- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2735/2735] arch/x86/kernel/cpu/resctrl/rdtgroup.c:1504:6: warning: variable 'h' set but not used
by kernel test robot 10 Feb '25

10 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d0165578d0df9962ea30fbabcf76cf41f8789d27 commit: 540e1ae2f7aca5a427a52f12bef657b1e3e81fc1 [2735/2735] x86/resctrl: Add interface to read mbm_total_bytes_config config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250210/202502102259.fAt19b0s-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250210/202502102259.fAt19b0s-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502102259.fAt19b0s-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/x86/kernel/cpu/resctrl/rdtgroup.c:19: In file included from include/linux/fs_parser.h:11: In file included from include/linux/fs_context.h:14: In file included from include/linux/security.h:33: In file included from include/linux/mm.h:1587: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/cpu/resctrl/rdtgroup.c:1504:6: warning: variable 'h' set but not used [-Wunused-but-set-variable] 1504 | u32 h; | ^ 6 warnings generated. vim +/h +1504 arch/x86/kernel/cpu/resctrl/rdtgroup.c 1499 1500 static void mon_event_config_read(void *info) 1501 { 1502 struct mon_config_info *mon_info = info; 1503 unsigned int index; > 1504 u32 h; 1505 1506 index = mon_event_config_index_get(mon_info->evtid); 1507 if (index == INVALID_CONFIG_INDEX) { 1508 pr_warn_once("Invalid event id %d\n", mon_info->evtid); 1509 return; 1510 } 1511 rdmsr(MSR_IA32_EVT_CFG_BASE + index, mon_info->mon_config, h); 1512 1513 /* Report only the valid event configuration bits */ 1514 mon_info->mon_config &= MAX_EVT_CONFIG_BITS; 1515 } 1516 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] RDMA/hns: Fix free_mr_qp not assigning qp->device in error flow
by Chengchang Tang 10 Feb '25

10 Feb '25

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBLA1C --------------------------------------------------------------- For HIP08, the driver creates 8 free_mr_qp in free_mr_alloc_res(), and then assigns qp->device for them in free_mr_modify_rsv_qp(). When an error occurs during this process, qp->device of some free_mr_qp may not get assigned yet. When the driver enters the error flow and destroys these free_mr_qp, it will obtain hr_dev by qp->device, and this will lead to the panic below: Unable to handle kernel paging request at virtual address 0000000000001198 ... Call trace: hns_roce_v2_destroy_qp_common+0x18c/0x5f4 [hns_roce_hw_v2] hns_roce_v2_destroy_qp+0x254/0x490 [hns_roce_hw_v2] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] free_mr_init+0xcc/0xf0 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x180/0x304 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0x6c/0x1a0 [hns_roce_hw_v2] hclge_notify_roce_client+0x6c/0x160 [hclge] hclge_reset_rebuild+0x150/0x5c0 [hclge] hclge_reset+0x10c/0x140 [hclge] hclge_reset_subtask+0x80/0x104 [hclge] hclge_reset_service_task+0x168/0x3ac [hclge] hclge_service_task+0xb4/0x100 [hclge] Fixes: e89e2d3b692b ("RDMA/hns: Fix gid idx issue caused by free mr") Fixes: 6f5f556d3795 ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 9607f2eb45b7..5a7539f8c14d 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -3055,6 +3055,8 @@ static struct hns_roce_qp *create_free_mr_qp(struct hns_roce_dev *hr_dev, ibdev_err(ibdev, "failed to create qp for free mr.\n"); return NULL; } + qp->device = ibdev; + qp->qp_type = IB_QPT_RC; return to_hr_qp(qp); } @@ -3138,8 +3140,6 @@ static int free_mr_modify_rsv_qp(struct hns_roce_dev *hr_dev, hr_qp = to_hr_qp(&free_mr->rsv_qp[sl_num]->ibqp); hr_qp->free_mr_en = 1; - hr_qp->ibqp.device = ibdev; - hr_qp->ibqp.qp_type = IB_QPT_RC; mask = IB_QP_STATE | IB_QP_PKEY_INDEX | IB_QP_PORT | IB_QP_ACCESS_FLAGS; attr->qp_state = IB_QPS_INIT; -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS] net: let net.core.dev_weight always be non-zero
by Liu Jian 10 Feb '25

10 Feb '25

mainline inclusion from mainline-v6.14-rc1 commit d1f9f79fa2af8e3b45cffdeef66e05833480148a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIFI3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exceeding its budget of 0. ------------[ cut here ]------------ list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \ next=ffff88905f746e40. WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \ __list_add_valid_or_report+0xf3/0x130 CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+ RIP: 0010:__list_add_valid_or_report+0xf3/0x130 Call Trace: ? __warn+0xcd/0x250 ? __list_add_valid_or_report+0xf3/0x130 enqueue_to_backlog+0x923/0x1070 netif_rx_internal+0x92/0x2b0 __netif_rx+0x15/0x170 loopback_xmit+0x2ef/0x450 dev_hard_start_xmit+0x103/0x490 __dev_queue_xmit+0xeac/0x1950 ip_finish_output2+0x6cc/0x1620 ip_output+0x161/0x270 ip_push_pending_frames+0x155/0x1a0 raw_sendmsg+0xe13/0x1550 __sys_sendto+0x3bf/0x4e0 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x5b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e The reproduction command is as follows: sysctl -w net.core.dev_weight=0 ping 127.0.0.1 This is because when the napi's weight is set to 0, process_backlog() may return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this napi to be re-polled in net_rx_action() until __do_softirq() times out. Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can be retriggered in enqueue_to_backlog(), causing this issue. Making the napi's weight always non-zero solves this problem. Triggering this issue requires system-wide admin (setting is not namespaced). Fixes: e38766054509 ("[NET]: Fix sysctl net.core.dev_weight") Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Link: https://patch.msgid.link/20250116143053.4146855-1-liujian56@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/sysctl_net_core.c [Did not backport eec4844fae7c.] Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/core/sysctl_net_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c index 79164fc37359..43f4d4080864 100644 --- a/net/core/sysctl_net_core.c +++ b/net/core/sysctl_net_core.c @@ -235,7 +235,7 @@ static int proc_do_dev_weight(struct ctl_table *table, int write, int ret, weight; mutex_lock(&dev_weight_mutex); - ret = proc_dointvec(table, write, buffer, lenp, ppos); + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); if (!ret && write) { weight = READ_ONCE(weight_p); WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias); @@ -349,6 +349,7 @@ static struct ctl_table net_core_table[] = { .maxlen = sizeof(int), .mode = 0644, .proc_handler = proc_do_dev_weight, + .extra1 = &one, }, { .procname = "dev_weight_rx_bias", @@ -356,6 +357,7 @@ static struct ctl_table net_core_table[] = { .maxlen = sizeof(int), .mode = 0644, .proc_handler = proc_do_dev_weight, + .extra1 = &one, }, { .procname = "dev_weight_tx_bias", @@ -363,6 +365,7 @@ static struct ctl_table net_core_table[] = { .maxlen = sizeof(int), .mode = 0644, .proc_handler = proc_do_dev_weight, + .extra1 = &one, }, { .procname = "netdev_max_backlog", -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] : ext4: no need to continue when the number of entries is 1
by Yongjian Sun 10 Feb '25

10 Feb '25

From: Edward Adam Davis <eadavis(a)qq.com> mainline inclusion from mainline-v6.12-rc1 commit 1a00a393d6a7fb1e745a41edd09019bd6a0ad64c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCB CVE: CVE-2024-49967 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Reported-by: syzbot+ae688d469e36fb5138d0(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ae688d469e36fb5138d0 Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Reported-and-tested-by: syzbot+ae688d469e36fb5138d0(a)syzkaller.appspotmail.com Link: https://patch.msgid.link/tencent_BE7AEE6C7C2D216CB8949CE8E6EE7ECC2C0A@qq.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index f2208337e5cb..f034326988e4 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -1820,7 +1820,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, split = count/2; hash2 = map[split].hash; - continued = hash2 == map[split - 1].hash; + continued = split > 0 ? hash2 == map[split - 1].hash : 0; dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n", (unsigned long)dx_get_block(frame->at), hash2, split, count-split)); -- 2.39.2

2 1

[openeuler:OLK-5.10 2734/2734] htmldocs: Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst
by kernel test robot 10 Feb '25

10 Feb '25

Hi Fenghua, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 9534dcd94e7f28129d5a3db85ebaf7bd9e1136c6 commit: a6c0245e15d65203dbe3b21d47e8618b4444bf27 [2734/2734] x86/resctrl: Correct MBM total and local values reproduce: (https://download.01.org/0day-ci/archive/20250210/202502101814.m8lSF3rK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502101814.m8lSF3rK-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: MAINTAINERS references a file that doesn't exist: Documentation/x86/amd_hsmp.rst Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/pinctrl/toshiba,tmpv7700-pinctrl.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst >> Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:394 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] iomap: avoid avoid truncating 64-bit offset to 32 bits
by Long Li 10 Feb '25

