, m->bsize_max * sizeof(*res_map)); + pipapo_resmap_init(m, res_map); nft_pipapo_for_each_field(f, i, m) { bool last = i == m->field_count - 1; diff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h index 2e709ae..8f8f58a 100644 --- a/net/netfilter/nft_set_pipapo.h +++ b/net/netfilter/nft_set_pipapo.h @@ -287,4 +287,25 @@ static u64 pipapo_estimate_size(const struct nft_set_desc *desc) return size; } +/** + * pipapo_resmap_init() - Initialise result map before first use + * @m: Matching data, including mapping table + * @res_map: Result map + * + * Initialize all bits covered by the first field to one, so that after + * the first step, only the matching bits of the first bit group remain. + * + * If other fields have a large bitmap, set remainder of res_map to 0. + */ +static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map) +{ + const struct nft_pipapo_field *f = m->f; + int i; + + for (i = 0; i < f->bsize; i++) + res_map[i] = ULONG_MAX; + + for (i = f->bsize; i < m->bsize_max; i++) + res_map[i] = 0ul; +} #endif /* _NFT_SET_PIPAPO_H */ diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c index 60fb8bc..fdc6c43 100644 --- a/net/netfilter/nft_set_pipapo_avx2.c +++ b/net/netfilter/nft_set_pipapo_avx2.c @@ -1027,6 +1027,7 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, /** * nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes + * @mdata: Matching data, including mapping table * @map: Previous match result, used as initial bitmap * @fill: Destination bitmap to be filled with current match result * @f: Field, containing lookup and mapping tables @@ -1042,7 +1043,8 @@ static int nft_pipapo_avx2_lookup_8b_16(unsigned long *map, unsigned long *fill, * Return: -1 on no match, rule index of match if @last, otherwise first long * word index to be checked next (i.e. first filled word). */ -static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, +static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata, + unsigned long *map, unsigned long *fill, struct nft_pipapo_field *f, int offset, const u8 *pkt, bool first, bool last) { @@ -1052,7 +1054,7 @@ static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill, lt += offset * NFT_PIPAPO_LONGS_PER_M256; if (first) - memset(map, 0xff, bsize * sizeof(*map)); + pipapo_resmap_init(mdata, map); for (i = offset; i < bsize; i++) { if (f->bb == 8) @@ -1173,7 +1175,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, } else if (f->groups == 16) { NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16); } else { - ret = nft_pipapo_avx2_lookup_slow(res, fill, f, + ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, ret, rp, first, last); } @@ -1189,7 +1191,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set, } else if (f->groups == 32) { NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32); } else { - ret = nft_pipapo_avx2_lookup_slow(res, fill, f, + ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f, ret, rp, first, last); } -- 2.9.5

2 1

[PATCH OLK-6.6 0/5] CVE-2024-57952
by Yongjian Sun 04 Mar '25

04 Mar '25

*** BLURB HERE *** Chuck Lever (5): [Backport] libfs: Return ENOSPC when the directory offset range is exhausted [Backport] Revert "libfs: Add simple_offset_empty()" [Backport] Revert "libfs: fix infinite directory reads for offset dir" [Backport] libfs: Replace simple_offset end-of-directory detection libfs: Use d_children list to iterate simple_offset directories fs/libfs.c | 164 ++++++++++++++++++++++----------------------- include/linux/fs.h | 1 - mm/shmem.c | 4 +- 3 files changed, 81 insertions(+), 88 deletions(-) -- 2.39.2

2 6

[PATCH openEuler-1.0-LTS] bpf, arm64: Clear prog->jited_len along prog->jited
by Pu Lehui 04 Mar '25

04 Mar '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.247 commit aaf61a312af63e1cfe2264c4c5b8cd4ea3626025 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP65P CVE: CVE-2022-49341 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10f3b29c65bb2fe0d47c2945cd0b4087be1c5218 ] syzbot reported an illegal copy_to_user() attempt from bpf_prog_get_info_by_fd() [1] There was no repro yet on this bug, but I think that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") is exposing a prior bug in bpf arm64. bpf_prog_get_info_by_fd() looks at prog->jited_len to determine if the JIT image can be copied out to user space. My theory is that syzbot managed to get a prog where prog->jited_len has been set to 43, while prog->bpf_func has ben cleared. It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering this particular warning. I thought find_vma_area(NULL) would not find a vm_struct. As we do not hold vmap_area_lock spinlock, it might be possible that the found vm_struct was garbage. [1] usercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)! kernel BUG at mm/usercopy.c:101! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 25002 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-10139-g8291eaafed36 #0 Hardware name: linux,dummy-virt (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : usercopy_abort+0x90/0x94 mm/usercopy.c:101 lr : usercopy_abort+0x90/0x94 mm/usercopy.c:89 sp : ffff80000b773a20 x29: ffff80000b773a30 x28: faff80000b745000 x27: ffff80000b773b48 x26: 0000000000000000 x25: 000000000000002b x24: 0000000000000000 x23: 00000000000000e0 x22: ffff80000b75db67 x21: 0000000000000001 x20: 000000000000002b x19: ffff80000b75db3c x18: 00000000fffffffd x17: 2820636f6c6c616d x16: 76206d6f72662064 x15: 6574636574656420 x14: 74706d6574746120 x13: 2129333420657a69 x12: 73202c3237313031 x11: 3237313434333533 x10: 3336323937207465 x9 : 657275736f707865 x8 : ffff80000a30c550 x7 : ffff80000b773830 x6 : ffff80000b773830 x5 : 0000000000000000 x4 : ffff00007fbbaa10 x3 : 0000000000000000 x2 : 0000000000000000 x1 : f7ff000028fc0000 x0 : 0000000000000064 Call trace: usercopy_abort+0x90/0x94 mm/usercopy.c:89 check_heap_object mm/usercopy.c:186 [inline] __check_object_size mm/usercopy.c:252 [inline] __check_object_size+0x198/0x36c mm/usercopy.c:214 check_object_size include/linux/thread_info.h:199 [inline] check_copy_size include/linux/thread_info.h:235 [inline] copy_to_user include/linux/uaccess.h:159 [inline] bpf_prog_get_info_by_fd.isra.0+0xf14/0xfdc kernel/bpf/syscall.c:3993 bpf_obj_get_info_by_fd+0x12c/0x510 kernel/bpf/syscall.c:4253 __sys_bpf+0x900/0x2150 kernel/bpf/syscall.c:4956 __do_sys_bpf kernel/bpf/syscall.c:5021 [inline] __se_sys_bpf kernel/bpf/syscall.c:5019 [inline] __arm64_sys_bpf+0x28/0x40 kernel/bpf/syscall.c:5019 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 el0_svc_common.constprop.0+0x44/0xec arch/arm64/kernel/syscall.c:142 do_el0_svc+0xa0/0xc0 arch/arm64/kernel/syscall.c:206 el0_svc+0x44/0xb0 arch/arm64/kernel/entry-common.c:624 el0t_64_sync_handler+0x1ac/0x1b0 arch/arm64/kernel/entry-common.c:642 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:581 Code: aa0003e3 d00038c0 91248000 97fff65f (d4210000) Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Song Liu <songliubraving(a)fb.com> Link: https://lore.kernel.org/bpf/20220531215113.1100754-1-eric.dumazet@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 04d82cf2d461..49ec5ce974f3 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -946,6 +946,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) bpf_jit_binary_free(header); prog->bpf_func = NULL; prog->jited = 0; + prog->jited_len = 0; goto out_off; } bpf_jit_binary_lock_ro(header); -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS 252f84b8f8205e5b1f29719d9139ed187c2873f4
by kernel test robot 04 Mar '25

04 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 252f84b8f8205e5b1f29719d9139ed187c2873f4 !15227 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.54-6.6.55 LTS Conflicts Patches Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250303 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-r123-20250304 | |-- drivers-scsi-leapioraid-leapioraid_func.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-usertype-value-got-restricted-__le32-usertype | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250303 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250303 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250303 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250303 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250303 |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:vm_compaction-proc_handler |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:vm_compaction-procname |-- mm-kasan-kasan_test.c-rcu_uaf_reclaim()-warn:statement-has-no-effect |-- mm-kasan-kasan_test.c-workqueue_uaf()-warn:statement-has-no-effect |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 725m configs tested: 21 configs skipped: 124 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250303 clang-21 arm64 randconfig-002-20250303 clang-19 arm64 randconfig-003-20250303 gcc-14.2.0 arm64 randconfig-004-20250303 clang-19 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250303 gcc-14.2.0 loongarch randconfig-002-20250303 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250303 clang-19 x86_64 buildonly-randconfig-002-20250303 gcc-12 x86_64 buildonly-randconfig-003-20250303 clang-19 x86_64 buildonly-randconfig-004-20250303 gcc-12 x86_64 buildonly-randconfig-005-20250303 gcc-12 x86_64 buildonly-randconfig-006-20250303 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1980/1980] drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 04 Mar '25

04 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 252f84b8f8205e5b1f29719d9139ed187c2873f4 commit: 7fea595ef48e9ab13bd31df067b19152153e1925 [1980/1980] SCSI: LEAPIORAID: Supports LEAPIO RAID controller config: loongarch-randconfig-r123-20250304 (https://download.01.org/0day-ci/archive/20250304/202503040511.Dk9g0ZiZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250304/202503040511.Dk9g0ZiZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503040511.Dk9g0ZiZ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 static [addressable] [assigned] [toplevel] [usertype] s_addr @@ got unsigned int [addressable] [usertype] ip @@ drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: expected restricted __be32 static [addressable] [assigned] [toplevel] [usertype] s_addr drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: got unsigned int [addressable] [usertype] ip drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long [usertype] iov_len @@ got restricted __le32 [usertype] datasize @@ drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: expected unsigned long [usertype] iov_len drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: got restricted __le32 [usertype] datasize drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __le32 [usertype] datasize @@ got unsigned int [assigned] [usertype] send_sz @@ drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: expected restricted __le32 [usertype] datasize drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: got unsigned int [assigned] [usertype] send_sz drivers/scsi/leapioraid/leapioraid_func.c:671:1: sparse: sparse: symbol 'leapioraid_base_stop_smart_polling' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c:1300:1: sparse: sparse: symbol 'leapioraid_base_process_reply_queue' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1468:5: sparse: sparse: symbol 'leapioraid_base_irqpoll' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1490:1: sparse: sparse: symbol 'leapioraid_base_init_irqpolls' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1924:21: sparse: sparse: symbol 'leapioraid_pcie_link_speed' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:2946:31: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: expected unsigned int [usertype] value drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] ImageSize @@ got unsigned long [assigned] [usertype] data_length @@ drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: expected restricted __le32 [usertype] ImageSize drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: got unsigned long [assigned] [usertype] data_length drivers/scsi/leapioraid/leapioraid_func.c:4414:1: sparse: sparse: symbol 'leapioraid_base_flush_ios_and_panic' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: sparse: invalid assignment: |= drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: left side has type restricted __le16 drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: right side has type int drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le64 [addressable] [assigned] [usertype] BufAddr @@ got unsigned long long [usertype] log_buffer_dma @@ drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: expected restricted __le64 [addressable] [assigned] [usertype] BufAddr drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: got unsigned long long [usertype] log_buffer_dma drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [addressable] [assigned] [usertype] BufSize @@ got int @@ drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: expected restricted __le32 [addressable] [assigned] [usertype] BufSize drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: got int drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c: note: in included file (through include/linux/module.h): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +3291 drivers/scsi/leapioraid/leapioraid_func.c 3280 3281 static void 3282 leapioraid_base_put_smid_scsi_io_atomic(struct LEAPIORAID_ADAPTER *ioc, 3283 u16 smid, u16 handle) 3284 { 3285 struct LeapioraidAtomicReqDesc_t descriptor; 3286 u32 *request = (u32 *) &descriptor; 3287 3288 descriptor.RequestFlags = LEAPIORAID_REQ_DESCRIPT_FLAGS_SCSI_IO; 3289 descriptor.MSIxIndex = leapioraid_base_set_and_get_msix_index(ioc, smid); 3290 descriptor.SMID = cpu_to_le16(smid); > 3291 writel(cpu_to_le32(*request), &ioc->chip->AtomicRequestDescriptorPost); 3292 } 3293 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1345/1345] net/netfilter/nf_nat_proto.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Mar '25

03 Mar '25

Hi Florian, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: df3541670ca99b09f2f70d1733516ef7a2289b29 commit: 83abe3a3b85762720192809ac8695ff9255cfd23 [1345/1345] netfilter: nat: remove csum_recalc hook config: x86_64-buildonly-randconfig-004-20241224 (https://download.01.org/0day-ci/archive/20250303/202503032046.ehJfxCPP-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250303/202503032046.ehJfxCPP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503032046.ehJfxCPP-lkp@intel.com/ All warnings (new ones prefixed by >>): net/netfilter/nf_nat_proto.c:56:6: warning: no previous prototype for function 'nf_nat_csum_recalc' [-Wmissing-prototypes] 56 | void nf_nat_csum_recalc(struct sk_buff *skb, | ^ net/netfilter/nf_nat_proto.c:56:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 56 | void nf_nat_csum_recalc(struct sk_buff *skb, | ^ | static 1 warning generated. >> net/netfilter/nf_nat_proto.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] tcp: Defer ts_recent changes until req is owned
by Liu Jian 03 Mar '25

03 Mar '25

From: Wang Hai <wanghai38(a)huawei.com> mainline inclusion from mainline-v6.14-rc5 commit 8d52da23b6c68a0f6bad83959ebb61a2cf623c4e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBN5ZW CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- Recently a bug was discovered where the server had entered TCP_ESTABLISHED state, but the upper layers were not notified. The same 5-tuple packet may be processed by different CPUSs, so two CPUs may receive different ack packets at the same time when the state is TCP_NEW_SYN_RECV. In that case, req->ts_recent in tcp_check_req may be changed concurrently, which will probably cause the newsk's ts_recent to be incorrectly large. So that tcp_validate_incoming will fail. At this point, newsk will not be able to enter the TCP_ESTABLISHED. cpu1 cpu2 tcp_check_req tcp_check_req req->ts_recent = rcv_tsval = t1 req->ts_recent = rcv_tsval = t2 syn_recv_sock tcp_sk(child)->rx_opt.ts_recent = req->ts_recent = t2 // t1 < t2 tcp_child_process tcp_rcv_state_process tcp_validate_incoming tcp_paws_check if ((s32)(rx_opt->ts_recent - rx_opt->rcv_tsval) <= paws_win) // t2 - t1 > paws_win, failed tcp_v4_do_rcv tcp_rcv_state_process // TCP_ESTABLISHED The cpu2's skb or a newly received skb will call tcp_v4_do_rcv to get the newsk into the TCP_ESTABLISHED state, but at this point it is no longer possible to notify the upper layer application. A notification mechanism could be added here, but the fix is more complex, so the current fix is used. In tcp_check_req, req->ts_recent is used to assign a value to tcp_sk(child)->rx_opt.ts_recent, so removing the change in req->ts_recent and changing tcp_sk(child)->rx_opt.ts_recent directly after owning the req fixes this bug. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Reviewed-by: Jason Xing <kerneljasonxing(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/tcp_minisocks.c [Did not backport d4f2c86b2b7e2.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/ipv4/tcp_minisocks.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index e2dbc9ab892a..f121307c0cb5 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -743,9 +743,6 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, /* In sequence, PAWS is OK. */ - if (tmp_opt.saw_tstamp && !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt)) - req->ts_recent = tmp_opt.rcv_tsval; - if (TCP_SKB_CB(skb)->seq == tcp_rsk(req)->rcv_isn) { /* Truncate SYN, it is out of window starting at tcp_rsk(req)->rcv_isn + 1. */ @@ -794,6 +791,10 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, if (!child) goto listen_overflow; + if (own_req && tmp_opt.saw_tstamp && + !after(TCP_SKB_CB(skb)->seq, tcp_rsk(req)->rcv_nxt)) + tcp_sk(child)->rx_opt.ts_recent = tmp_opt.rcv_tsval; + sock_rps_save_rxhash(child, skb); tcp_synack_rtt_meas(child, req); *req_stolen = !own_req; -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] Fix CVE-2022-49285
by Hongbo Li 03 Mar '25