10 Feb '25

From: Marco Nelissen <marco.nelissen(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit c13094b894de289514d84b8db56d1f2931a0bade category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJXF0 CVE: CVE-2025-21667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem. Signed-off-by: Marco Nelissen <marco.nelissen(a)gmail.com> Link: https://lore.kernel.org/r/20250109041253.2494374-1-marco.nelissen@gmail.com Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Conflicts: fs/iomap/buffered-io.c [Conflicts due to not merged 492f53758fad ("iomap: pass the iomap to the punch callback")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/iomap/buffered-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index ef8a8345ca9a..827a3ece86a1 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -1221,7 +1221,7 @@ static int iomap_write_delalloc_scan(struct inode *inode, } /* move offset to start of next folio in range */ - start_byte = folio_next_index(folio) << PAGE_SHIFT; + start_byte = folio_pos(folio) + folio_size(folio); folio_unlock(folio); folio_put(folio); } -- 2.39.2

2 1

[PATCH OLK-5.10] iomap: avoid avoid truncating 64-bit offset to 32 bits
by Long Li 10 Feb '25

10 Feb '25

From: Marco Nelissen <marco.nelissen(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit c13094b894de289514d84b8db56d1f2931a0bade category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJXF0 CVE: CVE-2025-21667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem. Signed-off-by: Marco Nelissen <marco.nelissen(a)gmail.com> Link: https://lore.kernel.org/r/20250109041253.2494374-1-marco.nelissen@gmail.com Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Conflicts: fs/xfs/xfs_iomap.c fs/iomap/buffered-io.c [Conflicts due to not merged 492f53758fad ("iomap: pass the iomap to the punch callback")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_iomap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index dc01689988ab..496d8950d5bf 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1195,7 +1195,7 @@ xfs_iomap_write_delalloc_scan( } /* move offset to start of next folio in range */ - start_byte = (page->index + 1) << PAGE_SHIFT; + start_byte = page_offset(page) + PAGE_SIZE; unlock_page(page); put_page(page); } -- 2.39.2

2 1

[PATCH OLK-5.10 00/14] try to backport "block: fix rq-qos breakage from skipping rq_qos_done_bio"
by Li Nan 10 Feb '25

10 Feb '25

Christoph Hellwig (9): [Backport] block: reuse BIO_INLINE_VECS for integrity bvecs [Backport] block: move struct biovec_slab to bio.c [Backport] block: factor out a bvec_alloc_gfp helper [Backport] block: streamline bvec_alloc [Backport] block: remove the 1 and 4 vec bvec_slabs entries [Backport] block: turn the nr_iovecs argument to bio_alloc* into an unsigned short [Backport] block: mark the bio as cloned in bio_iov_bvec_set [Backport] md/raid10: remove dead code in reshape_request [Backport] block: use bi_max_vecs to find the bvec pool Jens Axboe (2): [Backport] block: add a BUILD_BUG_ON() for adding more bio flags than we have space [Backport] block: only mark bio as tracked if it really is tracked Li Lingfeng (2): block: fix kabi broken block: fix kabi broken due to removing bip_slab Tejun Heo (1): [Backport] block: fix rq-qos breakage from skipping rq_qos_done_bio() block/blk-rq-qos.h | 23 +++-- block/blk.h | 1 + include/linux/bio.h | 13 +-- include/linux/blk_types.h | 32 +----- block/bio-integrity.c | 17 ++-- block/bio.c | 202 ++++++++++++++++---------------------- block/blk-iolatency.c | 2 +- drivers/md/raid10.c | 4 - 8 files changed, 110 insertions(+), 184 deletions(-) -- 2.39.2

2 15

[PATCH OLK-5.10] iio: light: vcnl4035: fix information leak in triggered buffer
by Huang Xiaojia 10 Feb '25

10 Feb '25

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> mainline inclusion from mainline-v6.13-rc7 commit 47b43e53c0a0edf5578d5d12f5fc71c019649279 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQVN CVE: CVE-2024-57910 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. That leaves at least 4 bytes uninitialized even after writing an integer value with regmap_read(). Initialize the array to zero before using it to avoid pushing uninitialized information to userspace. Cc: stable(a)vger.kernel.org Fixes: ec90b52c07c0 ("iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp()") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-6-0cb6e98d895c@g… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/iio/light/vcnl4035.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/light/vcnl4035.c b/drivers/iio/light/vcnl4035.c index 6e38a33f55c7..ce21c0fcd1c0 100644 --- a/drivers/iio/light/vcnl4035.c +++ b/drivers/iio/light/vcnl4035.c @@ -105,7 +105,7 @@ static irqreturn_t vcnl4035_trigger_consumer_handler(int irq, void *p) struct iio_dev *indio_dev = pf->indio_dev; struct vcnl4035_data *data = iio_priv(indio_dev); /* Ensure naturally aligned timestamp */ - u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8); + u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { }; int ret; ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] brd: fix AA deadlock for concurrent brd_probe()
by Yu Kuai 10 Feb '25

10 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIWBN CVE: NA ---------------------------------------- For concurrent brd_probe(), the first one will create brd disk and set partition number to 0, however, the second one will found the brd disk and keep the partition number as disk fist minor. This will case AA deadlock for the caller because bdev is part0 while bdev->bd_partno is not zero. Fix the problem by always return NULL in brd_probe, hence brd_probe() will be covered by exact_match() from __device_add_disk(). Fixes: 937af5ecd059 ("brd: Fix all partitions BUGs") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/block/brd.c | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/drivers/block/brd.c b/drivers/block/brd.c index 02e8fff3f828..fc1abcf760ad 100644 --- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -418,15 +418,13 @@ static void brd_free(struct brd_device *brd) kfree(brd); } -static struct brd_device *brd_init_one(int i, bool *new) +static void brd_init_one(int i) { struct brd_device *brd; - *new = false; - list_for_each_entry(brd, &brd_devices, brd_list) { + list_for_each_entry(brd, &brd_devices, brd_list) if (brd->brd_number == i) - goto out; - } + return; brd = brd_alloc(i); if (brd) { @@ -434,9 +432,6 @@ static struct brd_device *brd_init_one(int i, bool *new) add_disk(brd->brd_disk); list_add_tail(&brd->brd_list, &brd_devices); } - *new = true; -out: - return brd; } static void brd_del_one(struct brd_device *brd) @@ -448,19 +443,11 @@ static void brd_del_one(struct brd_device *brd) static struct kobject *brd_probe(dev_t dev, int *part, void *data) { - struct brd_device *brd; - struct kobject *kobj; - bool new; - mutex_lock(&brd_devices_mutex); - brd = brd_init_one(MINOR(dev) / max_part, &new); - kobj = brd ? get_disk_and_module(brd->brd_disk) : NULL; + brd_init_one(MINOR(dev) / max_part); mutex_unlock(&brd_devices_mutex); - if (new) - *part = 0; - - return kobj; + return NULL; } static inline void brd_check_and_reset_par(void) -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1420/1420] mm/page_alloc.c:3684:54: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 10 Feb '25

10 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 9b6c51cd780588813c5d327e2a6d677d010a2b6f [1420/1420] mm: fix zoneref mapping problem in memory reliable config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250210/202502100112.IwK7UXyM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250210/202502100112.IwK7UXyM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502100112.IwK7UXyM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c:141:1: sparse: sparse: symbol '__pcpu_scope_pcpu_drain' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/mem_reliable.h:68:15: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4656:13: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4661:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4661:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4661:35: sparse: right side has type unsigned int mm/page_alloc.c:4677:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4677:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4677:35: sparse: right side has type unsigned int mm/page_alloc.c:4683:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4683:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4683:35: sparse: right side has type unsigned int mm/page_alloc.c:4698:35: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4698:35: sparse: left side has type restricted gfp_t mm/page_alloc.c:4698:35: sparse: right side has type unsigned int mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:3683:14: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:3684:45: sparse: sparse: restricted gfp_t degrades to integer >> mm/page_alloc.c:3684:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted gfp_t [usertype] flags @@ got unsigned int @@ mm/page_alloc.c:3684:54: sparse: expected restricted gfp_t [usertype] flags mm/page_alloc.c:3684:54: sparse: got unsigned int include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:3701:14: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7512:27: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 36- | ^~ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 42- | ^~ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 48- | ^ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 54- | ^ mm/page_alloc.c:7516:9: note: in expansion of macro 'adj_init_size' 7516 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 60- | ^~ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 66- | ^~ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 72- | ^ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 78- | ^ mm/page_alloc.c:7518:9: note: in expansion of macro 'adj_init_size' 7518 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 84- | ^~ mm/page_alloc.c:7519:9: note: in expansion of macro 'adj_init_size' 7519 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 90- | ^~ mm/page_alloc.c:7519:9: note: in expansion of macro 'adj_init_size' 7519 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 96- | ^ mm/page_alloc.c:7519:9: note: in expansion of macro 'adj_init_size' 7519 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 102- | ^ mm/page_alloc.c:7519:9: note: in expansion of macro 'adj_init_size' 7519 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 108- | ^~ mm/page_alloc.c:7520:9: note: in expansion of macro 'adj_init_size' 7520 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 114- | ^~ mm/page_alloc.c:7520:9: note: in expansion of macro 'adj_init_size' 7520 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: warning: comparison between two arrays [-Warray-compare] 7512 | if (start <= pos && pos < end && size > adj) 120- | ^ mm/page_alloc.c:7520:9: note: in expansion of macro 'adj_init_size' 7520 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7512:41: note: use '&__start_rodata[0] < &_etext[0]' to compare the addresses 7512 | if (start <= pos && pos < end && size > adj) 126- | ^ vim +3684 mm/page_alloc.c 3673 3674 #ifdef CONFIG_MEMORY_RELIABLE 3675 static inline void reliable_fb_find_zone(gfp_t gfp_mask, 3676 struct alloc_context *ac) 3677 { 3678 if (!reliable_allow_fb_enabled()) 3679 return; 3680 3681 /* dst node don't have zone we want, fallback here */ 3682 if ((gfp_mask & __GFP_THISNODE) && (ac->high_zoneidx == ZONE_NORMAL) && 3683 (gfp_mask & ___GFP_RELIABILITY)) { > 3684 ac->high_zoneidx = gfp_zone(gfp_mask & ~___GFP_RELIABILITY); 3685 ac->preferred_zoneref = first_zones_zonelist( 3686 ac->zonelist, ac->high_zoneidx, ac->nodemask); 3687 } 3688 3689 return; 3690 } 3691 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1420/1420] mm/mem_reliable.c:401:5: sparse: sparse: symbol 'reliable_pagecache_max_bytes_write' was not declared. Should it be static?
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 6943b93b464351cbc35aa002e86bac48e08b1c3f [1420/1420] mm: add support for limiting the usage of reliable memory in pagecache config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250209/202502092339.Fe6S9ctM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250209/202502092339.Fe6S9ctM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502092339.Fe6S9ctM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/mem_reliable.c:39:1: sparse: sparse: symbol '__pcpu_scope_pagecache_reliable_pages' was not declared. Should it be static? mm/mem_reliable.c:67:14: sparse: sparse: restricted gfp_t degrades to integer mm/mem_reliable.c:250:5: sparse: sparse: symbol 'reliable_limit_handler' was not declared. Should it be static? mm/mem_reliable.c:323:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static? mm/mem_reliable.c:356:5: sparse: sparse: symbol 'reliable_reserve_size_handler' was not declared. Should it be static? mm/mem_reliable.c:380:5: sparse: sparse: symbol 'reliable_shmem_bytes_limit_handler' was not declared. Should it be static? >> mm/mem_reliable.c:401:5: sparse: sparse: symbol 'reliable_pagecache_max_bytes_write' was not declared. Should it be static? >> mm/mem_reliable.c:487:14: sparse: sparse: invalid assignment: |= mm/mem_reliable.c:487:14: sparse: left side has type restricted gfp_t mm/mem_reliable.c:487:14: sparse: right side has type unsigned int mm/mem_reliable.c:491:14: sparse: sparse: invalid assignment: &= mm/mem_reliable.c:491:14: sparse: left side has type restricted gfp_t mm/mem_reliable.c:491:14: sparse: right side has type unsigned int mm/mem_reliable.c:250:5: warning: no previous prototype for 'reliable_limit_handler' [-Wmissing-prototypes] 250 | int reliable_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:323:5: warning: no previous prototype for 'reliable_debug_handler' [-Wmissing-prototypes] 323 | int reliable_debug_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:356:5: warning: no previous prototype for 'reliable_reserve_size_handler' [-Wmissing-prototypes] 356 | int reliable_reserve_size_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:380:5: warning: no previous prototype for 'reliable_shmem_bytes_limit_handler' [-Wmissing-prototypes] 380 | int reliable_shmem_bytes_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:401:5: warning: no previous prototype for 'reliable_pagecache_max_bytes_write' [-Wmissing-prototypes] 401 | int reliable_pagecache_max_bytes_write(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/reliable_pagecache_max_bytes_write +401 mm/mem_reliable.c 400 > 401 int reliable_pagecache_max_bytes_write(struct ctl_table *table, int write, 402 void __user *buffer, size_t *length, loff_t *ppos) 403 { 404 unsigned long old_value = reliable_pagecache_max_bytes; 405 int ret; 406 407 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 408 if (!ret && write) { 409 if (reliable_pagecache_max_bytes > total_reliable_mem_sz()) { 410 reliable_pagecache_max_bytes = old_value; 411 return -EINVAL; 412 } 413 } 414 415 return ret; 416 } 417 418 static struct ctl_table reliable_ctl_table[] = { 419 { 420 .procname = "task_reliable_limit", 421 .data = &task_reliable_limit, 422 .maxlen = sizeof(task_reliable_limit), 423 .mode = 0644, 424 .proc_handler = reliable_limit_handler, 425 }, 426 { 427 .procname = "reliable_debug", 428 .data = &mem_reliable_ctrl_bits, 429 .maxlen = sizeof(mem_reliable_ctrl_bits), 430 .mode = 0600, 431 .proc_handler = reliable_debug_handler, 432 }, 433 { 434 .procname = "reliable_reserve_size", 435 .data = &sysctl_reliable_reserve_size, 436 .maxlen = sizeof(sysctl_reliable_reserve_size), 437 .mode = 0644, 438 .proc_handler = reliable_reserve_size_handler, 439 }, 440 #ifdef CONFIG_SHMEM 441 { 442 .procname = "shmem_reliable_bytes_limit", 443 .data = &sysctl_shmem_reliable_bytes_limit, 444 .maxlen = sizeof(sysctl_shmem_reliable_bytes_limit), 445 .mode = 0644, 446 .proc_handler = reliable_shmem_bytes_limit_handler, 447 }, 448 #endif 449 { 450 .procname = "reliable_pagecache_max_bytes", 451 .data = &reliable_pagecache_max_bytes, 452 .maxlen = sizeof(reliable_pagecache_max_bytes), 453 .mode = 0644, 454 .proc_handler = reliable_pagecache_max_bytes_write, 455 .extra1 = &zero, 456 }, 457 {} 458 }; 459 460 static struct ctl_table reliable_dir_table[] = { 461 { 462 .procname = "vm", 463 .maxlen = 0, 464 .mode = 0555, 465 .child = reliable_ctl_table, 466 }, 467 {} 468 }; 469 470 void page_cache_prepare_alloc(gfp_t *gfp) 471 { 472 long nr_reliable = 0; 473 int cpu; 474 475 if (!mem_reliable_is_enabled()) 476 return; 477 478 for_each_possible_cpu(cpu) 479 nr_reliable += this_cpu_read(pagecache_reliable_pages); 480 481 if (nr_reliable < 0) 482 goto no_reliable; 483 484 if (nr_reliable > reliable_pagecache_max_bytes >> PAGE_SHIFT) 485 goto no_reliable; 486 > 487 *gfp |= ___GFP_RELIABILITY; 488 return; 489 490 no_reliable: 491 *gfp &= ~___GFP_RELIABILITY; 492 } 493 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1420/1420] mm/mem_reliable.c:349:5: sparse: sparse: symbol 'reliable_shmem_bytes_limit_handler' was not declared. Should it be static?
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 7a36955e5c8808a4b45d826a127e136c97f2a6f8 [1420/1420] mm: Introduce shmem mirrored memory limit for memory reliable config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250209/202502092233.9edRdxQm-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250209/202502092233.9edRdxQm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502092233.9edRdxQm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/mem_reliable.c:63:14: sparse: sparse: restricted gfp_t degrades to integer mm/mem_reliable.c:219:5: sparse: sparse: symbol 'reliable_limit_handler' was not declared. Should it be static? mm/mem_reliable.c:292:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static? mm/mem_reliable.c:325:5: sparse: sparse: symbol 'reliable_reserve_size_handler' was not declared. Should it be static? >> mm/mem_reliable.c:349:5: sparse: sparse: symbol 'reliable_shmem_bytes_limit_handler' was not declared. Should it be static? mm/mem_reliable.c:219:5: warning: no previous prototype for 'reliable_limit_handler' [-Wmissing-prototypes] 219 | int reliable_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:292:5: warning: no previous prototype for 'reliable_debug_handler' [-Wmissing-prototypes] 292 | int reliable_debug_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:325:5: warning: no previous prototype for 'reliable_reserve_size_handler' [-Wmissing-prototypes] 325 | int reliable_reserve_size_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:349:5: warning: no previous prototype for 'reliable_shmem_bytes_limit_handler' [-Wmissing-prototypes] 349 | int reliable_shmem_bytes_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/reliable_shmem_bytes_limit_handler +349 mm/mem_reliable.c 348 > 349 int reliable_shmem_bytes_limit_handler(struct ctl_table *table, int write, 350 void __user *buffer, size_t *length, loff_t *ppos) 351 { 352 unsigned long *data_ptr = (unsigned long *)(table->data); 353 unsigned long old = *data_ptr; 354 int ret; 355 356 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 357 if (ret == 0 && write) { 358 if (*data_ptr > total_reliable_mem_sz()) { 359 *data_ptr = old; 360 return -EINVAL; 361 } 362 363 shmem_reliable_nr_page = *data_ptr >> PAGE_SHIFT; 364 } 365 366 return ret; 367 } 368 #endif 369 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1420/1420] mm/mem_reliable.c:272:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static?
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 851a3ff0b4de68403c9a344c3d5378aa590705b7 [1420/1420] mm: Introduce proc interface to control memory reliable features config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250209/202502092003.Ptadb8Sw-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250209/202502092003.Ptadb8Sw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502092003.Ptadb8Sw-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/mem_reliable.c:52:14: sparse: sparse: restricted gfp_t degrades to integer mm/mem_reliable.c:199:5: sparse: sparse: symbol 'reliable_limit_handler' was not declared. Should it be static? >> mm/mem_reliable.c:272:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static? mm/mem_reliable.c:199:5: warning: no previous prototype for 'reliable_limit_handler' [-Wmissing-prototypes] 199 | int reliable_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:272:5: warning: no previous prototype for 'reliable_debug_handler' [-Wmissing-prototypes] 272 | int reliable_debug_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ vim +/reliable_debug_handler +272 mm/mem_reliable.c 271 > 272 int reliable_debug_handler(struct ctl_table *table, int write, 273 void __user *buffer, size_t *length, loff_t *ppos) 274 { 275 unsigned long old_ctrl_bits, new_ctrl_bits; 276 static DEFINE_MUTEX(reliable_debug_mutex); 277 int ret; 278 279 mutex_lock(&reliable_debug_mutex); 280 old_ctrl_bits = mem_reliable_ctrl_bits; 281 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 282 if (ret == 0 && write) { 283 if (mem_reliable_ctrl_bits > (1 << CTRL_BITS_SHIFT) - 1) { 284 mem_reliable_ctrl_bits = old_ctrl_bits; 285 mutex_unlock(&reliable_debug_mutex); 286 287 return -EINVAL; 288 } 289 290 new_ctrl_bits = mem_reliable_ctrl_bits; 291 mem_reliable_ctrl_bits = old_ctrl_bits; 292 if (!!test_bit(MEM_RELIABLE_ALL, &new_ctrl_bits)) 293 mem_reliable_parse_ctrl_bits(new_ctrl_bits); 294 else 295 mem_reliable_disable_all(); 296 } 297 298 mutex_unlock(&reliable_debug_mutex); 299 300 return ret; 301 } 302 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1420/1420] mm/shmem.c:1601:19: sparse: sparse: invalid assignment: |=
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 3a3a1f75d885bc1d1a25bb753dd2cf9111c457f7 [1420/1420] shmem: Introduce shmem reliable config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250209/202502091809.4Ney4Px5-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250209/202502091809.4Ney4Px5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502091809.4Ney4Px5-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/shmem.c:688:9: sparse: sparse: self-comparison always evaluates to false >> mm/shmem.c:1601:19: sparse: sparse: invalid assignment: |= mm/shmem.c:1601:19: sparse: left side has type restricted gfp_t mm/shmem.c:1601:19: sparse: right side has type unsigned int mm/shmem.c: note: in included file (through include/linux/percpu_counter.h, include/linux/quota.h, include/linux/fs.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer vim +1601 mm/shmem.c 1595 1596 static inline void shmem_prepare_alloc(gfp_t *gfp_mask) 1597 { 1598 if (!shmem_reliable_is_enabled()) 1599 return; 1600 > 1601 *gfp_mask |= ___GFP_RELIABILITY; 1602 } 1603 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1420/1420] mm/mem_reliable.c:126:5: sparse: sparse: symbol 'reliable_limit_handler' was not declared. Should it be static?
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 1845e7add95773a24019fb72bbea24a0a568663b [1420/1420] mm: Add reliable memory use limit for user tasks config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250209/202502091601.sH0xhPOM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250209/202502091601.sH0xhPOM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502091601.sH0xhPOM-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_reliable.c:126:5: sparse: sparse: symbol 'reliable_limit_handler' was not declared. Should it be static? mm/mem_reliable.c:126:5: warning: no previous prototype for 'reliable_limit_handler' [-Wmissing-prototypes] 126 | int reliable_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ vim +/reliable_limit_handler +126 mm/mem_reliable.c 124 125 #ifdef CONFIG_SYSCTL > 126 int reliable_limit_handler(struct ctl_table *table, int write, 127 void __user *buffer, size_t *length, loff_t *ppos) 128 { 129 unsigned long old = task_reliable_limit; 130 int ret; 131 132 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 133 if (ret == 0 && write) { 134 if (task_reliable_limit > total_reliable_mem_sz()) { 135 task_reliable_limit = old; 136 return -EINVAL; 137 } 138 } 139 140 return ret; 141 } 142 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1420/1420] include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 33d1f46ad98ea3a13752a6360d97732ab4e119b9 [1420/1420] mm: Introduce memory reliable config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250209/202502091527.Cexj3y4I-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250209/202502091527.Cexj3y4I-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502091527.Cexj3y4I-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c:141:1: sparse: sparse: symbol '__pcpu_scope_pcpu_drain' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): >> include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4572:13: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4573:27: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4573:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4573:27: sparse: right side has type unsigned int mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 20- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 26- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 32- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 38- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 44- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 50- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 56- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 62- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 68- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 74- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 80- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 86- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 92- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 98- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 104- | ^ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); vim +41 include/linux/mem_reliable.h 31 32 static inline bool skip_none_movable_zone(gfp_t gfp, struct zoneref *z) 33 { 34 if (!mem_reliable_is_enabled()) 35 return false; 36 37 if (!current->mm || (current->flags & PF_KTHREAD)) 38 return false; 39 40 /* user tasks can only alloc memory from non-mirrored region */ > 41 if (!(gfp & ___GFP_RELIABILITY) && (gfp & __GFP_HIGHMEM) && 42 (gfp & __GFP_MOVABLE)) { 43 if (zonelist_zone_idx(z) < ZONE_MOVABLE) 44 return true; 45 } 46 47 return false; 48 } 49 #else 50 #define reliable_enabled 0 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1421/1421] drivers/edac/skx_base.o: warning: objtool: skx_decode()+0x27b: can't find switch jump table
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: e34047f6dc606c123911c6db8fa424bb4a035262 [1421/1421] EDAC, skx_edac: Delete duplicated code config: x86_64-buildonly-randconfig-005-20250208 (https://download.01.org/0day-ci/archive/20250209/202502091441.DGtT0ffE-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250209/202502091441.DGtT0ffE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502091441.DGtT0ffE-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/edac/skx_base.o: warning: objtool: skx_decode()+0x27b: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1420/1420] include/linux/uaccess.h:112:17: warning: 'kmask' may be used uninitialized
by kernel test robot 09 Feb '25