03 Mar '25

Fix CVE-2022-49285. Haibo Chen (1): iio: accel: mma8452: use the correct logic to get mma8452_data drivers/iio/accel/mma8452.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion
by Li Huafei 03 Mar '25

03 Mar '25

From: Ping-Ke Shih <pkshih(a)realtek.com> mainline inclusion from mainline-v6.14-rc1 commit ba4bb0402c60e945c4c396c51f0acac3c3e3ea5c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK7 CVE: CVE-2025-21729 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rtwdev->scanning flag isn't protected by mutex originally, so cancel_hw_scan can pass the condition, but suddenly hw_scan completion unset the flag and calls ieee80211_scan_completed() that will free local->hw_scan_req. Then, cancel_hw_scan raises null-ptr-deref and use-after-free. Fix it by moving the check condition to where protected by mutex. KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 2 PID: 6922 Comm: kworker/2:2 Tainted: G OE Hardware name: LENOVO 2356AD1/2356AD1, BIOS G7ETB6WW (2.76 ) 09/10/2019 Workqueue: events cfg80211_conn_work [cfg80211] RIP: 0010:rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] Code: 00 45 89 6c 24 1c 0f 85 23 01 00 00 48 8b 85 20 ff ff ff 48 8d RSP: 0018:ffff88811fd9f068 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff88811fd9f258 RCX: 0000000000000001 RDX: 0000000000000011 RSI: 0000000000000001 RDI: 0000000000000089 RBP: ffff88811fd9f170 R08: 0000000000000000 R09: 0000000000000000 R10: ffff88811fd9f108 R11: 0000000000000000 R12: ffff88810e47f960 R13: 0000000000000000 R14: 000000000000ffff R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881d6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007531dfca55b0 CR3: 00000001be296004 CR4: 00000000001706e0 Call Trace: <TASK> ? show_regs+0x61/0x73 ? __die_body+0x20/0x73 ? die_addr+0x4f/0x7b ? exc_general_protection+0x191/0x1db ? asm_exc_general_protection+0x27/0x30 ? rtw89_fw_h2c_scan_offload_be+0xc33/0x13c3 [rtw89_core] ? rtw89_fw_h2c_scan_offload_be+0x458/0x13c3 [rtw89_core] ? __pfx_rtw89_fw_h2c_scan_offload_be+0x10/0x10 [rtw89_core] ? do_raw_spin_lock+0x75/0xdb ? __pfx_do_raw_spin_lock+0x10/0x10 rtw89_hw_scan_offload+0xb5e/0xbf7 [rtw89_core] ? _raw_spin_unlock+0xe/0x24 ? __mutex_lock.constprop.0+0x40c/0x471 ? __pfx_rtw89_hw_scan_offload+0x10/0x10 [rtw89_core] ? __mutex_lock_slowpath+0x13/0x1f ? mutex_lock+0xa2/0xdc ? __pfx_mutex_lock+0x10/0x10 rtw89_hw_scan_abort+0x58/0xb7 [rtw89_core] rtw89_ops_cancel_hw_scan+0x120/0x13b [rtw89_core] ieee80211_scan_cancel+0x468/0x4d0 [mac80211] ieee80211_prep_connection+0x858/0x899 [mac80211] ieee80211_mgd_auth+0xbea/0xdde [mac80211] ? __pfx_ieee80211_mgd_auth+0x10/0x10 [mac80211] ? cfg80211_find_elem+0x15/0x29 [cfg80211] ? is_bss+0x1b7/0x1d7 [cfg80211] ieee80211_auth+0x18/0x27 [mac80211] cfg80211_mlme_auth+0x3bb/0x3e7 [cfg80211] cfg80211_conn_do_work+0x410/0xb81 [cfg80211] ? __pfx_cfg80211_conn_do_work+0x10/0x10 [cfg80211] ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? __kasan_check_write+0x14/0x22 ? mutex_lock+0x8e/0xdc ? __pfx_mutex_lock+0x10/0x10 ? __pfx___radix_tree_lookup+0x10/0x10 cfg80211_conn_work+0x245/0x34d [cfg80211] ? __pfx_cfg80211_conn_work+0x10/0x10 [cfg80211] ? update_cfs_rq_load_avg+0x3bc/0x3d7 ? sched_clock_noinstr+0x9/0x1a ? sched_clock+0x10/0x24 ? sched_clock_cpu+0x7e/0x42e ? newidle_balance+0x796/0x937 ? __pfx_sched_clock_cpu+0x10/0x10 ? __pfx_newidle_balance+0x10/0x10 ? __kasan_check_read+0x11/0x1f ? psi_group_change+0x8bc/0x944 ? _raw_spin_unlock+0xe/0x24 ? raw_spin_rq_unlock+0x47/0x54 ? raw_spin_rq_unlock_irq+0x9/0x1f ? finish_task_switch.isra.0+0x347/0x586 ? __schedule+0x27bf/0x2892 ? mutex_unlock+0x80/0xd0 ? do_raw_spin_lock+0x75/0xdb ? __pfx___schedule+0x10/0x10 process_scheduled_works+0x58c/0x821 worker_thread+0x4c7/0x586 ? __kasan_check_read+0x11/0x1f kthread+0x285/0x294 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x29/0x6f ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Fixes: 895907779752 ("rtw89: 8852a: add ieee80211_ops::hw_scan") Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20250107114254.6769-1-pkshih@realtek.com Conflicts: drivers/net/wireless/realtek/rtw89/mac80211.c [ Context conflicts caused by not backport commit aad0394e7a02 ("wifi: rtw89: tweak driver architecture for impending MLO support"). ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/net/wireless/realtek/rtw89/mac80211.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/realtek/rtw89/mac80211.c b/drivers/net/wireless/realtek/rtw89/mac80211.c index 5b9de1f41dc7..892a538a7ea5 100644 --- a/drivers/net/wireless/realtek/rtw89/mac80211.c +++ b/drivers/net/wireless/realtek/rtw89/mac80211.c @@ -872,11 +872,13 @@ static void rtw89_ops_cancel_hw_scan(struct ieee80211_hw *hw, if (!RTW89_CHK_FW_FEATURE(SCAN_OFFLOAD, &rtwdev->fw)) return; + mutex_lock(&rtwdev->mutex); + if (!rtwdev->scanning) - return; + goto out; - mutex_lock(&rtwdev->mutex); rtw89_hw_scan_abort(rtwdev, vif); +out: mutex_unlock(&rtwdev->mutex); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2022-49404
by Liao Chen 03 Mar '25

03 Mar '25

fix CVE-2022-49404 Dennis Dalessandro (1): RDMA/hfi1: Fix potential integer multiplication overflow errors drivers/infiniband/hw/hfi1/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] [Backport] fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()
by Yongjian Sun 03 Mar '25

03 Mar '25

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.12-rc3 commit 2afd4d267e6dbaec8d3ccd4f5396cb84bc67aa2e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5A CVE: CVE-2024-52560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Extended the `mi_enum_attr()` function interface with an additional parameter, `struct ntfs_inode *ni`, to allow marking the inode as bad as soon as an error is detected. Reported-by: syzbot+73d8fc29ec7cba8286fa(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Conflicts: fs/ntfs3/record.c [Context Changed] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ntfs3/attrib.c | 11 +++---- fs/ntfs3/frecord.c | 59 +++++++++++++++++++----------------- fs/ntfs3/ntfs_fs.h | 21 ++++++------- fs/ntfs3/record.c | 75 ++++++++++++++++++++++++---------------------- 4 files changed, 88 insertions(+), 78 deletions(-) diff --git a/fs/ntfs3/attrib.c b/fs/ntfs3/attrib.c index fc6cea60044e..98b459a54beb 100644 --- a/fs/ntfs3/attrib.c +++ b/fs/ntfs3/attrib.c @@ -788,7 +788,8 @@ int attr_set_size(struct ntfs_inode *ni, enum ATTR_TYPE type, if (err) goto out; - attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id); + attr = mi_find_attr(ni, mi, NULL, type, name, name_len, + &le->id); if (!attr) { err = -EINVAL; goto bad_inode; @@ -1180,7 +1181,7 @@ int attr_data_get_block(struct ntfs_inode *ni, CLST vcn, CLST clen, CLST *lcn, goto out; } - attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, &le->id); + attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, &le->id); if (!attr) { err = -EINVAL; goto out; @@ -1805,7 +1806,7 @@ int attr_allocate_frame(struct ntfs_inode *ni, CLST frame, size_t compr_size, goto out; } - attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, + attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, &le->id); if (!attr) { err = -EINVAL; @@ -2050,8 +2051,8 @@ int attr_collapse_range(struct ntfs_inode *ni, u64 vbo, u64 bytes) } /* Look for required attribute. */ - attr = mi_find_attr(mi, NULL, ATTR_DATA, NULL, - 0, &le->id); + attr = mi_find_attr(ni, mi, NULL, ATTR_DATA, + NULL, 0, &le->id); if (!attr) { err = -EINVAL; goto out; diff --git a/fs/ntfs3/frecord.c b/fs/ntfs3/frecord.c index 12e03feb3074..3a254bc5af74 100644 --- a/fs/ntfs3/frecord.c +++ b/fs/ntfs3/frecord.c @@ -75,7 +75,7 @@ struct ATTR_STD_INFO *ni_std(struct ntfs_inode *ni) { const struct ATTRIB *attr; - attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL); + attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL); return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO)) : NULL; } @@ -89,7 +89,7 @@ struct ATTR_STD_INFO5 *ni_std5(struct ntfs_inode *ni) { const struct ATTRIB *attr; - attr = mi_find_attr(&ni->mi, NULL, ATTR_STD, NULL, 0, NULL); + attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_STD, NULL, 0, NULL); return attr ? resident_data_ex(attr, sizeof(struct ATTR_STD_INFO5)) : NULL; @@ -201,7 +201,8 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr, *mi = &ni->mi; /* Look for required attribute in primary record. */ - return mi_find_attr(&ni->mi, attr, type, name, name_len, NULL); + return mi_find_attr(ni, &ni->mi, attr, type, name, name_len, + NULL); } /* First look for list entry of required type. */ @@ -217,7 +218,7 @@ struct ATTRIB *ni_find_attr(struct ntfs_inode *ni, struct ATTRIB *attr, return NULL; /* Look for required attribute. */ - attr = mi_find_attr(m, NULL, type, name, name_len, &le->id); + attr = mi_find_attr(ni, m, NULL, type, name, name_len, &le->id); if (!attr) goto out; @@ -259,7 +260,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr, if (mi) *mi = &ni->mi; /* Enum attributes in primary record. */ - return mi_enum_attr(&ni->mi, attr); + return mi_enum_attr(ni, &ni->mi, attr); } /* Get next list entry. */ @@ -275,7 +276,7 @@ struct ATTRIB *ni_enum_attr_ex(struct ntfs_inode *ni, struct ATTRIB *attr, *mi = mi2; /* Find attribute in loaded record. */ - return rec_find_attr_le(mi2, le2); + return rec_find_attr_le(ni, mi2, le2); } /* @@ -293,7 +294,8 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, if (!ni->attr_list.size) { if (pmi) *pmi = &ni->mi; - return mi_find_attr(&ni->mi, NULL, type, name, name_len, NULL); + return mi_find_attr(ni, &ni->mi, NULL, type, name, name_len, + NULL); } le = al_find_ex(ni, NULL, type, name, name_len, NULL); @@ -319,7 +321,7 @@ struct ATTRIB *ni_load_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, if (pmi) *pmi = mi; - attr = mi_find_attr(mi, NULL, type, name, name_len, &le->id); + attr = mi_find_attr(ni, mi, NULL, type, name, name_len, &le->id); if (!attr) return NULL; @@ -398,7 +400,8 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, int diff; if (base_only || type == ATTR_LIST || !ni->attr_list.size) { - attr = mi_find_attr(&ni->mi, NULL, type, name, name_len, id); + attr = mi_find_attr(ni, &ni->mi, NULL, type, name, name_len, + id); if (!attr) return -ENOENT; @@ -437,7 +440,7 @@ int ni_remove_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, al_remove_le(ni, le); - attr = mi_find_attr(mi, NULL, type, name, name_len, id); + attr = mi_find_attr(ni, mi, NULL, type, name, name_len, id); if (!attr) return -ENOENT; @@ -485,7 +488,7 @@ ni_ins_new_attr(struct ntfs_inode *ni, struct mft_inode *mi, name = le->name; } - attr = mi_insert_attr(mi, type, name, name_len, asize, name_off); + attr = mi_insert_attr(ni, mi, type, name, name_len, asize, name_off); if (!attr) { if (le_added) al_remove_le(ni, le); @@ -673,7 +676,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) if (err) return err; - attr_list = mi_find_attr(&ni->mi, NULL, ATTR_LIST, NULL, 0, NULL); + attr_list = mi_find_attr(ni, &ni->mi, NULL, ATTR_LIST, NULL, 0, NULL); if (!attr_list) return 0; @@ -695,7 +698,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) if (!mi) return 0; - attr = mi_find_attr(mi, NULL, le->type, le_name(le), + attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le), le->name_len, &le->id); if (!attr) return 0; @@ -731,7 +734,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) goto out; } - attr = mi_find_attr(mi, NULL, le->type, le_name(le), + attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le), le->name_len, &le->id); if (!attr) { /* Should never happened, 'cause already checked. */ @@ -740,7 +743,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) asize = le32_to_cpu(attr->size); /* Insert into primary record. */ - attr_ins = mi_insert_attr(&ni->mi, le->type, le_name(le), + attr_ins = mi_insert_attr(ni, &ni->mi, le->type, le_name(le), le->name_len, asize, le16_to_cpu(attr->name_off)); if (!attr_ins) { @@ -768,7 +771,7 @@ static int ni_try_remove_attr_list(struct ntfs_inode *ni) if (!mi) continue; - attr = mi_find_attr(mi, NULL, le->type, le_name(le), + attr = mi_find_attr(ni, mi, NULL, le->type, le_name(le), le->name_len, &le->id); if (!attr) continue; @@ -831,7 +834,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) free_b = 0; attr = NULL; - for (; (attr = mi_enum_attr(&ni->mi, attr)); le = Add2Ptr(le, sz)) { + for (; (attr = mi_enum_attr(ni, &ni->mi, attr)); le = Add2Ptr(le, sz)) { sz = le_size(attr->name_len); le->type = attr->type; le->size = cpu_to_le16(sz); @@ -886,7 +889,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) u32 asize = le32_to_cpu(b->size); u16 name_off = le16_to_cpu(b->name_off); - attr = mi_insert_attr(mi, b->type, Add2Ptr(b, name_off), + attr = mi_insert_attr(ni, mi, b->type, Add2Ptr(b, name_off), b->name_len, asize, name_off); if (!attr) goto out; @@ -909,7 +912,7 @@ int ni_create_attr_list(struct ntfs_inode *ni) goto out; } - attr = mi_insert_attr(&ni->mi, ATTR_LIST, NULL, 0, + attr = mi_insert_attr(ni, &ni->mi, ATTR_LIST, NULL, 0, lsize + SIZEOF_RESIDENT, SIZEOF_RESIDENT); if (!attr) goto out; @@ -993,13 +996,13 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, mi = rb_entry(node, struct mft_inode, node); if (is_mft_data && - (mi_enum_attr(mi, NULL) || + (mi_enum_attr(ni, mi, NULL) || vbo <= ((u64)mi->rno << sbi->record_bits))) { /* We can't accept this record 'cause MFT's bootstrapping. */ continue; } if (is_mft && - mi_find_attr(mi, NULL, ATTR_DATA, NULL, 0, NULL)) { + mi_find_attr(ni, mi, NULL, ATTR_DATA, NULL, 0, NULL)) { /* * This child record already has a ATTR_DATA. * So it can't accept any other records. @@ -1008,7 +1011,7 @@ static int ni_ins_attr_ext(struct ntfs_inode *ni, struct ATTR_LIST_ENTRY *le, } if ((type != ATTR_NAME || name_len) && - mi_find_attr(mi, NULL, type, name, name_len, NULL)) { + mi_find_attr(ni, mi, NULL, type, name, name_len, NULL)) { /* Only indexed attributes can share same record. */ continue; } @@ -1157,7 +1160,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, /* Estimate the result of moving all possible attributes away. */ attr = NULL; - while ((attr = mi_enum_attr(&ni->mi, attr))) { + while ((attr = mi_enum_attr(ni, &ni->mi, attr))) { if (attr->type == ATTR_STD) continue; if (attr->type == ATTR_LIST) @@ -1175,7 +1178,7 @@ static int ni_insert_attr(struct ntfs_inode *ni, enum ATTR_TYPE type, attr = NULL; for (;;) { - attr = mi_enum_attr(&ni->mi, attr); + attr = mi_enum_attr(ni, &ni->mi, attr); if (!attr) { /* We should never be here 'cause we have already check this case. */ err = -EINVAL; @@ -1259,7 +1262,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) for (node = rb_first(&ni->mi_tree); node; node = rb_next(node)) { mi = rb_entry(node, struct mft_inode, node); - attr = mi_enum_attr(mi, NULL); + attr = mi_enum_attr(ni, mi, NULL); if (!attr) { mft_min = mi->rno; @@ -1280,7 +1283,7 @@ static int ni_expand_mft_list(struct ntfs_inode *ni) ni_remove_mi(ni, mi_new); } - attr = mi_find_attr(&ni->mi, NULL, ATTR_DATA, NULL, 0, NULL); + attr = mi_find_attr(ni, &ni->mi, NULL, ATTR_DATA, NULL, 0, NULL); if (!attr) { err = -EINVAL; goto out; @@ -1397,7 +1400,7 @@ int ni_expand_list(struct ntfs_inode *ni) continue; /* Find attribute in primary record. */ - attr = rec_find_attr_le(&ni->mi, le); + attr = rec_find_attr_le(ni, &ni->mi, le); if (!attr) { err = -EINVAL; goto out; @@ -3417,7 +3420,7 @@ int ni_write_inode(struct inode *inode, int sync, const char *hint) if (!mi->dirty) continue; - is_empty = !mi_enum_attr(mi, NULL); + is_empty = !mi_enum_attr(ni, mi, NULL); if (is_empty) clear_rec_inuse(mi->mrec); diff --git a/fs/ntfs3/ntfs_fs.h b/fs/ntfs3/ntfs_fs.h index cfe9d3bf07f9..0aea6ab15c14 100644 --- a/fs/ntfs3/ntfs_fs.h +++ b/fs/ntfs3/ntfs_fs.h @@ -738,23 +738,24 @@ int mi_get(struct ntfs_sb_info *sbi, CLST rno, struct mft_inode **mi); void mi_put(struct mft_inode *mi); int mi_init(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno); int mi_read(struct mft_inode *mi, bool is_mft); -struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr); -// TODO: id? -struct ATTRIB *mi_find_attr(struct mft_inode *mi, struct ATTRIB *attr, - enum ATTR_TYPE type, const __le16 *name, - u8 name_len, const __le16 *id); -static inline struct ATTRIB *rec_find_attr_le(struct mft_inode *rec, +struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr); +struct ATTRIB *mi_find_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr, enum ATTR_TYPE type, + const __le16 *name, u8 name_len, const __le16 *id); +static inline struct ATTRIB *rec_find_attr_le(struct ntfs_inode *ni, + struct mft_inode *rec, struct ATTR_LIST_ENTRY *le) { - return mi_find_attr(rec, NULL, le->type, le_name(le), le->name_len, + return mi_find_attr(ni, rec, NULL, le->type, le_name(le), le->name_len, &le->id); } int mi_write(struct mft_inode *mi, int wait); int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno, __le16 flags, bool is_mft); -struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, - const __le16 *name, u8 name_len, u32 asize, - u16 name_off); +struct ATTRIB *mi_insert_attr(struct ntfs_inode *ni, struct mft_inode *mi, + enum ATTR_TYPE type, const __le16 *name, + u8 name_len, u32 asize, u16 name_off); bool mi_remove_attr(struct ntfs_inode *ni, struct mft_inode *mi, struct ATTRIB *attr); diff --git a/fs/ntfs3/record.c b/fs/ntfs3/record.c index f810f0419d25..25aa5997a947 100644 --- a/fs/ntfs3/record.c +++ b/fs/ntfs3/record.c @@ -31,7 +31,7 @@ static inline int compare_attr(const struct ATTRIB *left, enum ATTR_TYPE type, * * Return: Unused attribute id that is less than mrec->next_attr_id. */ -static __le16 mi_new_attt_id(struct mft_inode *mi) +static __le16 mi_new_attt_id(struct ntfs_inode *ni, struct mft_inode *mi) { u16 free_id, max_id, t16; struct MFT_REC *rec = mi->mrec; @@ -52,7 +52,7 @@ static __le16 mi_new_attt_id(struct mft_inode *mi) attr = NULL; for (;;) { - attr = mi_enum_attr(mi, attr); + attr = mi_enum_attr(ni, mi, attr); if (!attr) { rec->next_attr_id = cpu_to_le16(max_id + 1); mi->dirty = true; @@ -195,7 +195,8 @@ int mi_read(struct mft_inode *mi, bool is_mft) * NOTE: mi->mrec - memory of size sbi->record_size * here we sure that mi->mrec->total == sbi->record_size (see mi_read) */ -struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) +struct ATTRIB *mi_enum_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr) { const struct MFT_REC *rec = mi->mrec; u32 used = le32_to_cpu(rec->used); @@ -209,11 +210,11 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) off = le16_to_cpu(rec->attr_off); if (used > total) - return NULL; + goto out; if (off >= used || off < MFTRECORD_FIXUP_OFFSET_1 || !IS_ALIGNED(off, 4)) { - return NULL; + goto out; } /* Skip non-resident records. */ @@ -240,7 +241,7 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) /* NOTE: this code also checks attr->size availability. */ if (off + 8 > used) { static_assert(ALIGN(sizeof(enum ATTR_TYPE), 8) == 8); - return NULL; + goto out; } if (attr->type == ATTR_END) { @@ -251,105 +252,109 @@ struct ATTRIB *mi_enum_attr(struct mft_inode *mi, struct ATTRIB *attr) /* 0x100 is last known attribute for now. */ t32 = le32_to_cpu(attr->type); if (!t32 || (t32 & 0xf) || (t32 > 0x100)) - return NULL; + goto out; /* attributes in record must be ordered by type */ if (t32 < prev_type) - return NULL; + goto out; asize = le32_to_cpu(attr->size); /* Check overflow and boundary. */ if (off + asize < off || off + asize > used) - return NULL; + goto out; /* Check size of attribute. */ if (!attr->non_res) { /* Check resident fields. */ if (asize < SIZEOF_RESIDENT) - return NULL; + goto out; t16 = le16_to_cpu(attr->res.data_off); if (t16 > asize) - return NULL; + goto out; if (le32_to_cpu(attr->res.data_size) > asize - t16) - return NULL; + goto out; t32 = sizeof(short) * attr->name_len; if (t32 && le16_to_cpu(attr->name_off) + t32 > t16) - return NULL; + goto out; return attr; } /* Check nonresident fields. */ if (attr->non_res != 1) - return NULL; + goto out; /* Can we use memory including attr->nres.valid_size? */ if (asize < SIZEOF_NONRESIDENT) - return NULL; + goto out; t16 = le16_to_cpu(attr->nres.run_off); if (t16 > asize) - return NULL; + goto out; t32 = sizeof(short) * attr->name_len; if (t32 && le16_to_cpu(attr->name_off) + t32 > t16) - return NULL; + goto out; /* Check start/end vcn. */ if (le64_to_cpu(attr->nres.svcn) > le64_to_cpu(attr->nres.evcn) + 1) - return NULL; + goto out; data_size = le64_to_cpu(attr->nres.data_size); if (le64_to_cpu(attr->nres.valid_size) > data_size) - return NULL; + goto out; alloc_size = le64_to_cpu(attr->nres.alloc_size); if (data_size > alloc_size) - return NULL; + goto out; t32 = mi->sbi->cluster_mask; if (alloc_size & t32) - return NULL; + goto out; if (!attr->nres.svcn && is_attr_ext(attr)) { /* First segment of sparse/compressed attribute */ /* Can we use memory including attr->nres.total_size? */ if (asize < SIZEOF_NONRESIDENT_EX) - return NULL; + goto out; tot_size = le64_to_cpu(attr->nres.total_size); if (tot_size & t32) - return NULL; + goto out; if (tot_size > alloc_size) - return NULL; + goto out; } else { if (attr->nres.c_unit) - return NULL; + goto out; if (alloc_size > mi->sbi->volume.size) - return NULL; + goto out; } return attr; + +out: + _ntfs_bad_inode(&ni->vfs_inode); + return NULL; } /* * mi_find_attr - Find the attribute by type and name and id. */ -struct ATTRIB *mi_find_attr(struct mft_inode *mi, struct ATTRIB *attr, - enum ATTR_TYPE type, const __le16 *name, - u8 name_len, const __le16 *id) +struct ATTRIB *mi_find_attr(struct ntfs_inode *ni, struct mft_inode *mi, + struct ATTRIB *attr, enum ATTR_TYPE type, + const __le16 *name, u8 name_len, const __le16 *id) { u32 type_in = le32_to_cpu(type); u32 atype; next_attr: - attr = mi_enum_attr(mi, attr); + attr = mi_enum_attr(ni, mi, attr); if (!attr) return NULL; @@ -457,9 +462,9 @@ int mi_format_new(struct mft_inode *mi, struct ntfs_sb_info *sbi, CLST rno, * * Return: Not full constructed attribute or NULL if not possible to create. */ -struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, - const __le16 *name, u8 name_len, u32 asize, - u16 name_off) +struct ATTRIB *mi_insert_attr(struct ntfs_inode *ni, struct mft_inode *mi, + enum ATTR_TYPE type, const __le16 *name, + u8 name_len, u32 asize, u16 name_off) { size_t tail; struct ATTRIB *attr; @@ -478,7 +483,7 @@ struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, * at which we should insert it. */ attr = NULL; - while ((attr = mi_enum_attr(mi, attr))) { + while ((attr = mi_enum_attr(ni, mi, attr))) { int diff = compare_attr(attr, type, name, name_len, upcase); if (diff < 0) @@ -498,7 +503,7 @@ struct ATTRIB *mi_insert_attr(struct mft_inode *mi, enum ATTR_TYPE type, tail = used - PtrOffset(rec, attr); } - id = mi_new_attt_id(mi); + id = mi_new_attt_id(ni, mi); memmove(Add2Ptr(attr, asize), attr, tail); memset(attr, 0, asize); -- 2.39.2

2 1

[PATCH OLK-6.6] tracing/osnoise: Fix resetting of tracepoints
by Li Huafei 03 Mar '25

03 Mar '25

From: Steven Rostedt <rostedt(a)goodmis.org> stable inclusion from stable-v6.6.78 commit ee8c4c39a8f97467d63adfe03bcd45139d8c8b53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8L CVE: CVE-2025-21733 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e3ff4245928f948f3eb2e852aa350b870421c358 upstream. If a timerlat tracer is started with the osnoise option OSNOISE_WORKLOAD disabled, but then that option is enabled and timerlat is removed, the tracepoints that were enabled on timerlat registration do not get disabled. If the option is disabled again and timelat is started, then it triggers a warning in the tracepoint code due to registering the tracepoint again without ever disabling it. Do not use the same user space defined options to know to disable the tracepoints when timerlat is removed. Instead, set a global flag when it is enabled and use that flag to know to disable the events. ~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options ~# echo timerlat > /sys/kernel/tracing/current_tracer ~# echo OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options ~# echo nop > /sys/kernel/tracing/current_tracer ~# echo NO_OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options ~# echo timerlat > /sys/kernel/tracing/current_tracer Triggers: ------------[ cut here ]------------ WARNING: CPU: 6 PID: 1337 at kernel/tracepoint.c:294 tracepoint_add_func+0x3b6/0x3f0 Modules linked in: CPU: 6 UID: 0 PID: 1337 Comm: rtla Not tainted 6.13.0-rc4-test-00018-ga867c441128e-dirty #73 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:tracepoint_add_func+0x3b6/0x3f0 Code: 48 8b 53 28 48 8b 73 20 4c 89 04 24 e8 23 59 11 00 4c 8b 04 24 e9 36 fe ff ff 0f 0b b8 ea ff ff ff 45 84 e4 0f 84 68 fe ff ff <0f> 0b e9 61 fe ff ff 48 8b 7b 18 48 85 ff 0f 84 4f ff ff ff 49 8b RSP: 0018:ffffb9b003a87ca0 EFLAGS: 00010202 RAX: 00000000ffffffef RBX: ffffffff92f30860 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff9bf59e91ccd0 RDI: ffffffff913b6410 RBP: 000000000000000a R08: 00000000000005c7 R09: 0000000000000002 R10: ffffb9b003a87ce0 R11: 0000000000000002 R12: 0000000000000001 R13: ffffb9b003a87ce0 R14: ffffffffffffffef R15: 0000000000000008 FS: 00007fce81209240(0000) GS:ffff9bf6fdd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e99b728000 CR3: 00000001277c0002 CR4: 0000000000172ef0 Call Trace: <TASK> ? __warn.cold+0xb7/0x14d ? tracepoint_add_func+0x3b6/0x3f0 ? report_bug+0xea/0x170 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? __pfx_trace_sched_migrate_callback+0x10/0x10 ? tracepoint_add_func+0x3b6/0x3f0 ? __pfx_trace_sched_migrate_callback+0x10/0x10 ? __pfx_trace_sched_migrate_callback+0x10/0x10 tracepoint_probe_register+0x78/0xb0 ? __pfx_trace_sched_migrate_callback+0x10/0x10 osnoise_workload_start+0x2b5/0x370 timerlat_tracer_init+0x76/0x1b0 tracing_set_tracer+0x244/0x400 tracing_set_trace_write+0xa0/0xe0 vfs_write+0xfc/0x570 ? do_sys_openat2+0x9c/0xe0 ksys_write+0x72/0xf0 do_syscall_64+0x79/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Tomas Glozar <tglozar(a)redhat.com> Cc: Gabriele Monaco <gmonaco(a)redhat.com> Cc: Luis Goncalves <lgoncalv(a)redhat.com> Cc: John Kacur <jkacur(a)redhat.com> Link: https://lore.kernel.org/20250123204159.4450c88e@gandalf.local.home Fixes: e88ed227f639e ("tracing/timerlat: Add user-space interface") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- kernel/trace/trace_osnoise.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index 3e2bc029fa8c..cc155590018f 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c @@ -1235,6 +1235,8 @@ static void trace_sched_migrate_callback(void *data, struct task_struct *p, int } } +static bool monitor_enabled; + static int register_migration_monitor(void) { int ret = 0; @@ -1243,16 +1245,25 @@ static int register_migration_monitor(void) * Timerlat thread migration check is only required when running timerlat in user-space. * Thus, enable callback only if timerlat is set with no workload. */ - if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) + if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) { + if (WARN_ON_ONCE(monitor_enabled)) + return 0; + ret = register_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); + if (!ret) + monitor_enabled = true; + } return ret; } static void unregister_migration_monitor(void) { - if (timerlat_enabled() && !test_bit(OSN_WORKLOAD, &osnoise_options)) - unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); + if (!monitor_enabled) + return; + + unregister_trace_sched_migrate_task(trace_sched_migrate_callback, NULL); + monitor_enabled = false; } #else static int register_migration_monitor(void) -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode()
by Yongjian Sun 03 Mar '25