09 Feb '25

Hi Oleg, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: b77633c8236f2383f8d994249b40ed1bd3d012c0 [1420/1420] signal: simplify set_user_sigmask/restore_user_sigmask config: arm64-randconfig-r131-20250208 (https://download.01.org/0day-ci/archive/20250209/202502091307.JeeYzeRI-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250209/202502091307.JeeYzeRI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502091307.JeeYzeRI-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): include/linux/compat.h:499:9: note: here 499 | case 3: v.sig[5] = (set->sig[2] >> 32); v.sig[4] = set->sig[2]; | ^~~~ include/linux/compat.h:499:58: warning: this statement may fall through [-Wimplicit-fallthrough=] 499 | case 3: v.sig[5] = (set->sig[2] >> 32); v.sig[4] = set->sig[2]; | ~~~~~~~~~^~~~~~~~~~~~~ include/linux/compat.h:500:9: note: here 500 | case 2: v.sig[3] = (set->sig[1] >> 32); v.sig[2] = set->sig[1]; | ^~~~ include/linux/compat.h:500:58: warning: this statement may fall through [-Wimplicit-fallthrough=] 500 | case 2: v.sig[3] = (set->sig[1] >> 32); v.sig[2] = set->sig[1]; | ~~~~~~~~~^~~~~~~~~~~~~ include/linux/compat.h:501:9: note: here 501 | case 1: v.sig[1] = (set->sig[0] >> 32); v.sig[0] = set->sig[0]; | ^~~~ In file included from include/asm-generic/termios.h:6, from ./arch/arm64/include/generated/uapi/asm/termios.h:1, from include/uapi/linux/termios.h:6, from include/linux/tty.h:7, from kernel/signal.c:23: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_sigaltstack' at kernel/signal.c:3635:13, inlined from '__se_sys_sigaltstack' at kernel/signal.c:3631:1: include/linux/uaccess.h:112:17: warning: 'new' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/asm-generic/bug.h:5, from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/gfp.h:5, from include/linux/slab.h:15, from kernel/signal.c:13: include/linux/kasan-checks.h: In function '__se_sys_sigaltstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3633:17: note: 'new' declared here 3633 | stack_t new, old; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'do_compat_sigaltstack' at kernel/signal.c:3678:7: include/linux/uaccess.h:112:17: warning: 'uss32' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'do_compat_sigaltstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3677:32: note: 'uss32' declared here 3677 | compat_stack_t uss32; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_tgsigqueueinfo' at kernel/signal.c:3496:6, inlined from '__se_sys_rt_tgsigqueueinfo' at kernel/signal.c:3491:1: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_tgsigqueueinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3494:19: note: 'info' declared here 3494 | siginfo_t info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigqueueinfo' at kernel/signal.c:3454:6, inlined from '__se_sys_rt_sigqueueinfo' at kernel/signal.c:3450:1: include/linux/uaccess.h:112:17: warning: 'info' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigqueueinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3453:19: note: 'info' declared here 3453 | siginfo_t info; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_sigprocmask' at kernel/signal.c:3783:7, inlined from '__se_sys_sigprocmask' at kernel/signal.c:3774:1: include/linux/uaccess.h:112:17: warning: 'new_set' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_sigprocmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3777:31: note: 'new_set' declared here 3777 | old_sigset_t old_set, new_set; | ^~~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'set_user_sigmask' at kernel/signal.c:2836:6: >> include/linux/uaccess.h:112:17: warning: 'kmask' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'set_user_sigmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:2830:18: note: 'kmask' declared here 2830 | sigset_t kmask; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigprocmask' at kernel/signal.c:2887:7, inlined from '__se_sys_rt_sigprocmask' at kernel/signal.c:2874:1, inlined from '__arm64_sys_rt_sigprocmask' at kernel/signal.c:2874:1: include/linux/uaccess.h:112:17: warning: 'new_set' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__arm64_sys_rt_sigprocmask': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:2877:27: note: 'new_set' declared here 2877 | sigset_t old_set, new_set; | ^~~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigtimedwait' at kernel/signal.c:3281:6, inlined from '__se_sys_rt_sigtimedwait' at kernel/signal.c:3268:1: include/linux/uaccess.h:112:17: warning: 'these' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__se_sys_rt_sigtimedwait': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3272:18: note: 'these' declared here 3272 | sigset_t these; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'copy_siginfo_from_user32' at kernel/signal.c:3125:6: include/linux/uaccess.h:112:17: warning: 'from' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'copy_siginfo_from_user32': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3123:31: note: 'from' declared here 3123 | struct compat_siginfo from; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'restore_altstack' at kernel/signal.c:3648:6: include/linux/uaccess.h:112:17: warning: 'new' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'restore_altstack': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3647:17: note: 'new' declared here 3647 | stack_t new; | ^~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigaction' at kernel/signal.c:3834:13, inlined from '__se_sys_rt_sigaction' at kernel/signal.c:3822:1, inlined from '__arm64_sys_rt_sigaction' at kernel/signal.c:3822:1: include/linux/uaccess.h:112:17: warning: 'new_sa' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__arm64_sys_rt_sigaction': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:3827:28: note: 'new_sa' declared here 3827 | struct k_sigaction new_sa, old_sa; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__do_sys_rt_sigsuspend' at kernel/signal.c:4053:6, inlined from '__se_sys_rt_sigsuspend' at kernel/signal.c:4045:1, inlined from '__arm64_sys_rt_sigsuspend' at kernel/signal.c:4045:1: include/linux/uaccess.h:112:17: warning: 'newset' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__arm64_sys_rt_sigsuspend': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ kernel/signal.c:4047:18: note: 'newset' declared here 4047 | sigset_t newset; | ^~~~~~ vim +/kmask +112 include/linux/uaccess.h d597580d373774 Al Viro 2017-03-20 104 d597580d373774 Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774 Al Viro 2017-03-20 106 static inline unsigned long d597580d373774 Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 108 { d597580d373774 Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4 Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4 Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774 Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 114 } d597580d373774 Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774 Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774 Al Viro 2017-03-20 117 return res; d597580d373774 Al Viro 2017-03-20 118 } d597580d373774 Al Viro 2017-03-20 119 #else d597580d373774 Al Viro 2017-03-20 120 extern unsigned long d597580d373774 Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774 Al Viro 2017-03-20 122 #endif d597580d373774 Al Viro 2017-03-20 123 d597580d373774 Al Viro 2017-03-20 124 #ifdef INLINE_COPY_TO_USER d597580d373774 Al Viro 2017-03-20 125 static inline unsigned long d597580d373774 Al Viro 2017-03-20 126 _copy_to_user(void __user *to, const void *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 127 { 9c5f6908de03a4 Al Viro 2017-06-29 128 might_fault(); 4983cb67a383a7 Linus Torvalds 2019-02-14 129 if (access_ok(to, n)) { 9c5f6908de03a4 Al Viro 2017-06-29 130 kasan_check_read(from, n); d597580d373774 Al Viro 2017-03-20 131 n = raw_copy_to_user(to, from, n); 9c5f6908de03a4 Al Viro 2017-06-29 132 } d597580d373774 Al Viro 2017-03-20 133 return n; d597580d373774 Al Viro 2017-03-20 134 } d597580d373774 Al Viro 2017-03-20 135 #else d597580d373774 Al Viro 2017-03-20 136 extern unsigned long d597580d373774 Al Viro 2017-03-20 137 _copy_to_user(void __user *, const void *, unsigned long); d597580d373774 Al Viro 2017-03-20 138 #endif d597580d373774 Al Viro 2017-03-20 139 d597580d373774 Al Viro 2017-03-20 140 static __always_inline unsigned long __must_check d597580d373774 Al Viro 2017-03-20 141 copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774 Al Viro 2017-03-20 142 { b0377fedb65280 Al Viro 2017-06-29 143 if (likely(check_copy_size(to, n, false))) d597580d373774 Al Viro 2017-03-20 @144 n = _copy_from_user(to, from, n); d597580d373774 Al Viro 2017-03-20 145 return n; d597580d373774 Al Viro 2017-03-20 146 } d597580d373774 Al Viro 2017-03-20 147 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2732/2732] kismet: WARNING: unmet direct dependencies detected for TASK_PLACEMENT_BY_CPU_RANGE when selected by BPF_SCHED
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 263072f655dcd6fd63f7d5dd1f9c5553134982fa commit: f23e7844132b626800d06e42d09e2ffe241c51cc [2732/2732] sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE config: arm64-kismet-CONFIG_TASK_PLACEMENT_BY_CPU_RANGE-CONFIG_BPF_SCHED-0-0 (https://download.01.org/0day-ci/archive/20250209/202502091108.0W1jorJu-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250209/202502091108.0W1jorJu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502091108.0W1jorJu-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for TASK_PLACEMENT_BY_CPU_RANGE when selected by BPF_SCHED WARNING: unmet direct dependencies detected for TASK_PLACEMENT_BY_CPU_RANGE Depends on [n]: CGROUPS [=n] Selected by [y]: - BPF_SCHED [=y] && BPF_EVENTS [=y] && BPF_SYSCALL [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2732/2732] kismet: WARNING: unmet direct dependencies detected for BPF_NET_GLOBAL_PROG when selected by SCHED_TASK_RELATIONSHIP
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 263072f655dcd6fd63f7d5dd1f9c5553134982fa commit: 64ba5634c4c60ea966612ab3eca75cbf2d90f9bc [2732/2732] net: add some bpf hooks in tcp stack for network numa relationship config: arm64-kismet-CONFIG_BPF_NET_GLOBAL_PROG-CONFIG_SCHED_TASK_RELATIONSHIP-0-0 (https://download.01.org/0day-ci/archive/20250209/202502090816.X4XejMgg-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250209/202502090816.X4XejMgg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502090816.X4XejMgg-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for BPF_NET_GLOBAL_PROG when selected by SCHED_TASK_RELATIONSHIP WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] WARNING: unmet direct dependencies detected for BPF_NET_GLOBAL_PROG Depends on [n]: NET [=n] && BPF_SYSCALL [=n] Selected by [y]: - SCHED_TASK_RELATIONSHIP [=y] && CGROUPS [=y] && NUMA_BALANCING [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 96ebabc25b2677a2a225de204946e424cf3887c1
by kernel test robot 09 Feb '25

09 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 96ebabc25b2677a2a225de204946e424cf3887c1 !15002 riscv: Fix sleeping in invalid context in die() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502082247.kdBxrDeT-lkp@intel.com mm/madvise.c:297:6: warning: no previous prototype for function 'force_swapin_vma' [-Wmissing-prototypes] mm/memblock.c:1409:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] mm/memcontrol.c:4428:12: warning: 'mem_cgroup_check_swap_for_v1' defined but not used [-Wunused-function] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- arm64-allnoconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- arm64-randconfig-001-20250208 | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- arm64-randconfig-002-20250208 | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- arm64-randconfig-003-20250208 | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- arm64-randconfig-004-20250208 | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- loongarch-allmodconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-allnoconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-allyesconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-randconfig-001-20250208 | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-randconfig-002-20250208 | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- x86_64-buildonly-randconfig-001-20250207 | `-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used |-- x86_64-buildonly-randconfig-001-20250208 | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:member-reference-type-int-is-not-a-pointer | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- x86_64-buildonly-randconfig-002-20250208 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-003-20250208 | |-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_getets | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-004-20250208 | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- x86_64-buildonly-randconfig-005-20250208 | `-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- x86_64-buildonly-randconfig-006-20250208 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags `-- x86_64-randconfig-161-20250207 |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags elapsed time: 724m configs tested: 19 configs skipped: 98 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250208 clang-21 arm64 randconfig-002-20250208 clang-21 arm64 randconfig-003-20250208 clang-21 arm64 randconfig-004-20250208 clang-15 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250208 gcc-14.2.0 loongarch randconfig-002-20250208 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250208 clang-19 x86_64 buildonly-randconfig-002-20250208 gcc-12 x86_64 buildonly-randconfig-003-20250208 gcc-12 x86_64 buildonly-randconfig-004-20250208 clang-19 x86_64 buildonly-randconfig-005-20250208 clang-19 x86_64 buildonly-randconfig-006-20250208 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 263072f655dcd6fd63f7d5dd1f9c5553134982fa
by kernel test robot 09 Feb '25