03 Mar '25

From: Jiang Liu <gerry(a)linux.alibaba.com> mainline inclusion from mainline-v6.12-rc3 commit a0a455b4bc7483ad60e8b8a50330c1e05bb7bfcf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC7M CVE: CVE-2025-21784 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In function psp_init_cap_microcode(), it should bail out when failed to load firmware, otherwise it may cause invalid memory access. Fixes: 07dbfc6b102e ("drm/amd: Use `amdgpu_ucode_*` helpers for PSP") Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Jiang Liu <gerry(a)linux.alibaba.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c index a4f9015345cc..6a24e8ceb944 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -3450,9 +3450,10 @@ int psp_init_cap_microcode(struct psp_context *psp, const char *chip_name) if (err == -ENODEV) { dev_warn(adev->dev, "cap microcode does not exist, skip\n"); err = 0; - goto out; + } else { + dev_err(adev->dev, "fail to initialize cap microcode\n"); } - dev_err(adev->dev, "fail to initialize cap microcode\n"); + goto out; } info = &adev->firmware.ucode[AMDGPU_UCODE_ID_CAP]; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: libfc: Fix use after free in fc_exch_abts_resp()
by Baokun Li 03 Mar '25

03 Mar '25

From: Jianglei Nie <niejianglei2021(a)163.com> stable inclusion from stable-v4.19.238 commit 6044ad64f41c87382cfeeca281573d1886d80cbe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBYM CVE: CVE-2022-49114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 271add11994ba1a334859069367e04d2be2ebdd4 ] fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free. Link: https://lore.kernel.org/r/20220303015115.459778-1-niejianglei2021@163.com Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- drivers/scsi/libfc/fc_exch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c index 6ba257cbc6d9..e821d4cbe772 100644 --- a/drivers/scsi/libfc/fc_exch.c +++ b/drivers/scsi/libfc/fc_exch.c @@ -1703,6 +1703,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) if (cancel_delayed_work_sync(&ep->timeout_work)) { FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n"); fc_exch_release(ep); /* release from pending timer hold */ + return; } spin_lock_bh(&ep->ex_lock); -- 2.46.1

2 1

[PATCH OLK-6.6 0/4] arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait()
by Zeng Heng 03 Mar '25

03 Mar '25

Zeng Heng (4): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitors drivers/platform/mpam/mpam_devices.c | 2 +- drivers/platform/mpam/mpam_internal.h | 2 +- drivers/platform/mpam/mpam_resctrl.c | 46 ++++++++------------------- fs/resctrl/rdtgroup.c | 6 ++-- 4 files changed, 19 insertions(+), 37 deletions(-) -- 2.25.1

2 5

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 03 Mar '25

03 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: df3541670ca99b09f2f70d1733516ef7a2289b29 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250303/202503031330.RPH0chUc-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503031330.RPH0chUc-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1424/1424] mm/page_alloc.c:3005: warning: Function parameter or member 'mt' not described in '__putback_isolated_page'
by kernel test robot 03 Mar '25

03 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: df3541670ca99b09f2f70d1733516ef7a2289b29 commit: 91bac2310ae7eca9d9869222c96fcc3d02851eea [1424/1424] mm: add function __putback_isolated_page config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20250303/202503031153.NCtb0XuW-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250303/202503031153.NCtb0XuW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503031153.NCtb0XuW-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_alloc.c:21: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/page_alloc.c:58: include/linux/mm_inline.h:32:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/page_alloc.c:1419:6: warning: no previous prototype for function 'set_zone_contiguous' [-Wmissing-prototypes] 1419 | void set_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1419:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1419 | void set_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:1441:6: warning: no previous prototype for function 'clear_zone_contiguous' [-Wmissing-prototypes] 1441 | void clear_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1441:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1441 | void clear_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:2304:5: warning: no previous prototype for function 'find_suitable_fallback' [-Wmissing-prototypes] 2304 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ mm/page_alloc.c:2304:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2304 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ | static mm/page_alloc.c:3081:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3081 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3129:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3129 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 8 warnings generated. >> mm/page_alloc.c:3005: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' mm/page_alloc.o: warning: objtool: missing symbol for section .ref.text vim +3005 mm/page_alloc.c 2995 2996 /** 2997 * __putback_isolated_page - Return a now-isolated page back where we got it 2998 * @page: Page that was isolated 2999 * @order: Order of the isolated page 3000 * 3001 * This function is meant to return a page pulled from the free lists via 3002 * __isolate_free_page back to the free lists they were pulled from. 3003 */ 3004 void __putback_isolated_page(struct page *page, unsigned int order, int mt) > 3005 { 3006 struct zone *zone = page_zone(page); 3007 3008 /* zone lock should be held when this function is called */ 3009 lockdep_assert_held(&zone->lock); 3010 3011 /* Return isolated page to tail of freelist. */ 3012 __free_one_page(page, page_to_pfn(page), zone, order, mt); 3013 } 3014 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ARM: davinci: da850-evm: Avoid NULL pointer dereference
by Yuntao Liu 03 Mar '25

03 Mar '25

From: Nathan Chancellor <nathan(a)kernel.org> stable inclusion from stable-v4.19.239 commit c64e2ed5cc376e137e572babfd2edc38b2cfb61b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP62H CVE: CVE-2021-47631 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 83a1cde5c74bfb44b49cb2a940d044bb2380f4ea upstream. With newer versions of GCC, there is a panic in da850_evm_config_emac() when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine: Unable to handle kernel NULL pointer dereference at virtual address 00000020 pgd = (ptrval) [00000020] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 Hardware name: Generic DT based system PC is at da850_evm_config_emac+0x1c/0x120 LR is at do_one_initcall+0x50/0x1e0 The emac_pdata pointer in soc_info is NULL because davinci_soc_info only gets populated on davinci machines but da850_evm_config_emac() is called on all machines via device_initcall(). Move the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC. Fixes: bae105879f2f ("davinci: DA850/OMAP-L138 EVM: implement autodetect of RMII PHY") Signed-off-by: Nathan Chancellor <nathan(a)kernel.org> Reviewed-by: Arnd Bergmann <arnd(a)arndb.de> Reviewed-by: Bartosz Golaszewski <brgl(a)bgdev.pl> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/YcS4xVWs6bQlQSPC@archlinux-ax161/ Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm/mach-davinci/board-da850-evm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c index 774a3e535ad0..2afc2ff6f55a 100644 --- a/arch/arm/mach-davinci/board-da850-evm.c +++ b/arch/arm/mach-davinci/board-da850-evm.c @@ -1045,11 +1045,13 @@ static int __init da850_evm_config_emac(void) int ret; u32 val; struct davinci_soc_info *soc_info = &davinci_soc_info; - u8 rmii_en = soc_info->emac_pdata->rmii_en; + u8 rmii_en; if (!machine_is_davinci_da850_evm()) return 0; + rmii_en = soc_info->emac_pdata->rmii_en; + cfg_chip3_base = DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP3_REG); val = __raw_readl(cfg_chip3_base); -- 2.34.1

2 1

[PATCH OLK-6.6 0/7] LoongArch: fix cacheinfo/unaligned/rtc/s3/hda/usb issues
by Hongchen Zhang 03 Mar '25

03 Mar '25

Huacai Chen (1): LoongArch: Correct the cacheinfo sharing information Michal Schmidt (1): ice: fix unaligned access in ice_create_lag_recipe Ming Wang (1): rtc: loongson: clear TOY_MATCH0_REG in loongson_rtc_isr() Zhao Qunqin (3): LoongArch: Update the flush cache policy hda/pci: Add AZX_DCAPS_NO_TCSEL flag for Loongson HDA devices blutetooth/btusb: delay 1ms while suspending Hongchen Zhang (1): LoongArch: set CONFIG_CMA_SIZE_MBYTES to 0 arch/loongarch/configs/loongson3_defconfig | 1 + arch/loongarch/kernel/cacheinfo.c | 6 ++++++ arch/loongarch/mm/cache.c | 24 ++++++++++++++++++++- drivers/bluetooth/btusb.c | 3 +++ drivers/net/ethernet/intel/ice/ice_lag.c | 4 +--- drivers/net/ethernet/intel/ice/ice_switch.c | 6 ++---- drivers/rtc/rtc-loongson.c | 13 ++++++----- sound/pci/hda/hda_intel.c | 4 ++-- 8 files changed, 46 insertions(+), 15 deletions(-) -- 2.43.0

2 8

[PATCH OLK-6.6 v2 0/3] mm: Backport two patch
by Liu Shixin 03 Mar '25

03 Mar '25

Anshuman Khandual (2): arm64/mm: Re-organize arch_make_huge_pte() arm64/mm: Drop setting PTE_TYPE_PAGE in pte_mkcont() Liu Shixin (1): mm/hugetlb: use arch_make_huge_pte() in __hugetlb_insert_pfn() arch/arm64/include/asm/pgtable.h | 8 +------- arch/arm64/mm/hugetlbpage.c | 21 ++++++++++++++++----- mm/hugetlb.c | 2 +- 3 files changed, 18 insertions(+), 13 deletions(-) -- 2.34.1

2 4

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION df3541670ca99b09f2f70d1733516ef7a2289b29
by kernel test robot 02 Mar '25

02 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: df3541670ca99b09f2f70d1733516ef7a2289b29 !15262 blk-iolatency: Fix inflight count imbalances and IO hangs on offline Error/Warning (recently discovered and may have been fixed): include/linux/uaccess.h:115:17: warning: 'ces32' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'rdwr_arg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'u_cmd' may be used uninitialized [-Wmaybe-uninitialized] Unverified Error/Warning (likely false positive, kindly check if interested): include/linux/uaccess.h:115:17: warning: 'data32' may be used uninitialized [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | `-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- arm64-allnoconfig | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- arm64-randconfig-001-20250302 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- arm64-randconfig-002-20250302 | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- arm64-randconfig-003-20250302 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | `-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- arm64-randconfig-004-20250302 | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:from-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:input-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:iocb-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kmask-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs485-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:u_cmd-may-be-used-uninitialized | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | `-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- x86_64-allnoconfig | |-- mm-hugetlb.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | `-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- x86_64-buildonly-randconfig-001-20250302 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250302 | |-- kernel-time-.tmp_posix-cpu-timers.o:warning:objtool:set_process_cpu_timer:unreachable-instruction | |-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-.tmp_vmacache.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- x86_64-buildonly-randconfig-003-20250302 | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- x86_64-buildonly-randconfig-004-20250302 | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- x86_64-buildonly-randconfig-005-20250302 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_shmem | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read |-- x86_64-buildonly-randconfig-006-20250302 | |-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-memcontrol.c:warning:no-previous-prototype-for-dhugetlb_pool_is_free |-- x86_64-defconfig | |-- mm-hugetlb.c:warning:no-previous-prototype-for-free_huge_page_to_dhugetlb_pool | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read `-- x86_64-randconfig-161-20250302 `-- mm-maccess.c:warning:no-previous-prototype-for-__probe_user_read elapsed time: 723m configs tested: 15 configs skipped: 118 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250302 gcc-14.2.0 arm64 randconfig-002-20250302 gcc-14.2.0 arm64 randconfig-003-20250302 gcc-14.2.0 arm64 randconfig-004-20250302 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250302 clang-19 x86_64 buildonly-randconfig-002-20250302 clang-19 x86_64 buildonly-randconfig-003-20250302 gcc-12 x86_64 buildonly-randconfig-004-20250302 gcc-12 x86_64 buildonly-randconfig-005-20250302 gcc-12 x86_64 buildonly-randconfig-006-20250302 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-testcase] TEST: add Dynamic Memory Bandwidth Regulator and Tracer
by Zeng Heng 01 Mar '25

01 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- bw_dynamic.py | 143 ++++++++++++++++++++++++++++++++++++++++++++++ calc_cpu_usage.py | 27 +++++++++ draw_bw.py | 105 ++++++++++++++++++++++++++++++++++ draw_cpu.py | 34 +++++++++++ mb_calculate.py | 24 ++++++++ mv_tasks.py | 21 +++++++ pidcontroller.py | 35 ++++++++++++ 7 files changed, 389 insertions(+) create mode 100644 bw_dynamic.py create mode 100644 calc_cpu_usage.py create mode 100644 draw_bw.py create mode 100644 draw_cpu.py create mode 100644 mb_calculate.py create mode 100644 mv_tasks.py create mode 100644 pidcontroller.py diff --git a/bw_dynamic.py b/bw_dynamic.py new file mode 100644 index 000000000000..a5ca83ccdd90 --- /dev/null +++ b/bw_dynamic.py @@ -0,0 +1,143 @@ +import os, time, signal, json, sys +from pidcontroller import PIDController +from calc_cpu_usage import read_cpu_times, calculate_cpu_utilization + +numa_bw_limit = 80000 +target_percent = 60 + +bw_list = [] +set_list = [] +cpu_list = [] + +def read_bw(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_MB_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/mbm_total_bytes', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + +def increase_bw(i, percent): + print("increase NUMA%d %d%%" % (i, percent)) + + resctrl_par_dir = '/sys/fs/resctrl/p1/schemata' + with open(resctrl_par_dir, 'r') as f: + lines = f.readlines() + + for line in lines: + if "MB:" in line: + config = line.split(":") + config = config[1].split(";") + origin_p = int(config[i].split("=")[1]) + + new_p = (origin_p + percent) + if new_p > 100: + new_p = 100 + elif new_p < 1: + new_p = 1 + + # if percent < 0: + # cnt = "MBHDL:%d=1\n" % i + # with open(resctrl_par_dir, 'w+') as f: + # f.write(cnt) + + cnt = "MB:%d=%d" % (i, new_p) + print("%s<=%d" % (cnt, origin_p)) + if new_p == origin_p: + return origin_p + + with open(resctrl_par_dir, 'w+') as f: + f.write("%s\n" % cnt) + + return origin_p + +def gain_numa_bw(pid_ctl, adjust_enable): + lc_val = read_bw(".") + be_val = read_bw("p1") + + numa_bw_state = [] + numa_set = [] + + for i in range(len(lc_val)): + bw_state = {"total_bw": {}, "lc_bw": {}, "be_bw": {}} + + bw_sum = lc_val[i] + be_val[i] + + bw_state["total_bw"] = bw_sum + bw_state["lc_bw"] = lc_val[i] + bw_state["be_bw"] = be_val[i] + numa_bw_state.append(bw_state) + + set_state = {"setting": {}, "delta": {}} + + if adjust_enable == True: + if bw_state["lc_bw"] < (0.04 * numa_bw_limit): + # enlarge BE load + diff = 5 + elif bw_state["lc_bw"] > (target_percent / 100 * numa_bw_limit): + # shutdown BE load + diff = -100 + else: + diff = pid_ctl[i].update(bw_sum * 100 // numa_bw_limit , 1) + else: + diff = 0 + + curr = increase_bw(i, diff) + set_state['setting'] = curr + set_state['delta'] = diff + + numa_set.append(set_state) + + bw_list.append(numa_bw_state) + set_list.append(numa_set) + return + +def gain_cpu(time1, time2): + usage = calculate_cpu_utilization(time1, time2) + print(f"CPU usage: {usage:.2f}%") + cpu_list.append(usage) + return + +def save_file(sig, frame): + with open(f"ctrlgrp_bw.data", 'w') as fl: + json.dump(bw_list, fl) + + with open(f"schemata_set.data", 'w') as fl: + json.dump(set_list, fl) + + with open(f"cpu_usage.data", 'w') as fl: + json.dump(cpu_list, fl) + + exit(0) + +if __name__ == "__main__": + signal.signal(signal.SIGINT, save_file) + + pid_ctl = [] + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + pid_ctl.append(PIDController(kp=1.0, ki=0.02, kd=0.05, set_point=target_percent)) + + enable = True + num_args = len(sys.argv) - 1 + if num_args == 1: + if sys.argv[1] == "mon": + enable = False + + time1 = read_cpu_times() + + while True: + gain_numa_bw(pid_ctl, enable) + + time2 = read_cpu_times() + gain_cpu(time1, time2) + time1 = time2 + + print("..........................") + time.sleep(1) diff --git a/calc_cpu_usage.py b/calc_cpu_usage.py new file mode 100644 index 000000000000..98fef7a2c1f5 --- /dev/null +++ b/calc_cpu_usage.py @@ -0,0 +1,27 @@ +import time + +def read_cpu_times(): + with open('/proc/stat', 'r') as f: + line = f.readline() + parts = line.split() + return list(map(int, parts[1:])) + +def calculate_cpu_utilization(times1, times2): + total1 = sum(times1) + idle1 = times1[3] + total2 = sum(times2) + idle2 = times2[3] + total_diff = total2 - total1 + idle_diff = idle2 - idle1 + return (total_diff - idle_diff) / total_diff * 100 + +# def gain_cpu(time1, time2): +# usage = calculate_cpu_utilization(time1, time2) +# print(f"CPU usage: {usage:.2f}%") +# return time2 + +# time1 = read_cpu_times() +# while True: +# time.sleep(1) +# time2 = read_cpu_times() +# time1 = gain_cpu(time1, time2) diff --git a/draw_bw.py b/draw_bw.py new file mode 100644 index 000000000000..17f28842cbcc --- /dev/null +++ b/draw_bw.py @@ -0,0 +1,105 @@ +import json +import matplotlib.pyplot as plt + +target_percent = 60 / 100 +bw_limit = target_percent * 80000 + +def get_all_bw(data_list, idx): + total = [] + lc = [] + be = [] + + for data in data_list: + total.append(data[idx]['total_bw']) + lc.append(data[idx]['lc_bw']) + be.append(data[idx]['be_bw']) + + return total, lc, be + +def get_all_set(set_list, idx): + setting = [] + delta = [] + + for data in set_list: + setting.append(data[idx]['setting']) + delta.append(data[idx]['delta']) + + return setting, delta + +def draw_data(bw_list, set_list, cpu_list): + fig = plt.figure() + x_arr = list(range(len(bw_list))) + + # numa_cnt = len(bw_list[0]) + # only draw numa1 + numa_cnt_display = 1 + numa_th = 1 + for cnt in range(numa_cnt_display): + ax1 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 1) + # total, lc, be = get_all_bw(bw_list, cnt) + total, lc, be = get_all_bw(bw_list, numa_th) + ref = [bw_limit] * len(bw_list) + + ax1.plot(x_arr, total, label='total bw') + ax1.plot(x_arr, lc, label='lc bw') + ax1.plot(x_arr, be, label='be bw') + ax1.plot(x_arr, ref, label='reference') + ax1.legend() + + ax2 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, cnt * 2 + 2) + # setting, delta = get_all_set(set_list, cnt) + setting, delta = get_all_set(set_list, numa_th) + + ref = [0] * len(bw_list) + ax2.plot(x_arr, setting, label='setting') + ax2.plot(x_arr, delta, label='delta') + ax2.plot(x_arr, ref, label='reference') + ax2.legend() + + # ax3 = fig.add_subplot(5, 1, 3) + # total, lc, be = get_all_bw(bw_list, 1) + + # ax3.plot(x_arr, total, label='total bw') + # ax3.plot(x_arr, lc, label='lc bw') + # ax3.plot(x_arr, be, label='be bw') + # ax3.plot(x_arr, ref, label='reference') + # ax3.legend() + + # ax4 = fig.add_subplot(5, 1, 4) + # setting, delta = get_all_set(set_list, 1) + + # ax4.plot(x_arr, setting, label='setting') + # ax4.plot(x_arr, delta, label='delta') + # ax4.legend() + + ax5 = fig.add_subplot(numa_cnt_display * 2 + 1, 1, numa_cnt_display * 2 + 1) + + ax5.plot(x_arr, cpu_list, label='CPU usage') + ax5.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + data_list = json.load(f) + except FileNotFoundError: + return None + + return data_list + +if __name__ == '__main__': + filename = 'ctrlgrp_bw.data' + bw_list = get_data(filename) + filename = 'schemata_set.data' + set_list = get_data(filename) + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if bw_list and set_list: + draw_data(bw_list, set_list, cpu_list) + else: + print('FileNotFound') diff --git a/draw_cpu.py b/draw_cpu.py new file mode 100644 index 000000000000..02e5b0e48376 --- /dev/null +++ b/draw_cpu.py @@ -0,0 +1,34 @@ +import json +import matplotlib.pyplot as plt + +def draw_data(cpu_list): + fig = plt.figure() + x_arr = list(range(len(cpu_list))) + + ax1 = fig.add_subplot(1, 1, 1) + + ax1.plot(x_arr, cpu_list, label='CPU usage') + ax1.legend() + + plt.tight_layout() + plt.show() + + return + +def get_data(file): + try: + with open(file, 'r') as f: + cpu_list = json.load(f) + except FileNotFoundError: + return None + + return cpu_list + +if __name__ == '__main__': + filename = 'cpu_usage.data' + cpu_list = get_data(filename) + + if cpu_list: + draw_data(cpu_list) + else: + print('FileNotFound') diff --git a/mb_calculate.py b/mb_calculate.py new file mode 100644 index 000000000000..eb67cc85ec91 --- /dev/null +++ b/mb_calculate.py @@ -0,0 +1,24 @@ +import os, time, signal, json + +def read_bw(grp): + resctrl_mon_data_dir = '/sys/fs/resctrl/%s/mon_data/' % grp + mon_data_dirs = os.listdir(resctrl_mon_data_dir) + mon_MB_dirs = [dir for dir in mon_data_dirs if dir.startswith('mon_MB_')] + + vals = [] + for mb_dir in mon_MB_dirs: + with open(resctrl_mon_data_dir + mb_dir + '/mbm_total_bytes', 'r') as f: + line = f.readline() + vals.append(int(line.strip())) + + return vals + + +sum_val = [0] * 2 +while True: + for i in range(5): + vals = read_bw('.') + for i in range(len(sum_val)): + sum_val[i] += vals[i] + print(sum_val) + time.sleep(1) diff --git a/mv_tasks.py b/mv_tasks.py new file mode 100644 index 000000000000..27ad18f77e0c --- /dev/null +++ b/mv_tasks.py @@ -0,0 +1,21 @@ +import os, subprocess + +# proc = subprocess.Popen("ps -e -T | grep 'Executor task'", +proc = subprocess.Popen("jps | grep YarnCoarseGrainedExecutorBackend", + shell=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE) + +pid_list = [] +cnt = proc.stdout.readlines() +for line in cnt: + line = line.decode("utf-8") + res = line.split() + pid_list.append(int(res[0])) + +print(",".join(map(str, pid_list))) + +for pid in pid_list: + ret = os.system("echo %d > /sys/fs/resctrl/hpri/tasks" % pid) + if ret: + print(ret) diff --git a/pidcontroller.py b/pidcontroller.py new file mode 100644 index 000000000000..4d03d2f28aa1 --- /dev/null +++ b/pidcontroller.py @@ -0,0 +1,35 @@ +class PIDController: + def __init__(self, kp, ki, kd, set_point): + self.kp = kp # 比例增益 + self.ki = ki # 积分增益 + self.kd = kd # 微分增益 + self.set_point = set_point # 设定值 + self.last_error = 0 # 上一次的误差 + self.integral = 0 # 积分项 + + self.max_output = 5 # 缓升 + self.min_output = -100 # 快降 + + def update(self, current_value, dt): + """ + 更新PID控制器的输出 + :param current_value: 当前系统的输出值 + :param dt: 时间间隔 + :return: 控制器的输出 + """ + error = self.set_point - current_value # 计算当前误差 + self.integral += error * dt # 更新积分项 + derivative = (error - self.last_error) / dt # 计算微分项 + + # 计算PID控制器的输出 + output = (self.kp * error) + (self.ki * self.integral) + (self.kd * derivative) + + self.last_error = error # 更新上一次的误差 + + # 限制输出范围 + if output > self.max_output: + output = self.max_output + elif output < self.min_output: + output = self.min_output + + return output -- 2.25.1

1 0

[PATCH OLK-6.6 0/2] mm: Backport two patch
by Liu Shixin 01 Mar '25

01 Mar '25

Anshuman Khandual (2): arm64/mm: Re-organize arch_make_huge_pte() arm64/mm: Drop setting PTE_TYPE_PAGE in pte_mkcont() arch/arm64/include/asm/pgtable.h | 8 +------- arch/arm64/mm/hugetlbpage.c | 21 ++++++++++++++++----- 2 files changed, 17 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] nfsd: clear acl_access/acl_default after releasing them
by Li Lingfeng 01 Mar '25

01 Mar '25

stable inclusion from stable-v6.6.79 commit 55d947315fb5f67a35e4e1d3e01bb886b9c6decf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC30 CVE: CVE-2025-21796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7faf14a7b0366f153284db0ad3347c457ea70136 upstream. If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-rc6-00079-g04ae226af01f-dirty #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb5/0x170 Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75 e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb cd 0f b6 1d 8a3 RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff83904fde RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff88871ed36380 RBP: ffff888158beeb40 R08: 0000000000000001 R09: fffff520010c6f56 R10: ffffc90008637ab7 R11: 0000000000000001 R12: 0000000000000001 R13: ffff888140e77400 R14: ffff888140e77408 R15: ffffffff858b42c0 FS: 0000000000000000(0000) GS:ffff88871ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562384d32158 CR3: 000000055cc6a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0xb5/0x170 ? __warn+0xa5/0x140 ? refcount_warn_saturate+0xb5/0x170 ? report_bug+0x1b1/0x1e0 ? handle_bug+0x53/0xa0 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? tick_nohz_tick_stopped+0x1e/0x40 ? refcount_warn_saturate+0xb5/0x170 ? refcount_warn_saturate+0xb5/0x170 nfs3svc_release_getacl+0xc9/0xe0 svc_process_common+0x5db/0xb60 ? __pfx_svc_process_common+0x10/0x10 ? __rcu_read_unlock+0x69/0xa0 ? __pfx_nfsd_dispatch+0x10/0x10 ? svc_xprt_received+0xa1/0x120 ? xdr_init_decode+0x11d/0x190 svc_process+0x2a7/0x330 svc_handle_xprt+0x69d/0x940 svc_recv+0x180/0x2d0 nfsd+0x168/0x200 ? __pfx_nfsd+0x10/0x10 kthread+0x1a2/0x1e0 ? kthread+0xf4/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Kernel panic - not syncing: kernel: panic_on_warn set ... Clear acl_access/acl_default after posix_acl_release is called to prevent UAF from being triggered. Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241107014705.2509463-1-lilingfeng@huaweicloud… Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Rick Macklem <rmacklem(a)uoguelph.ca> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs2acl.c | 2 ++ fs/nfsd/nfs3acl.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c index 12b2b9bc07bf..f1f32ad4f42c 100644 --- a/fs/nfsd/nfs2acl.c +++ b/fs/nfsd/nfs2acl.c @@ -84,6 +84,8 @@ static __be32 nfsacld_proc_getacl(struct svc_rqst *rqstp) fail: posix_acl_release(resp->acl_access); posix_acl_release(resp->acl_default); + resp->acl_access = NULL; + resp->acl_default = NULL; goto out; } diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c index 73adca47d373..d7af28f44504 100644 --- a/fs/nfsd/nfs3acl.c +++ b/fs/nfsd/nfs3acl.c @@ -76,6 +76,8 @@ static __be32 nfsd3_proc_getacl(struct svc_rqst *rqstp) fail: posix_acl_release(resp->acl_access); posix_acl_release(resp->acl_default); + resp->acl_access = NULL; + resp->acl_default = NULL; goto out; } -- 2.31.1

2 1

[PATCH OLK-6.6] NFSD: fix hang in nfsd4_shutdown_callback
by Li Lingfeng 01 Mar '25

01 Mar '25

From: Dai Ngo <dai.ngo(a)oracle.com> mainline inclusion from mainline-v6.14-rc3 commit 036ac2778f7b28885814c6fbc07e156ad1624d03 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4R CVE: CVE-2025-21795 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 036ac2778f7b28885814c6fbc07e156ad1624d03 upstream. If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP notifies NFSD that the connection was dropped. This patch modifies nfsd4_run_cb_work to skip the RPC call if nfs4_client is in courtesy state. Signed-off-by: Dai Ngo <dai.ngo(a)oracle.com> Fixes: 66af25799940 ("NFSD: add courteous server support for thread with only delegation") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4callback.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c index 875ea311ca3c..d47173d98eef 100644 --- a/fs/nfsd/nfs4callback.c +++ b/fs/nfsd/nfs4callback.c @@ -1410,8 +1410,11 @@ nfsd4_run_cb_work(struct work_struct *work) nfsd4_process_cb_update(cb); clnt = clp->cl_cb_client; - if (!clnt) { - /* Callback channel broken, or client killed; give up: */ + if (!clnt || clp->cl_state == NFSD4_COURTESY) { + /* + * Callback channel broken, client killed or + * nfs4_client in courtesy state; give up. + */ nfsd41_destroy_cb(cb); return; } -- 2.31.1

2 1

[PATCH OLK-6.6] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 01 Mar '25

01 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-6.6] NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
by Li Lingfeng 01 Mar '25