09 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 263072f655dcd6fd63f7d5dd1f9c5553134982fa !15046 pinmux: Use sequential access to access desc->pinmux data Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502082204.WShjoZst-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502082313.lZnwkvkI-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502082340.S6mQ2xsd-lkp@intel.com fs/ceph/snap.o: warning: objtool: ceph_update_snap_trace()+0xb8c: unreachable instruction mm/damon/core-test.h:284:2: warning: comparison of distinct pointer types ('typeof (__left) *' (aka 'unsigned int *') and 'typeof (__right) *' (aka 'int *')) [-Wcompare-distinct-pointer-types] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-DRM_PANEL_BRIDGE-when-selected-by-DRM_TOSHIBA_TC358762 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SERIAL_EARLYCON-when-selected-by-SERIAL_IMX_EARLYCON | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SND_SOC_DMIC-when-selected-by-SND_SOC_INTEL_DA7219_MAX98357A_GENERIC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SND_SOC_DMIC-when-selected-by-SND_SOC_STM32_DFSDM | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-defconfig | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | `-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) |-- x86_64-buildonly-randconfig-001-20250208 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250205 | `-- fs-ceph-snap.o:warning:objtool:ceph_update_snap_trace:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250208 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-003-20250208 | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-004-20250208 | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | `-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250208 | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file |-- x86_64-buildonly-randconfig-006-20250208 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page `-- x86_64-defconfig |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page elapsed time: 728m configs tested: 16 configs skipped: 113 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250208 clang-21 arm64 randconfig-002-20250208 clang-21 arm64 randconfig-003-20250208 clang-21 arm64 randconfig-004-20250208 clang-15 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250208 clang-19 x86_64 buildonly-randconfig-002-20250208 gcc-12 x86_64 buildonly-randconfig-003-20250208 gcc-12 x86_64 buildonly-randconfig-004-20250208 clang-19 x86_64 buildonly-randconfig-005-20250208 clang-19 x86_64 buildonly-randconfig-006-20250208 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2729/2729] mm/hugetlb.c:2216:9: warning: variable 'gfp' set but not used
by kernel test robot 09 Feb '25

09 Feb '25

Hi Ben, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 263072f655dcd6fd63f7d5dd1f9c5553134982fa commit: 27a782f719fdab073c5b0e19764fad1f93cddd00 [2729/2729] mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY config: x86_64-buildonly-randconfig-004-20250208 (https://download.01.org/0day-ci/archive/20250209/202502090535.KiiKAKub-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250209/202502090535.KiiKAKub-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502090535.KiiKAKub-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/hugetlb.c:8: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> mm/hugetlb.c:2216:9: warning: variable 'gfp' set but not used [-Wunused-but-set-variable] 2216 | gfp_t gfp = gfp_mask | __GFP_NOWARN; | ^ 2 warnings generated. vim +/gfp +2216 mm/hugetlb.c 2200 2201 /* 2202 * Use the VMA's mpolicy to allocate a huge page from the buddy. 2203 */ 2204 static 2205 struct page *alloc_buddy_huge_page_with_mpol(struct hstate *h, 2206 struct vm_area_struct *vma, unsigned long addr) 2207 { 2208 struct page *page = NULL; 2209 struct mempolicy *mpol; 2210 gfp_t gfp_mask = htlb_alloc_mask(h); 2211 int nid; 2212 nodemask_t *nodemask; 2213 2214 nid = huge_node(vma, addr, gfp_mask, &mpol, &nodemask); 2215 if (mpol_is_preferred_many(mpol)) { > 2216 gfp_t gfp = gfp_mask | __GFP_NOWARN; 2217 2218 gfp &= ~(__GFP_DIRECT_RECLAIM | __GFP_NOFAIL); 2219 page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); 2220 2221 /* Fallback to all nodes if page==NULL */ 2222 nodemask = NULL; 2223 } 2224 2225 if (!page) 2226 page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); 2227 mpol_cond_put(mpol); 2228 return page; 2229 } 2230 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/hugetlb.c:1370:6: warning: no previous prototype for 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1418/1418] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-001-20250207 (https://download.01.org/0day-ci/archive/20250209/202502090531.QZLxv0jk-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250209/202502090531.QZLxv0jk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502090531.QZLxv0jk-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:1370:6: warning: no previous prototype for 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ -- In file included from include/linux/page_counter.h:6, from mm/memcontrol.c:34: mm/memcontrol.c: In function 'mem_cgroup_get_max': include/linux/kernel.h:884:45: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 884 | #define min(x, y) __careful_cmp(x, y, <) | ^ include/linux/kernel.h:867:30: note: in definition of macro '__cmp' 867 | #define __cmp(x, y, op) ((x) op (y) ? (x) : (y)) | ^~ include/linux/kernel.h:884:25: note: in expansion of macro '__careful_cmp' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ mm/memcontrol.c:1542:28: note: in expansion of macro 'min' 1542 | swap_max = min(swap_max, (unsigned long)total_swap_pages); | ^~~ mm/memcontrol.c: At top level: >> mm/memcontrol.c:5008:6: warning: no previous prototype for 'dhugetlb_pool_is_free' [-Wmissing-prototypes] 5008 | bool dhugetlb_pool_is_free(struct cgroup_subsys_state *css) | ^~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/shmem_fs.h:7, from mm/memcontrol.c:39: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ mm/memcontrol.c:6718: warning: bad line: | 0, otherwise. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/khugepaged.c:1336: warning: Function parameter or member 'reliable' not described in 'collapse_shmem'
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: ff0fb9e816fac221fa24a1810dd895745406070b [1418/1418] mm: thp: Add memory reliable support for hugepaged collapse config: x86_64-buildonly-randconfig-001-20250207 (https://download.01.org/0day-ci/archive/20250209/202502090339.Fw3TyU0R-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250209/202502090339.Fw3TyU0R-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502090339.Fw3TyU0R-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/khugepaged.c:1336: warning: Function parameter or member 'mm' not described in 'collapse_shmem' mm/khugepaged.c:1336: warning: Function parameter or member 'mapping' not described in 'collapse_shmem' mm/khugepaged.c:1336: warning: Function parameter or member 'start' not described in 'collapse_shmem' mm/khugepaged.c:1336: warning: Function parameter or member 'hpage' not described in 'collapse_shmem' mm/khugepaged.c:1336: warning: Function parameter or member 'node' not described in 'collapse_shmem' >> mm/khugepaged.c:1336: warning: Function parameter or member 'reliable' not described in 'collapse_shmem' vim +1336 mm/khugepaged.c f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1314 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1315 /** f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1316 * collapse_shmem - collapse small tmpfs/shmem pages into huge one. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1317 * f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1318 * Basic scheme is simple, details are more complex: af24c01831e4e21 Hugh Dickins 2018-11-30 1319 * - allocate and lock a new huge page; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1320 * - scan over radix tree replacing old pages the new one f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1321 * + swap in pages if necessary; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1322 * + fill in gaps; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1323 * + keep old pages around in case if rollback is required; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1324 * - if replacing succeed: f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1325 * + copy data over; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1326 * + free old pages; af24c01831e4e21 Hugh Dickins 2018-11-30 1327 * + unlock huge page; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1328 * - if replacing failed; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1329 * + put all pages back and unfreeze them; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1330 * + restore gaps in the radix-tree; af24c01831e4e21 Hugh Dickins 2018-11-30 1331 * + unlock and free huge page; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1332 */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1333 static void collapse_shmem(struct mm_struct *mm, f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1334 struct address_space *mapping, pgoff_t start, ff0fb9e816fac22 Ma Wupeng 2022-02-09 1335 struct page **hpage, int node, bool reliable) f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 @1336 { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1337 gfp_t gfp; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1338 struct page *page, *new_page, *tmp; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1339 struct mem_cgroup *memcg; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1340 pgoff_t index, end = start + HPAGE_PMD_NR; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1341 LIST_HEAD(pagelist); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1342 struct radix_tree_iter iter; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1343 void **slot; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1344 int nr_none = 0, result = SCAN_SUCCEED; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1345 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1346 VM_BUG_ON(start & (HPAGE_PMD_NR - 1)); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1347 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1348 /* Only allocate from the target node */ 41b6167e8f746b4 Michal Hocko 2017-01-10 1349 gfp = alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1350 ff0fb9e816fac22 Ma Wupeng 2022-02-09 1351 if (reliable) ff0fb9e816fac22 Ma Wupeng 2022-02-09 1352 gfp |= ___GFP_RELIABILITY; ff0fb9e816fac22 Ma Wupeng 2022-02-09 1353 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1354 new_page = khugepaged_alloc_page(hpage, gfp, node); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1355 if (!new_page) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1356 result = SCAN_ALLOC_HUGE_PAGE_FAIL; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1357 goto out; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1358 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1359 2a70f6a76bb86d1 Michal Hocko 2018-04-10 1360 if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1361 result = SCAN_CGROUP_CHARGE_FAIL; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1362 goto out; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1363 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1364 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1365 __SetPageLocked(new_page); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1366 __SetPageSwapBacked(new_page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1367 new_page->index = start; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1368 new_page->mapping = mapping; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1369 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1370 /* af24c01831e4e21 Hugh Dickins 2018-11-30 1371 * At this point the new_page is locked and not up-to-date. af24c01831e4e21 Hugh Dickins 2018-11-30 1372 * It's safe to insert it into the page cache, because nobody would af24c01831e4e21 Hugh Dickins 2018-11-30 1373 * be able to map it or use it in another way until we unlock it. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1374 */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1375 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1376 index = start; b93b016313b3ba8 Matthew Wilcox 2018-04-10 1377 xa_lock_irq(&mapping->i_pages); b93b016313b3ba8 Matthew Wilcox 2018-04-10 1378 radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1379 int n = min(iter.index, end) - index; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1380 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1381 /* 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1382 * Stop if extent has been hole-punched, and is now completely 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1383 * empty (the more obvious i_size_read() check would take an 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1384 * irq-unsafe seqlock on 32-bit). 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1385 */ 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1386 if (n >= HPAGE_PMD_NR) { 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1387 result = SCAN_TRUNCATED; 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1388 goto tree_locked; 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1389 } 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1390 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1391 /* f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1392 * Handle holes in the radix tree: charge it from shmem and f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1393 * insert relevant subpage of new_page into the radix-tree. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1394 */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1395 if (n && !shmem_charge(mapping->host, n)) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1396 result = SCAN_FAIL; 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1397 goto tree_locked; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1398 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1399 for (; index < min(iter.index, end); index++) { b93b016313b3ba8 Matthew Wilcox 2018-04-10 1400 radix_tree_insert(&mapping->i_pages, index, f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1401 new_page + (index % HPAGE_PMD_NR)); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1402 } 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1403 nr_none += n; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1404 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1405 /* We are done. */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1406 if (index >= end) f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1407 break; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1408 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1409 page = radix_tree_deref_slot_protected(slot, b93b016313b3ba8 Matthew Wilcox 2018-04-10 1410 &mapping->i_pages.xa_lock); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1411 if (radix_tree_exceptional_entry(page) || !PageUptodate(page)) { b93b016313b3ba8 Matthew Wilcox 2018-04-10 1412 xa_unlock_irq(&mapping->i_pages); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1413 /* swap in or instantiate fallocated page */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1414 if (shmem_getpage(mapping->host, index, &page, f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1415 SGP_NOHUGE)) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1416 result = SCAN_FAIL; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1417 goto tree_unlocked; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1418 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1419 } else if (trylock_page(page)) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1420 get_page(page); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1421 xa_unlock_irq(&mapping->i_pages); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1422 } else { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1423 result = SCAN_PAGE_LOCK; 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1424 goto tree_locked; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1425 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1426 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1427 /* b93b016313b3ba8 Matthew Wilcox 2018-04-10 1428 * The page must be locked, so we can drop the i_pages lock f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1429 * without racing with truncate. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1430 */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1431 VM_BUG_ON_PAGE(!PageLocked(page), page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1432 VM_BUG_ON_PAGE(!PageUptodate(page), page); 8b37c40503eadc6 Hugh Dickins 2018-11-30 1433 8b37c40503eadc6 Hugh Dickins 2018-11-30 1434 /* 8b37c40503eadc6 Hugh Dickins 2018-11-30 1435 * If file was truncated then extended, or hole-punched, before 8b37c40503eadc6 Hugh Dickins 2018-11-30 1436 * we locked the first page, then a THP might be there already. 