01 Mar '25

From: Zichen Xie <zichenxie0106(a)gmail.com> stable inclusion from stable-v6.6.79 commit 19b3ca651b4b473878c73539febe477905041442 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5M CVE: CVE-2024-54456 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49fd4e34751e90e6df009b70cd0659dc839e7ca8 ] name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potential buffer overflow. Change them to strscpy() and strncat() to fix potential issues. Signed-off-by: Zichen Xie <zichenxie0106(a)gmail.com> Reviewed-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/sysfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nfs/sysfs.c b/fs/nfs/sysfs.c index bf378ecd5d9f..7b59a40d40c0 100644 --- a/fs/nfs/sysfs.c +++ b/fs/nfs/sysfs.c @@ -280,9 +280,9 @@ void nfs_sysfs_link_rpc_client(struct nfs_server *server, char name[RPC_CLIENT_NAME_SIZE]; int ret; - strcpy(name, clnt->cl_program->name); - strcat(name, uniq ? uniq : ""); - strcat(name, "_client"); + strscpy(name, clnt->cl_program->name, sizeof(name)); + strncat(name, uniq ? uniq : "", sizeof(name) - strlen(name) - 1); + strncat(name, "_client", sizeof(name) - strlen(name) - 1); ret = sysfs_create_link_nowarn(&server->kobj, &clnt->cl_sysfs->kobject, name); -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] blk-iolatency: Fix inflight count imbalances and IO hangs on offline
by Tengda Wu 28 Feb '25

28 Feb '25

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v4.19.247 commit 515d077ee3085ae343b6bea7fd031f9906645f38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1WU CVE: CVE-2022-49394 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8a177a36da6c54c98b8685d4f914cb3637d53c0d upstream. iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no cgroup has iolatency configured for the device. To ensure that the inflight counters stay balanced, iolatency_set_limit() freezes the request_queue while manipulating the enabled counter, which ensures that no IO is in flight and thus all counters are zero. Unfortunately, iolatency_set_limit() isn't the only place where the enabled counter is manipulated. iolatency_pd_offline() can also dec the counter and trigger disabling. As this disabling happens without freezing the q, this can easily happen while some IOs are in flight and thus leak the counts. This can be easily demonstrated by turning on iolatency on an one empty cgroup while IOs are in flight in other cgroups and then removing the cgroup. Note that iolatency shouldn't have been enabled elsewhere in the system to ensure that removing the cgroup disables iolatency for the whole device. The following keeps flipping on and off iolatency on sda: echo +io > /sys/fs/cgroup/cgroup.subtree_control while true; do mkdir -p /sys/fs/cgroup/test echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency sleep 1 rmdir /sys/fs/cgroup/test sleep 1 done and there's concurrent fio generating direct rand reads: fio --name test --filename=/dev/sda --direct=1 --rw=randread \ --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k while monitoring with the following drgn script: while True: for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()): for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list): blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node') pd = blkg.pd[prog['blkcg_policy_iolatency'].plid] if pd.value_() == 0: continue iolat = container_of(pd, 'struct iolatency_grp', 'pd') inflight = iolat.rq_wait.inflight.counter.value_() if inflight: print(f'inflight={inflight} {disk_name(blkg.q.disk).decode("utf-8")} ' f'{cgroup_path(css.cgroup).decode("utf-8")}') time.sleep(1) The monitoring output looks like the following: inflight=1 sda /user.slice inflight=1 sda /user.slice ... inflight=14 sda /user.slice inflight=13 sda /user.slice inflight=17 sda /user.slice inflight=15 sda /user.slice inflight=18 sda /user.slice inflight=17 sda /user.slice inflight=20 sda /user.slice inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19 inflight=19 sda /user.slice inflight=19 sda /user.slice If a cgroup with stuck inflight ends up getting throttled, the throttled IOs will never get issued as there's no completion event to wake it up leading to an indefinite hang. This patch fixes the bug by unifying enable handling into a work item which is automatically kicked off from iolatency_set_min_lat_nsec() which is called from both iolatency_set_limit() and iolatency_pd_offline() paths. Punting to a work item is necessary as iolatency_pd_offline() is called under spinlocks while freezing a request_queue requires a sleepable context. This also simplifies the code reducing LOC sans the comments and avoids the unnecessary freezes which were happening whenever a cgroup's latency target is newly set or cleared. Signed-off-by: Tejun Heo <tj(a)kernel.org> Cc: Josef Bacik <josef(a)toxicpanda.com> Cc: Liu Bo <bo.liu(a)linux.alibaba.com> Fixes: 8c772a9bfc7c ("blk-iolatency: fix IO hang due to negative inflight counter") Cc: stable(a)vger.kernel.org # v5.0+ Link: https://lore.kernel.org/r/Yn9ScX6Nx2qIiQQi@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: block/blk-iolatency.c [One line changed by commit f2fe4410dc00 in blkcg_iolatency_done_bio(), causing conflicts] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- block/blk-iolatency.c | 122 ++++++++++++++++++++++-------------------- 1 file changed, 64 insertions(+), 58 deletions(-) diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c index 6f81794eb6e6..3572ac28081a 100644 --- a/block/blk-iolatency.c +++ b/block/blk-iolatency.c @@ -85,7 +85,17 @@ struct iolatency_grp; struct blk_iolatency { struct rq_qos rqos; struct timer_list timer; - atomic_t enabled; + + /* + * ->enabled is the master enable switch gating the throttling logic and + * inflight tracking. The number of cgroups which have iolat enabled is + * tracked in ->enable_cnt, and ->enable is flipped on/off accordingly + * from ->enable_work with the request_queue frozen. For details, See + * blkiolatency_enable_work_fn(). + */ + bool enabled; + atomic_t enable_cnt; + struct work_struct enable_work; }; static inline struct blk_iolatency *BLKIOLATENCY(struct rq_qos *rqos) @@ -93,11 +103,6 @@ static inline struct blk_iolatency *BLKIOLATENCY(struct rq_qos *rqos) return container_of(rqos, struct blk_iolatency, rqos); } -static inline bool blk_iolatency_enabled(struct blk_iolatency *blkiolat) -{ - return atomic_read(&blkiolat->enabled) > 0; -} - struct child_latency_info { spinlock_t lock; @@ -402,7 +407,7 @@ static void blkcg_iolatency_throttle(struct rq_qos *rqos, struct bio *bio, struct request_queue *q = rqos->q; bool issue_as_root = bio_issue_as_root_blkg(bio); - if (!blk_iolatency_enabled(blkiolat)) + if (!blkiolat->enabled) return; rcu_read_lock(); @@ -559,7 +564,6 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) u64 window_start; u64 now = blk_time_get_ns(); bool issue_as_root = bio_issue_as_root_blkg(bio); - bool enabled = false; int inflight = 0; blkg = bio->bi_blkg; @@ -570,8 +574,7 @@ static void blkcg_iolatency_done_bio(struct rq_qos *rqos, struct bio *bio) if (!iolat) return; - enabled = blk_iolatency_enabled(iolat->blkiolat); - if (!enabled) + if (!iolat->blkiolat->enabled) return; while (blkg && blkg->parent) { @@ -609,6 +612,7 @@ static void blkcg_iolatency_exit(struct rq_qos *rqos) struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos); del_timer_sync(&blkiolat->timer); + flush_work(&blkiolat->enable_work); blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency); kfree(blkiolat); } @@ -680,6 +684,44 @@ static void blkiolatency_timer_fn(struct timer_list *t) rcu_read_unlock(); } +/** + * blkiolatency_enable_work_fn - Enable or disable iolatency on the device + * @work: enable_work of the blk_iolatency of interest + * + * iolatency needs to keep track of the number of in-flight IOs per cgroup. This + * is relatively expensive as it involves walking up the hierarchy twice for + * every IO. Thus, if iolatency is not enabled in any cgroup for the device, we + * want to disable the in-flight tracking. + * + * We have to make sure that the counting is balanced - we don't want to leak + * the in-flight counts by disabling accounting in the completion path while IOs + * are in flight. This is achieved by ensuring that no IO is in flight by + * freezing the queue while flipping ->enabled. As this requires a sleepable + * context, ->enabled flipping is punted to this work function. + */ +static void blkiolatency_enable_work_fn(struct work_struct *work) +{ + struct blk_iolatency *blkiolat = container_of(work, struct blk_iolatency, + enable_work); + bool enabled; + + /* + * There can only be one instance of this function running for @blkiolat + * and it's guaranteed to be executed at least once after the latest + * ->enabled_cnt modification. Acting on the latest ->enable_cnt is + * sufficient. + * + * Also, we know @blkiolat is safe to access as ->enable_work is flushed + * in blkcg_iolatency_exit(). + */ + enabled = atomic_read(&blkiolat->enable_cnt); + if (enabled != blkiolat->enabled) { + blk_mq_freeze_queue(blkiolat->rqos.q); + blkiolat->enabled = enabled; + blk_mq_unfreeze_queue(blkiolat->rqos.q); + } +} + int blk_iolatency_init(struct request_queue *q) { struct blk_iolatency *blkiolat; @@ -705,17 +747,15 @@ int blk_iolatency_init(struct request_queue *q) } timer_setup(&blkiolat->timer, blkiolatency_timer_fn, 0); + INIT_WORK(&blkiolat->enable_work, blkiolatency_enable_work_fn); return 0; } -/* - * return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise - * return 0. - */ -static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) +static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) { struct iolatency_grp *iolat = blkg_to_lat(blkg); + struct blk_iolatency *blkiolat = iolat->blkiolat; u64 oldval = iolat->min_lat_nsec; iolat->min_lat_nsec = val; @@ -723,13 +763,15 @@ static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) iolat->cur_win_nsec = min_t(u64, iolat->cur_win_nsec, BLKIOLATENCY_MAX_WIN_SIZE); - if (!oldval && val) - return 1; + if (!oldval && val) { + if (atomic_inc_return(&blkiolat->enable_cnt) == 1) + schedule_work(&blkiolat->enable_work); + } if (oldval && !val) { blkcg_clear_delay(blkg); - return -1; + if (atomic_dec_return(&blkiolat->enable_cnt) == 0) + schedule_work(&blkiolat->enable_work); } - return 0; } static void iolatency_clear_scaling(struct blkcg_gq *blkg) @@ -762,7 +804,6 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, u64 lat_val = 0; u64 oldval; int ret; - int enable = 0; ret = blkg_conf_prep(blkcg, &blkcg_policy_iolatency, buf, &ctx); if (ret) @@ -798,41 +839,12 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, blkg = ctx.blkg; oldval = iolat->min_lat_nsec; - enable = iolatency_set_min_lat_nsec(blkg, lat_val); - if (enable) { - if (!blk_get_queue(blkg->q)) { - ret = -ENODEV; - goto out; - } - - blkg_get(blkg); - } - - if (oldval != iolat->min_lat_nsec) { + iolatency_set_min_lat_nsec(blkg, lat_val); + if (oldval != iolat->min_lat_nsec) iolatency_clear_scaling(blkg); - } - ret = 0; out: blkg_conf_finish(&ctx); - if (ret == 0 && enable) { - struct iolatency_grp *tmp = blkg_to_lat(blkg); - struct blk_iolatency *blkiolat = tmp->blkiolat; - - blk_mq_freeze_queue(blkg->q); - - if (enable == 1) - atomic_inc(&blkiolat->enabled); - else if (enable == -1) - atomic_dec(&blkiolat->enabled); - else - WARN_ON_ONCE(1); - - blk_mq_unfreeze_queue(blkg->q); - - blkg_put(blkg); - blk_put_queue(blkg->q); - } return ret ?: nbytes; } @@ -932,14 +944,8 @@ static void iolatency_pd_offline(struct blkg_policy_data *pd) { struct iolatency_grp *iolat = pd_to_lat(pd); struct blkcg_gq *blkg = lat_to_blkg(iolat); - struct blk_iolatency *blkiolat = iolat->blkiolat; - int ret; - ret = iolatency_set_min_lat_nsec(blkg, 0); - if (ret == 1) - atomic_inc(&blkiolat->enabled); - if (ret == -1) - atomic_dec(&blkiolat->enabled); + iolatency_set_min_lat_nsec(blkg, 0); iolatency_clear_scaling(blkg); } -- 2.34.1

2 1

[PATCH openEuler-25.03] mm: introduce kernel cmdline option "kernel_replication="
by Nikita Panov 28 Feb '25

28 Feb '25

kunpeng inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBPRS0 ------------------------------------------------- The new cmdline option allows enabling/disabling kernel replication feature. By default, the replication feature is disabled. This allows to set CONFIG_KERNEL_REPLICATION=y by default, but enabling this feature is done via kernel cmdline. Signed-off-by: Nikita Panov <panov.nikita(a)huawei.com> --- .../admin-guide/kernel-parameters.txt | 7 ++ arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/mm/pgd.c | 56 +++++++++---- include/linux/numa_kernel_replication.h | 28 ++++++- kernel/module/main.c | 11 ++- mm/numa_kernel_replication.c | 78 ++++++++++++++++++- mm/vmalloc.c | 6 +- 7 files changed, 163 insertions(+), 25 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 5bf51e171ee7..0f1f6143f53f 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -2534,6 +2534,13 @@ some extension. These two features are alternatives. Current only arm64 is supported. + kernel_replication= + [ARM64] + Format: [on|off] + If CONFIG_KERNEL_REPLICATION is set, it allows + enabling/disabling the kernel replication feature + via cmdline. Default value is off. + kgdbdbgp= [KGDB,HW] kgdb over EHCI usb debug port. Format: <Controller#>[,poll interval] The controller # is the number of the ehci usb debug diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 28de20ca2d71..0f3e72a3c2b6 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -1212,7 +1212,7 @@ CONFIG_ARM64_HAFT=y CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y CONFIG_LOCK_MM_AND_FIND_VMA=y -# CONFIG_KERNEL_REPLICATION is not set +CONFIG_KERNEL_REPLICATION=y CONFIG_IOMMU_MM_DATA=y # CONFIG_ASCEND_FEATURES is not set CONFIG_PAGE_CACHE_LIMIT=y diff --git a/arch/arm64/mm/pgd.c b/arch/arm64/mm/pgd.c index adf642eba4e7..8326bd693b29 100644 --- a/arch/arm64/mm/pgd.c +++ b/arch/arm64/mm/pgd.c @@ -18,6 +18,24 @@ static struct kmem_cache *pgd_cache __ro_after_init; +static pgd_t *pgd_alloc_orig(struct mm_struct *mm) +{ + gfp_t gfp = GFP_PGTABLE_USER; + + if (PGD_SIZE == PAGE_SIZE) + return (pgd_t *)__get_free_page(gfp); + else + return kmem_cache_alloc(pgd_cache, gfp); +} + +static void pgd_free_orig(struct mm_struct *mm, pgd_t *pgd) +{ + if (PGD_SIZE == PAGE_SIZE) + free_page((unsigned long)pgd); + else + kmem_cache_free(pgd_cache, pgd); +} + #ifdef CONFIG_KERNEL_REPLICATION pgd_t *page_pgd_alloc(struct mm_struct *mm) { @@ -37,11 +55,11 @@ pgd_t *page_pgd_alloc(struct mm_struct *mm) WARN_ON_ONCE(page_to_nid(page) != nid); - per_node_pgd(mm, nid) = (pgd_t *)page_address(page); + *per_node_pgd_ptr(mm, nid) = (pgd_t *)page_address(page); } for_each_online_node(nid) - per_node_pgd(mm, nid) = per_node_pgd(mm, numa_get_memory_node(nid)); + *per_node_pgd_ptr(mm, nid) = per_node_pgd(mm, numa_get_memory_node(nid)); mm->pgd = per_node_pgd(mm, numa_get_memory_node(0));/*!!!*/ @@ -53,7 +71,7 @@ pgd_t *page_pgd_alloc(struct mm_struct *mm) return NULL; } -pgd_t *pgd_alloc(struct mm_struct *mm) +static pgd_t *pgd_alloc_replica(struct mm_struct *mm) { pgd_t **pgd_numa = (pgd_t **)kmalloc(sizeof(pgd_t *) * MAX_NUMNODES, GFP_PGTABLE_KERNEL); @@ -81,34 +99,44 @@ static void page_pgd_free(struct mm_struct *mm, pgd_t *pgd) } for_each_online_node(nid) - per_node_pgd(mm, nid) = NULL; + *per_node_pgd_ptr(mm, nid) = NULL; } -void pgd_free(struct mm_struct *mm, pgd_t *pgd) +static void pgd_free_replica(struct mm_struct *mm, pgd_t *pgd) { page_pgd_free(mm, pgd); kfree(mm->pgd_numa); } -#else /* !CONFIG_KERNEL_REPLICATION */ pgd_t *pgd_alloc(struct mm_struct *mm) { - gfp_t gfp = GFP_PGTABLE_USER; - - if (PGD_SIZE == PAGE_SIZE) - return (pgd_t *)__get_free_page(gfp); + mm->pgd_numa = NULL; + if (is_text_replicated()) + return pgd_alloc_replica(mm); else - return kmem_cache_alloc(pgd_cache, gfp); + return pgd_alloc_orig(mm); + } void pgd_free(struct mm_struct *mm, pgd_t *pgd) { - if (PGD_SIZE == PAGE_SIZE) - free_page((unsigned long)pgd); + if (is_text_replicated()) + pgd_free_replica(mm, pgd); else - kmem_cache_free(pgd_cache, pgd); + pgd_free_orig(mm, pgd); +} + +#else /* !CONFIG_KERNEL_REPLICATION */ +pgd_t *pgd_alloc(struct mm_struct *mm) +{ + return pgd_alloc_orig(mm); +} + +void pgd_free(struct mm_struct *mm, pgd_t *pgd) +{ + pgd_free_orig(mm, pgd); } #endif /* CONFIG_KERNEL_REPLICATION */ diff --git a/include/linux/numa_kernel_replication.h b/include/linux/numa_kernel_replication.h index ee1ab0f111c7..37e7b56b5aa9 100644 --- a/include/linux/numa_kernel_replication.h +++ b/include/linux/numa_kernel_replication.h @@ -42,8 +42,31 @@ extern nodemask_t replica_nodes; nid != MAX_NUMNODES; \ nid = next_node(nid, replica_nodes)) -#define this_node_pgd(mm) ((mm)->pgd_numa[numa_node_id()]) -#define per_node_pgd(mm, nid) ((mm)->pgd_numa[nid]) +bool is_text_replicated(void); + +static inline pgd_t *this_node_pgd(struct mm_struct *mm) +{ + if (is_text_replicated()) + return mm->pgd_numa[numa_node_id()]; + else + return mm->pgd; +} + +static inline pgd_t *per_node_pgd(struct mm_struct *mm, int nid) +{ + if (is_text_replicated()) + return mm->pgd_numa[nid]; + else + return mm->pgd; +} + +static inline pgd_t **per_node_pgd_ptr(struct mm_struct *mm, int nid) +{ + if (is_text_replicated()) + return &mm->pgd_numa[nid]; + else + return &mm->pgd; +} static inline bool numa_addr_has_replica(const void *addr) { @@ -56,7 +79,6 @@ void __init numa_replicate_kernel_text(void); void numa_replicate_kernel_rodata(void); void numa_replication_fini(void); -bool is_text_replicated(void); propagation_level_t get_propagation_level(void); void numa_setup_pgd(void); void __init_or_module *numa_get_replica(void *vaddr, int nid); diff --git a/kernel/module/main.c b/kernel/module/main.c index 3aa696b127ca..c5448bc9589a 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -1217,6 +1217,9 @@ static void module_replicate_sections(struct module *mod) { int i; + if (!is_text_replicated()) + return; + for (i = 0; i < ARRAY_SIZE(sections_to_replicate); i++) module_replicate(mod->mem[sections_to_replicate[i]].base); } @@ -1228,9 +1231,11 @@ static void *module_memory_alloc(unsigned int size, enum mod_mem_type type) if (mod_mem_use_vmalloc(type)) return vzalloc(size); - for (i = 0; i < ARRAY_SIZE(sections_to_replicate); i++) { - if (type == sections_to_replicate[i]) - return module_alloc_replica(size); + if (is_text_replicated()) { + for (i = 0; i < ARRAY_SIZE(sections_to_replicate); i++) { + if (type == sections_to_replicate[i]) + return module_alloc_replica(size); + } } return module_alloc(size); } diff --git a/mm/numa_kernel_replication.c b/mm/numa_kernel_replication.c index c2d289b7b9df..17664a1300b8 100644 --- a/mm/numa_kernel_replication.c +++ b/mm/numa_kernel_replication.c @@ -65,6 +65,8 @@ static unsigned int master_node = INT_MAX; */ static int node_to_memory_node[MAX_NUMNODES]; +static bool kernel_replication_enabled; + static bool pgtables_extra; static DEFINE_SPINLOCK(debugfs_lock); @@ -254,6 +256,9 @@ static void dump_pgtables(struct mm_struct *mm, start = start & PAGE_MASK; end = (end & PAGE_MASK) - 1 + PAGE_SIZE; + if (!mm->pgd_numa) + return; + replication_log(data, "----PER-NUMA NODE KERNEL REPLICATION ENABLED----\n"); @@ -622,6 +627,18 @@ static void replicate_pgtables(void) } } +static void __init numa_replicate_kernel_text_disabled(void) +{ + int nid; + + init_mm.pgd_numa = (pgd_t **)kmalloc(sizeof(pgd_t *) * MAX_NUMNODES, GFP_PGTABLE_KERNEL); + BUG_ON(!init_mm.pgd_numa); + for_each_online_node(nid) { + init_mm.pgd_numa[nid] = init_mm.pgd; + } +} + + /* * Kernel text replication includes two steps: * 1. page tables replication for init_mm @@ -639,6 +656,11 @@ void __init numa_replicate_kernel_text(void) { int nid; + if (!kernel_replication_enabled) { + numa_replicate_kernel_text_disabled(); + return; + } + replicate_pgtables(); for_each_memory_node(nid) { @@ -667,6 +689,10 @@ void numa_replicate_kernel_rodata(void) { int nid; + if (!kernel_replication_enabled) { + return; + } + for_each_memory_node(nid) { if (nid == master_node) continue; @@ -678,7 +704,7 @@ void numa_replicate_kernel_rodata(void) void numa_setup_pgd(void) { - numa_load_replicated_pgd(init_mm.pgd_numa[numa_node_id()]); + numa_load_replicated_pgd(this_node_pgd(&init_mm)); } void __init_or_module *numa_get_replica(void *vaddr, int nid) @@ -693,8 +719,48 @@ void __init_or_module *numa_get_replica(void *vaddr, int nid) return node_desc[nid].text_vaddr + offset; } +static int __init setup_kernel_replication(char *str) +{ + int ret = 0; + + if (!str) + goto out; + if (!strcmp(str, "on")) { + kernel_replication_enabled = true; + pr_info("Kernel replication enabled via cmdline\n"); + ret = 1; + } else if (!strcmp(str, "off")) { + kernel_replication_enabled = false; + pr_info("Kernel replication disabled via cmdline\n"); + ret = 1; + } +out: + if (!ret) + pr_warn("kernel_replication= cannot parse, ignored\n"); + return ret; +} +__setup("kernel_replication=", setup_kernel_replication); + + nodemask_t __ro_after_init replica_nodes = { { [0] = 1UL } }; +/* + * Let us pretend, that we have only single node fore replicas. + * Do not replicate anything. + */ +static void __init numa_replication_init_disabled(void) +{ + int nid; + + __node_set(0, &replica_nodes); + for_each_online_node(nid) { + node_to_memory_node[nid] = 0; + } + + node_desc[0].text_vaddr = lm_alias((void *)KERNEL_TEXT_START); + node_desc[0].rodata_vaddr = lm_alias((void *)KERNEL_RODATA_START); +} + void __init numa_replication_init(void) { int nid; @@ -707,6 +773,16 @@ void __init numa_replication_init(void) #endif nodes_clear(replica_nodes); + if (kernel_replication_enabled) + pr_info("WARNING! WARNING! WARNING! Kernel replication enabled WARNING! WARNING! WARNING!\n"); + else + pr_info("Kernel replication disabled\n"); + + if (!kernel_replication_enabled) { + numa_replication_init_disabled(); + return; + } + for_each_node_state(nid, N_MEMORY) { __node_set(nid, &replica_nodes); } diff --git a/mm/vmalloc.c b/mm/vmalloc.c index a136e86e6480..b170cc1ef447 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -493,7 +493,7 @@ void vunmap_range_replicas(unsigned long addr, unsigned long end) flush_cache_vunmap(addr, end); for_each_memory_node(nid) - vunmap_range_noflush_pgd(init_mm.pgd_numa[nid], addr, end); + vunmap_range_noflush_pgd(per_node_pgd(&init_mm, nid), addr, end); flush_tlb_kernel_range(addr, end); } #endif /* CONFIG_KERNEL_REPLICATION && CONFIG_ARM64 */ @@ -2378,7 +2378,7 @@ static void free_unmap_vmap_area(struct vmap_area *va) * empty entries here, which is totally fine */ for_each_memory_node(node) - vunmap_range_noflush_pgd(init_mm.pgd_numa[node], + vunmap_range_noflush_pgd(per_node_pgd(&init_mm, node), va->va_start, va->va_end); } else { vunmap_range_noflush(va->va_start, va->va_end); @@ -4123,7 +4123,7 @@ int __vmalloc_node_replicate_range(const void *addr, gfp_t gfp_mask, for (i = 0; i < area->nr_pages; i++) list_add(&pages[i]->lru, &area->pages[i]->lru); - vunmap_range_noflush_pgd(init_mm.pgd_numa[node], + vunmap_range_noflush_pgd(per_node_pgd(&init_mm, node), area_start, area_end); /* -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] KVM: arm64: pvsched bugfix and module param
by Dongxu Sun 28 Feb '25

28 Feb '25

Yanan Wang (1): KVM:arm64:Add a module param to enable/disable pv_preempted dynamically Zhiqiang Ni (1): KVM: ARM: mark vCPU preempted if average guest steal time is considerable arch/arm64/include/asm/kvm_host.h | 6 ++++- arch/arm64/kvm/arm.c | 45 ++++++++++++++++++++++++++++--- arch/arm64/kvm/pvsched.c | 2 ++ arch/arm64/kvm/pvtime.c | 8 ++++++ include/trace/events/kvm.h | 24 +++++++++++++++++ 5 files changed, 80 insertions(+), 5 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 00/12] Add support for IPIv
by yangjinqian 28 Feb '25

28 Feb '25

Patch#1 Probe and configure IPIV capacity on HIP12 Patch#2 Allocate VM table and save vpeid in it Patch#3 Add support for ipiv direct mode Patch#4 Register ipiv exception interrupt Patch#5 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#6 Pre-allocate vpe id for direct mode Patch#7 Add interface KVM_CAP_ARM_IPIV_MODE Patch#8 Change ipiv irq type Patch#9 IPI performance benchmark Patch#10 Check GICD_CTLR_nASSGIreq when vpe schedule and deschedule Patch#11 Add a check before disabling ICC_SGI1R_EL1 trap Patch#12 use __GENKSYMS__ to revert the kabi change Xiang Chen (11): kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 kvm: hisi_virt: Allocate VM table and save vpeid in it kvm: hisi_virt: Add support for ipiv direct mode kvm: hisi_virt: Register ipiv exception interrupt irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Pre-allocate vpe id for direct mode kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Change ipiv irq type IPI performance benchmark irqchip: gicv3-its: Check GICD_CTLR_nASSGIreq when vpe schedule and deschedule irqchip: gicv3-its: Add a check before disabling ICC_SGI1R_EL1 trap yangjinqian (1): irqchip: gicv3-its: use __GENKSYMS__ to revert the kabi change .../admin-guide/kernel-parameters.txt | 8 + arch/Kconfig | 10 ++ arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 23 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 41 ++++- arch/arm64/kvm/hisilicon/hisi_virt.h | 9 + arch/arm64/kvm/sys_regs.c | 33 +++- arch/arm64/kvm/vgic/vgic-init.c | 84 +++++++++- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 + drivers/irqchip/irq-gic-v3-its.c | 121 +++++++++++++- drivers/irqchip/irq-gic-v3.c | 37 +++++ include/kvm/arm_vgic.h | 2 + include/linux/irqchip/arm-gic-v3.h | 23 +++ include/linux/irqchip/arm-gic-v4.h | 7 + include/uapi/linux/kvm.h | 2 + kernel/Makefile | 1 + kernel/ipi_benchmark.c | 155 ++++++++++++++++++ 17 files changed, 539 insertions(+), 20 deletions(-) create mode 100644 kernel/ipi_benchmark.c -- 2.33.0

2 13

[PATCH OLK-6.6 V2 00/24] Add support for heterogeneous live migration
by yangjinqian 28 Feb '25

28 Feb '25

Patch#1 Allow userspace to get the writable masks for feature ID registers Patch#2 Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 Use guest ID register values for the sake of emulation Patch#4 Advertise selected DebugVer in DBGDIDR.Version Patch#5 Reject attempts to set invalid debug arch version Patch#6 Bump up the default KVM sanitised debug version to v8p8 Patch#7 Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 Allow userspace to change ID_AA64PFR0_EL1 Patch#10 Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 Document vCPU feature selection UAPIs Patch#12 Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 Disable MPAM visibility by default and ignore VMM writes Patch#14 Use read-only helper for reading VM ID registers Patch#15 Add helper for writing ID regs Patch#16 Treat CTR_EL0 as a VM feature ID register Patch#17 Rename functions for invariant sys regs Patch#18 Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#19 Show writable masks for feature registers Patch#20 Make HCX writable from userspace Patch#21 Remove duplicated AA64MMFR1_EL1 XNX Patch#22 Add support for HIP09 Spectre-BHB mitigation Patch#23 add cnp verification on Hisilicon erratum 162100125 Patch#24 use __GENKSYMS__ to revert struct kvm kabi change James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Oliver Upton (8): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (3): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers Shameer Kolothum (2): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace yangjinqian (4): KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use __GENKSYMS__ to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 52 ++++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++ arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 24 ++ arch/arm64/include/uapi/asm/kvm.h | 32 ++ arch/arm64/kernel/cpu_errata.c | 13 +- arch/arm64/kernel/proton-pack.c | 1 + arch/arm64/kvm/arm.c | 10 + arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 305 +++++++++++++++---- include/uapi/linux/kvm.h | 3 + 13 files changed, 448 insertions(+), 60 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 25

[PATCH OLK-6.6 v2 00/24] Add support for heterogeneous live migration
by yangjinqian 28 Feb '25

28 Feb '25

Patch#1 Allow userspace to get the writable masks for feature ID registers Patch#2 Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 Use guest ID register values for the sake of emulation Patch#4 Advertise selected DebugVer in DBGDIDR.Version Patch#5 Reject attempts to set invalid debug arch version Patch#6 Bump up the default KVM sanitised debug version to v8p8 Patch#7 Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 Allow userspace to change ID_AA64PFR0_EL1 Patch#10 Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 Document vCPU feature selection UAPIs Patch#12 Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 Disable MPAM visibility by default and ignore VMM writes Patch#14 Use read-only helper for reading VM ID registers Patch#15 Add helper for writing ID regs Patch#16 Treat CTR_EL0 as a VM feature ID register Patch#17 Rename functions for invariant sys regs Patch#18 Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#19 Show writable masks for feature registers Patch#20 Make HCX writable from userspace Patch#21 Remove duplicated AA64MMFR1_EL1 XNX Patch#22 Add support for HIP09 Spectre-BHB mitigation Patch#23 add cnp verification on Hisilicon erratum 162100125 Patch#24 use __GENKSYMS__ to revert struct kvm kabi change James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Oliver Upton (8): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (3): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers Shameer Kolothum (2): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace yangjinqian (4): KVM: arm64: Make HCX writable from userspace arm64: Add support for HIP09 Spectre-BHB mitigation arm64: add cnp verification on Hisilicon erratum 162100125 KVM: arm64: use __GENKSYMS__ to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 52 ++++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 +++ arch/arm64/include/asm/cpufeature.h | 14 + arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 24 ++ arch/arm64/include/uapi/asm/kvm.h | 32 ++ arch/arm64/kernel/cpu_errata.c | 13 +- arch/arm64/kernel/proton-pack.c | 1 + arch/arm64/kvm/arm.c | 10 + arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 305 +++++++++++++++---- include/uapi/linux/kvm.h | 3 + 13 files changed, 448 insertions(+), 60 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 25