8b37c40503eadc6 Hugh Dickins 2018-11-30 1437 */ 8b37c40503eadc6 Hugh Dickins 2018-11-30 1438 if (PageTransCompound(page)) { 8b37c40503eadc6 Hugh Dickins 2018-11-30 1439 result = SCAN_PAGE_COMPOUND; 8b37c40503eadc6 Hugh Dickins 2018-11-30 1440 goto out_unlock; 8b37c40503eadc6 Hugh Dickins 2018-11-30 1441 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1442 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1443 if (page_mapping(page) != mapping) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1444 result = SCAN_TRUNCATED; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1445 goto out_unlock; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1446 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1447 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1448 if (isolate_lru_page(page)) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1449 result = SCAN_DEL_PAGE_LRU; 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1450 goto out_unlock; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1451 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1452 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1453 if (page_mapped(page)) 977fbdcd5986c9f Matthew Wilcox 2018-01-31 1454 unmap_mapping_pages(mapping, index, 1, false); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1455 b93b016313b3ba8 Matthew Wilcox 2018-04-10 1456 xa_lock_irq(&mapping->i_pages); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1457 b93b016313b3ba8 Matthew Wilcox 2018-04-10 1458 slot = radix_tree_lookup_slot(&mapping->i_pages, index); 91a45f71078a656 Johannes Weiner 2016-12-12 1459 VM_BUG_ON_PAGE(page != radix_tree_deref_slot_protected(slot, b93b016313b3ba8 Matthew Wilcox 2018-04-10 1460 &mapping->i_pages.xa_lock), page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1461 VM_BUG_ON_PAGE(page_mapped(page), page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1462 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1463 /* f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1464 * The page is expected to have page_count() == 3: f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1465 * - we hold a pin on it; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1466 * - one reference from radix tree; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1467 * - one from isolate_lru_page; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1468 */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1469 if (!page_ref_freeze(page, 3)) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1470 result = SCAN_PAGE_COUNT; 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1471 xa_unlock_irq(&mapping->i_pages); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1472 putback_lru_page(page); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1473 goto out_unlock; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1474 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1475 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1476 /* f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1477 * Add the page to the list to be able to undo the collapse if f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1478 * something go wrong. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1479 */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1480 list_add_tail(&page->lru, &pagelist); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1481 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1482 /* Finally, replace with the new page. */ b93b016313b3ba8 Matthew Wilcox 2018-04-10 1483 radix_tree_replace_slot(&mapping->i_pages, slot, f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1484 new_page + (index % HPAGE_PMD_NR)); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1485 148deab223b2373 Matthew Wilcox 2016-12-14 1486 slot = radix_tree_iter_resume(slot, &iter); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1487 index++; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1488 continue; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1489 out_unlock: f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1490 unlock_page(page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1491 put_page(page); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1492 goto tree_unlocked; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1493 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1494 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1495 /* f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1496 * Handle hole in radix tree at the end of the range. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1497 * This code only triggers if there's nothing in radix tree f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1498 * beyond 'end'. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1499 */ 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1500 if (index < end) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1501 int n = end - index; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1502 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1503 /* Stop if extent has been truncated, and is now empty */ 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1504 if (n >= HPAGE_PMD_NR) { 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1505 result = SCAN_TRUNCATED; 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1506 goto tree_locked; 8797f2f4fe0d555 Hugh Dickins 2018-11-30 1507 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1508 if (!shmem_charge(mapping->host, n)) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1509 result = SCAN_FAIL; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1510 goto tree_locked; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1511 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1512 for (; index < end; index++) { b93b016313b3ba8 Matthew Wilcox 2018-04-10 1513 radix_tree_insert(&mapping->i_pages, index, f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1514 new_page + (index % HPAGE_PMD_NR)); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1515 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1516 nr_none += n; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1517 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1518 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1519 __inc_node_page_state(new_page, NR_SHMEM_THPS); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1520 if (nr_none) { 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1521 struct zone *zone = page_zone(new_page); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1522 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1523 __mod_node_page_state(zone->zone_pgdat, NR_FILE_PAGES, nr_none); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1524 __mod_node_page_state(zone->zone_pgdat, NR_SHMEM, nr_none); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1525 } 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1526 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1527 tree_locked: b93b016313b3ba8 Matthew Wilcox 2018-04-10 1528 xa_unlock_irq(&mapping->i_pages); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1529 tree_unlocked: f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1530 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1531 if (result == SCAN_SUCCEED) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1532 /* f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1533 * Replacing old pages with new one has succeed, now we need to f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1534 * copy the content and free old pages. f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1535 */ ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1536 index = start; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1537 list_for_each_entry_safe(page, tmp, &pagelist, lru) { ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1538 while (index < page->index) { ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1539 clear_highpage(new_page + (index % HPAGE_PMD_NR)); ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1540 index++; ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1541 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1542 copy_highpage(new_page + (page->index % HPAGE_PMD_NR), f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1543 page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1544 list_del(&page->lru); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1545 page->mapping = NULL; 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1546 page_ref_unfreeze(page, 1); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1547 ClearPageActive(page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1548 ClearPageUnevictable(page); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1549 unlock_page(page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1550 put_page(page); ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1551 index++; ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1552 } ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1553 while (index < end) { ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1554 clear_highpage(new_page + (index % HPAGE_PMD_NR)); ee13d69bc1e8a55 Hugh Dickins 2018-11-30 1555 index++; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1556 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1557 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1558 SetPageUptodate(new_page); af24c01831e4e21 Hugh Dickins 2018-11-30 1559 page_ref_add(new_page, HPAGE_PMD_NR - 1); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1560 set_page_dirty(new_page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1561 mem_cgroup_commit_charge(new_page, memcg, false, true); 9d5425af85abe36 Chris Down 2021-06-30 1562 count_memcg_events(memcg, THP_COLLAPSE_ALLOC, 1); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1563 lru_cache_add_anon(new_page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1564 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1565 /* 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1566 * Remove pte page tables, so we can re-fault the page as huge. 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1567 */ 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1568 retract_page_tables(mapping, start); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1569 *hpage = NULL; 87aa752906ecf69 Yang Shi 2018-08-17 1570 87aa752906ecf69 Yang Shi 2018-08-17 1571 khugepaged_pages_collapsed++; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1572 } else { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1573 /* Something went wrong: rollback changes to the radix-tree */ b93b016313b3ba8 Matthew Wilcox 2018-04-10 1574 xa_lock_irq(&mapping->i_pages); 78141aabfbb9560 Hugh Dickins 2018-11-30 1575 mapping->nrpages -= nr_none; 78141aabfbb9560 Hugh Dickins 2018-11-30 1576 shmem_uncharge(mapping->host, nr_none); 78141aabfbb9560 Hugh Dickins 2018-11-30 1577 b93b016313b3ba8 Matthew Wilcox 2018-04-10 1578 radix_tree_for_each_slot(slot, &mapping->i_pages, &iter, start) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1579 if (iter.index >= end) f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1580 break; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1581 page = list_first_entry_or_null(&pagelist, f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1582 struct page, lru); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1583 if (!page || iter.index < page->index) { f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1584 if (!nr_none) f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1585 break; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1586 nr_none--; 59749e6ce53735d Johannes Weiner 2016-12-12 1587 /* Put holes back where they were */ b93b016313b3ba8 Matthew Wilcox 2018-04-10 1588 radix_tree_delete(&mapping->i_pages, iter.index); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1589 continue; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1590 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1591 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1592 VM_BUG_ON_PAGE(page->index != iter.index, page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1593 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1594 /* Unfreeze the page. */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1595 list_del(&page->lru); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1596 page_ref_unfreeze(page, 2); b93b016313b3ba8 Matthew Wilcox 2018-04-10 1597 radix_tree_replace_slot(&mapping->i_pages, slot, page); 148deab223b2373 Matthew Wilcox 2016-12-14 1598 slot = radix_tree_iter_resume(slot, &iter); b93b016313b3ba8 Matthew Wilcox 2018-04-10 1599 xa_unlock_irq(&mapping->i_pages); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1600 unlock_page(page); 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1601 putback_lru_page(page); b93b016313b3ba8 Matthew Wilcox 2018-04-10 1602 xa_lock_irq(&mapping->i_pages); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1603 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1604 VM_BUG_ON(nr_none); b93b016313b3ba8 Matthew Wilcox 2018-04-10 1605 xa_unlock_irq(&mapping->i_pages); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1606 f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1607 mem_cgroup_cancel_charge(new_page, memcg, true); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1608 new_page->mapping = NULL; f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1609 } 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1610 3e9646c76cb91d6 Hugh Dickins 2018-11-30 1611 unlock_page(new_page); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1612 out: f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1613 VM_BUG_ON(!list_empty(&pagelist)); f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1614 /* TODO: tracepoints */ f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1615 } f3f0e1d2150b2b9 Kirill A. Shutemov 2016-07-26 1616 :::::: The code at line 1336 was first introduced by commit :::::: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 khugepaged: add support of collapse for tmpfs/shmem pages :::::: TO: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/maccess.c:64:6: warning: no previous prototype for '__probe_user_read'
by kernel test robot 09 Feb '25