[openeuler:OLK-6.6] BUILD REGRESSION 305d30148bc6eb27489370e9370f84eb88c3a467
by kernel test robot 28 Feb '25

28 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 305d30148bc6eb27489370e9370f84eb88c3a467 !14820 [OLK-6.6]Hygon: Support kernel boot verification and secret injection for Hygon CSV3 VM Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250227 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250227 | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:member-reference-type-int-is-not-a-pointer | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250227 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250227 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250228 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250228 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250228 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250228 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250228 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250227 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250227 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250227 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250227 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250227 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250227 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250227 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250227 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250228 |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:vm_compaction-proc_handler |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:vm_compaction-procname |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 822m configs tested: 19 configs skipped: 123 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250227 gcc-14.2.0 arm64 randconfig-002-20250227 clang-19 arm64 randconfig-003-20250227 gcc-14.2.0 arm64 randconfig-004-20250227 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250227 gcc-14.2.0 loongarch randconfig-002-20250227 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250227 clang-19 x86_64 buildonly-randconfig-002-20250227 clang-19 x86_64 buildonly-randconfig-003-20250227 gcc-12 x86_64 buildonly-randconfig-004-20250227 gcc-12 x86_64 buildonly-randconfig-005-20250227 clang-19 x86_64 buildonly-randconfig-006-20250227 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ata: sata_dwc_460ex: Fix crash due to OOB write
by Li Lingfeng 28 Feb '25

28 Feb '25

From: Christian Lamparter <chunkeey(a)gmail.com> stable inclusion from stable-v4.19.238 commit 596c7efd69aae94f4b0e91172b075eb197958b99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6AM CVE: CVE-2022-49073 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7aa8104a554713b685db729e66511b93d989dd6a upstream. the driver uses libata's "tag" values from in various arrays. Since the mentioned patch bumped the ATA_TAG_INTERNAL to 32, the value of the SATA_DWC_QCMD_MAX needs to account for that. Otherwise ATA_TAG_INTERNAL usage cause similar crashes like this as reported by Tice Rex on the OpenWrt Forum and reproduced (with symbols) here: | BUG: Kernel NULL pointer dereference at 0x00000000 | Faulting instruction address: 0xc03ed4b8 | Oops: Kernel access of bad area, sig: 11 [#1] | BE PAGE_SIZE=4K PowerPC 44x Platform | CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0 | NIP: c03ed4b8 LR: c03d27e8 CTR: c03ed36c | REGS: cfa59950 TRAP: 0300 Not tainted (5.4.163) | MSR: 00021000 <CE,ME> CR: 42000222 XER: 00000000 | DEAR: 00000000 ESR: 00000000 | GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...] | [..] | NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254 | LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc | Call Trace: | [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable) | [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc | [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524 | [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0 | [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204 | [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130 | [...] This is because sata_dwc_dma_xfer_complete() NULLs the dma_pending's next neighbour "chan" (a *dma_chan struct) in this '32' case right here (line ~735): > hsdevp->dma_pending[tag] = SATA_DWC_DMA_PENDING_NONE; Then the next time, a dma gets issued; dma_dwc_xfer_setup() passes the NULL'd hsdevp->chan to the dmaengine_slave_config() which then causes the crash. With this patch, SATA_DWC_QCMD_MAX is now set to ATA_MAX_QUEUE + 1. This avoids the OOB. But please note, there was a worthwhile discussion on what ATA_TAG_INTERNAL and ATA_MAX_QUEUE is. And why there should not be a "fake" 33 command-long queue size. Ideally, the dw driver should account for the ATA_TAG_INTERNAL. In Damien Le Moal's words: "... having looked at the driver, it is a bigger change than just faking a 33rd "tag" that is in fact not a command tag at all." Fixes: 28361c403683c ("libata: add extra internal command") Cc: stable(a)kernel.org # 4.18+ BugLink: https://github.com/openwrt/openwrt/issues/9505 Signed-off-by: Christian Lamparter <chunkeey(a)gmail.com> Signed-off-by: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/ata/sata_dwc_460ex.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c index 6f142aa54f5f..5bc8633c6352 100644 --- a/drivers/ata/sata_dwc_460ex.c +++ b/drivers/ata/sata_dwc_460ex.c @@ -149,7 +149,11 @@ struct sata_dwc_device { #endif }; -#define SATA_DWC_QCMD_MAX 32 +/* + * Allow one extra special slot for commands and DMA management + * to account for libata internal commands. + */ +#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1) struct sata_dwc_device_port { struct sata_dwc_device *hsdev; -- 2.31.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 22f7213922f74e0c6d02a762d8442e9666efed26
by kernel test robot 28 Feb '25

28 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 22f7213922f74e0c6d02a762d8442e9666efed26 !15246 UBI/UBIFS mainline patch backport Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PCI_IOV-when-selected-by-CRYPTO_DEV_HISI_MIGRATION | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-001-20250227 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250227 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250227 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250227 | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250227 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250227 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250227 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250227 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250227 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-defconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-randconfig-161-20250228 |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 809m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250227 gcc-14.2.0 arm64 randconfig-002-20250227 clang-19 arm64 randconfig-003-20250227 gcc-14.2.0 arm64 randconfig-004-20250227 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250227 clang-19 x86_64 buildonly-randconfig-002-20250227 clang-19 x86_64 buildonly-randconfig-003-20250227 gcc-12 x86_64 buildonly-randconfig-004-20250227 gcc-12 x86_64 buildonly-randconfig-005-20250227 clang-19 x86_64 buildonly-randconfig-006-20250227 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-25.03 v4 0/4] Add TrIO support in EROFS
by Hongbo Li 27 Feb '25

27 Feb '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 ++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++ tools/trio/README.md | 507 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 59 +++ tools/trio/bpf/iotracker/iotracker.c | 57 +++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 280 ++++++++++ tools/trio/scripts/trace_parser.py | 277 ++++++++++ 16 files changed, 1793 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-25.03 v4 0/4] Add TrIO support in EROFS
by Hongbo Li 27 Feb '25

27 Feb '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. - Use spinlock in kprobe context. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/fscache.c | 22 +- fs/erofs/inode.c | 2 + fs/erofs/internal.h | 56 ++ fs/erofs/super.c | 49 +- fs/erofs/trio_manager.c | 365 +++++++++++++ tools/trio/README.md | 507 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 59 +++ tools/trio/bpf/iotracker/iotracker.c | 57 +++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 280 ++++++++++ tools/trio/scripts/trace_parser.py | 277 ++++++++++ 16 files changed, 1793 insertions(+), 3 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] NFSD: prevent underflow in nfssvc_decode_writeargs()
by Li Lingfeng 27 Feb '25

27 Feb '25

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.238 commit 9f0f048c1bfa7867d565a95fd8c28f4484ba1043 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4WZ CVE: CVE-2022-49280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 184416d4b98509fb4c3d8fc3d6dc1437896cc159 upstream. Smatch complains: fs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs() warn: no lower bound on 'args->len' Change the type to unsigned to prevent this issue. Cc: stable(a)vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c index 0d20fd161225..7b6a5f78f556 100644 --- a/fs/nfsd/nfsproc.c +++ b/fs/nfsd/nfsproc.c @@ -214,7 +214,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) unsigned long cnt = argp->len; unsigned int nvecs; - dprintk("nfsd: WRITE %s %d bytes at %d\n", + dprintk("nfsd: WRITE %s %u bytes at %d\n", SVCFH_fmt(&argp->fh), argp->len, argp->offset); diff --git a/fs/nfsd/xdr.h b/fs/nfsd/xdr.h index ea7cca3a64b7..6251d8754c82 100644 --- a/fs/nfsd/xdr.h +++ b/fs/nfsd/xdr.h @@ -33,7 +33,7 @@ struct nfsd_readargs { struct nfsd_writeargs { svc_fh fh; __u32 offset; - int len; + __u32 len; struct kvec first; }; -- 2.31.1

2 1

[PATCH openEuler-25.03 v4 0/4] Add TrIO support in EROFS
by Hongbo Li 27 Feb '25

27 Feb '25

TrIO can accelerate the cold start of containers during on-demand loading. It aggregates the read I/O operations required for container runtime during the first container launch. In the following startups, TrIO pulls the necessary I/O data to the container node in a single large I/O operation and uses this I/O information to construct the runtime rootfs. By improving the efficiency of network I/O, TrIO speeds up container startup in on-demand loading scenarios. TrIO consists of both kernel-space and user-space code. The kernel-space code has been adapted at the overlayfs layer, introducing the CONFIG_EROFS_TRIO configuration to provide isolation. The user-space code requires adaptation by the user, and detailed usage methods are introduced in the tools/trio/README.md section. Patches 1~2 correspond to the kernel adaptations, while patches 3~4 are the scripts and best practices that TrIO relies on for its operation. v4: - Avoid the memleak of meta_buf. - Fix some exception handle from reviewer's suggestions. v3: - Obtain and keep the trio_object in open. - Only close readahead in trio case. Hongbo Li (4): erofs:trio: Add trio_manager in erofs erofs: trio: Support TrIO feature in erofs TrIO: Add tools for using TrIO TrIO: Add README.md fs/erofs/Kconfig | 11 + fs/erofs/Makefile | 1 + fs/erofs/data.c | 16 + fs/erofs/fscache.c | 22 +- fs/erofs/internal.h | 50 ++ fs/erofs/super.c | 47 +- fs/erofs/trio_manager.c | 370 ++++++++++++++ tools/trio/README.md | 507 +++++++++++++++++++ tools/trio/bpf/iotracker/Makefile | 99 ++++ tools/trio/bpf/iotracker/iotracker.bpf.c | 59 +++ tools/trio/bpf/iotracker/iotracker.c | 57 +++ tools/trio/bpf/rio_tracker_mod/Makefile | 9 + tools/trio/bpf/rio_tracker_mod/rio_tracker.c | 278 ++++++++++ tools/trio/scripts/trace_parser.py | 277 ++++++++++ 14 files changed, 1801 insertions(+), 2 deletions(-) create mode 100644 fs/erofs/trio_manager.c create mode 100644 tools/trio/README.md create mode 100644 tools/trio/bpf/iotracker/Makefile create mode 100644 tools/trio/bpf/iotracker/iotracker.bpf.c create mode 100644 tools/trio/bpf/iotracker/iotracker.c create mode 100644 tools/trio/bpf/rio_tracker_mod/Makefile create mode 100644 tools/trio/bpf/rio_tracker_mod/rio_tracker.c create mode 100644 tools/trio/scripts/trace_parser.py -- 2.34.1

2 5

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 27 Feb '25

27 Feb '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 33c097cb0d6c8c1dcf8cde0f66b1c6c907ee2740 commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250227/202502271605.5iiFNfaf-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250227/202502271605.5iiFNfaf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502271605.5iiFNfaf-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 27 Feb '25

27 Feb '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 33c097cb0d6c8c1dcf8cde0f66b1c6c907ee2740 commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250227/202502271519.xkL4Djqh-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250227/202502271519.xkL4Djqh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502271519.xkL4Djqh-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/vmscan.c:23: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/vmscan.c:33: include/linux/mm_inline.h:32:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:350:64: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 350 | lru_size = node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:240:60: note: expanded from macro 'node_page_state' 240 | #define node_page_state(node, item) global_node_page_state(item) | ^~~~ mm/vmscan.c:363:29: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 363 | NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:1776:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 1776 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ mm/vmscan.c:3066:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3066 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 8 warnings and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 09176f764c02f778892696e10f5521ec75b901f9
by kernel test robot 27 Feb '25

27 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 09176f764c02f778892696e10f5521ec75b901f9 !15228 EDAC/amd64: Add support family types for hygon family 4h~5h and 7h. Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-001-20250226 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250226 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250226 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250226 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250226 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250226 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250226 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250226 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250226 | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 892m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250226 gcc-14.2.0 arm64 randconfig-002-20250226 gcc-14.2.0 arm64 randconfig-003-20250226 clang-21 arm64 randconfig-004-20250226 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250226 clang-19 x86_64 buildonly-randconfig-002-20250226 clang-19 x86_64 buildonly-randconfig-003-20250226 gcc-12 x86_64 buildonly-randconfig-004-20250226 clang-19 x86_64 buildonly-randconfig-005-20250226 gcc-12 x86_64 buildonly-randconfig-006-20250226 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS WITH WARNING 2a45fac1ca21c05d0e90f3177c4856bd0fffd363
by kernel test robot 27 Feb '25

27 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 2a45fac1ca21c05d0e90f3177c4856bd0fffd363 !15185 hwtracing: hisi_ptt: Initialize the filter sysfs attribute when allocation Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502262126.WKwzRa2g-lkp@intel.com drivers/cpufreq/acpi-cpufreq.c:638:13: warning: 'sched_set_itmt' defined but not used [-Wunused-function] Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250226 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250226 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250226 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250226 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250227 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250227 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250226 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250226 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250226 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250226 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250226 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250226 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250226 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250226 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250227 |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:vm_compaction-proc_handler |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:vm_compaction-procname |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 816m configs tested: 19 configs skipped: 114 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250226 gcc-14.2.0 arm64 randconfig-002-20250226 gcc-14.2.0 arm64 randconfig-003-20250226 clang-21 arm64 randconfig-004-20250226 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250226 gcc-14.2.0 loongarch randconfig-002-20250226 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250226 clang-19 x86_64 buildonly-randconfig-002-20250226 clang-19 x86_64 buildonly-randconfig-003-20250226 gcc-12 x86_64 buildonly-randconfig-004-20250226 clang-19 x86_64 buildonly-randconfig-005-20250226 gcc-12 x86_64 buildonly-randconfig-006-20250226 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1974/1974] drivers/cpufreq/acpi-cpufreq.c:638:13: warning: 'sched_set_itmt' defined but not used
by kernel test robot 26 Feb '25

26 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2a45fac1ca21c05d0e90f3177c4856bd0fffd363 commit: 06ee47aa957617950ebf29f2a9dbb5682233ba4e [1974/1974] cpufreq: ACPI: add ITMT support when CPPC enabled config: x86_64-buildonly-randconfig-005-20250226 (https://download.01.org/0day-ci/archive/20250226/202502262126.WKwzRa2g-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250226/202502262126.WKwzRa2g-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502262126.WKwzRa2g-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpufreq/acpi-cpufreq.c:638:13: warning: 'sched_set_itmt' defined but not used [-Wunused-function] 638 | static void sched_set_itmt(void) | ^~~~~~~~~~~~~~ vim +/sched_set_itmt +638 drivers/cpufreq/acpi-cpufreq.c 637 > 638 static void sched_set_itmt(void) 639 { 640 schedule_work(&sched_itmt_work); 641 } 642 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0