09 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 5c5bac1227aee80ee106ec07b32c981558049304 [1418/1418] uaccess: Add non-pagefault user-space read functions config: x86_64-buildonly-randconfig-001-20250207 (https://download.01.org/0day-ci/archive/20250209/202502090137.3KkiIJ8x-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250209/202502090137.3KkiIJ8x-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502090137.3KkiIJ8x-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/maccess.c:64:6: warning: no previous prototype for '__probe_user_read' [-Wmissing-prototypes] 64 | long __probe_user_read(void *dst, const void __user *src, size_t size) | ^~~~~~~~~~~~~~~~~ vim +/__probe_user_read +64 mm/maccess.c 50 51 /** 52 * probe_user_read(): safely attempt to read from a user-space location 53 * @dst: pointer to the buffer that shall take the data 54 * @src: address to read from. This must be a user address. 55 * @size: size of the data chunk 56 * 57 * Safely read from user address @src to the buffer at @dst. If a kernel fault 58 * happens, handle that and return -EFAULT. 59 */ 60 61 long __weak probe_user_read(void *dst, const void __user *src, size_t size) 62 __attribute__((alias("__probe_user_read"))); 63 > 64 long __probe_user_read(void *dst, const void __user *src, size_t size) 65 { 66 long ret = -EFAULT; 67 mm_segment_t old_fs = get_fs(); 68 69 set_fs(USER_DS); 70 if (access_ok(src, size)) 71 ret = probe_read_common(dst, src, size); 72 set_fs(old_fs); 73 74 return ret; 75 } 76 EXPORT_SYMBOL_GPL(probe_user_read); 77 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION cc7cb040bd0afe96f1da94c9f21eda5a986510a5
by kernel test robot 09 Feb '25

09 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 !15017 spi: mpc52xx: Add cancel_work_sync before module remove Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502082031.V2tZWUQg-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502082225.bZGoGhTq-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502082245.oXwKH6sI-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502082355.jrzYRRaD-lkp@intel.com include/linux/thread_info.h:59:17: warning: 'ctl' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'from' may be used uninitialized [-Wmaybe-uninitialized] mm/.tmp_ioremap.o: warning: objtool: missing symbol for section .text mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] mm/kasan/kasan_init.c:328:16: warning: variable 'p4d' set but not used [-Wunused-but-set-variable] mm/memcontrol.c:432:54: warning: array subscript nid is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] mm/memcontrol.c:5375: warning: bad line: | 0, otherwise. Unverified Error/Warning (likely false positive, kindly check if interested): drivers/mtd/spi-nor/fsl-quadspi.c:909:9: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/usb/mtu3/mtu3_qmu.c:297:26: sparse: sparse: incorrect type in assignment (different base types) kernel/trace/ftrace.c:295:49: sparse: sparse: incorrect type in argument 1 (different address spaces) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len | |-- include-asm-generic-bitops-non-atomic.h:warning:array-subscript-long-unsigned-int-is-partly-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized | |-- include-net-netns-generic.h:warning:array-subscript-id-is-outside-array-bounds-of-void | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized | |-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used | `-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node |-- arm64-allnoconfig | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250207 | `-- mm-kasan-kasan_init.c:warning:variable-p4d-set-but-not-used |-- arm64-randconfig-001-20250208 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-list.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-tmp-in-((struct-list_head-)lip)-.prev | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-plist.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | `-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized |-- arm64-randconfig-002-20250207 | `-- mm-memcontrol.c:warning:array-subscript-nid-is-outside-array-bounds-of-struct-mem_cgroup_per_node |-- arm64-randconfig-002-20250208 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250208 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250208 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-r131-20250208 | |-- drivers-mtd-spi-nor-fsl-quadspi.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-got-void-noderef-__iomem | |-- drivers-usb-mtu3-mtu3_qmu.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-char-usertype-rx_ext_addr-got-restricted-__le16-usertype | |-- include-linux-uaccess.h:warning:from-may-be-used-uninitialized | `-- kernel-trace-ftrace.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-ftrace_ops-ops-got-struct-ftrace_ops-noderef-__rcu-static-toplevel-ftrace_ops_list |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-001-20250207 | `-- mm-memcontrol.c:warning:bad-line:otherwise. |-- x86_64-buildonly-randconfig-002-20250208 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-thread_info.h:warning:ctl-may-be-used-uninitialized | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-003-20250207 | `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- x86_64-buildonly-randconfig-004-20250207 | `-- mm-.tmp_ioremap.o:warning:objtool:missing-symbol-for-section-.text `-- x86_64-defconfig |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast `-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 738m configs tested: 10 configs skipped: 108 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250208 gcc-14.2.0 arm64 randconfig-002-20250208 gcc-14.2.0 arm64 randconfig-003-20250208 gcc-14.2.0 arm64 randconfig-004-20250208 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-002-20250208 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1421/1421] include/linux/thread_info.h:59:17: warning: 'ctl' may be used uninitialized
by kernel test robot 08 Feb '25

08 Feb '25

Hi Jens, FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: c6e864fee7c3dd416048d129997c7def53cb9ed8 [1421/1421] net: separate out the msghdr copy from ___sys_{send,recv}msg() config: x86_64-buildonly-randconfig-002-20250208 (https://download.01.org/0day-ci/archive/20250208/202502082355.jrzYRRaD-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082355.jrzYRRaD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082355.jrzYRRaD-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In function '__sock_release', inlined from 'sock_close' at net/socket.c:1140:2: net/socket.c:579:21: warning: array subscript -1 is outside array bounds of 'struct inode[9078122083518480]' [-Warray-bounds] 579 | sock->ops->release(sock); | ~~~~^~~~~ net/socket.c:580:26: warning: array subscript -1 is outside array bounds of 'struct inode[9078122083518480]' [-Warray-bounds] 580 | sock->sk = NULL; In file included from arch/x86/include/asm/preempt.h:7, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/mmzone.h:9, from include/linux/gfp.h:6, from include/linux/mm.h:11, from net/socket.c:61: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from '____sys_sendmsg' at net/socket.c:2110:7: >> include/linux/thread_info.h:59:17: warning: 'ctl' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function '____sys_sendmsg': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ net/socket.c:2075:23: note: 'ctl' declared here 2075 | unsigned char ctl[sizeof(struct cmsghdr) + 20] | ^~~ In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from '__do_sys_socketcall' at net/socket.c:2618:6, inlined from '__se_sys_socketcall' at net/socket.c:2602:1: include/linux/thread_info.h:59:17: warning: 'a' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function '__se_sys_socketcall': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ net/socket.c:2604:23: note: 'a' declared here 2604 | unsigned long a[AUDITSC_ARGS]; | ^ net/socket.c:573: warning: Function parameter or member 'inode' not described in '__sock_release' vim +/ctl +59 include/linux/thread_info.h 0f60a8efe4005a Kees Cook 2016-07-12 50 f5509cc18daa7f Kees Cook 2016-06-07 51 #ifdef CONFIG_HARDENED_USERCOPY f5509cc18daa7f Kees Cook 2016-06-07 52 extern void __check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 53 bool to_user); f5509cc18daa7f Kees Cook 2016-06-07 54 a85d6b8242dc78 Kees Cook 2016-09-07 55 static __always_inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 56 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 57 { 81409e9e280588 Kees Cook 2016-08-31 58 if (!__builtin_constant_p(n)) f5509cc18daa7f Kees Cook 2016-06-07 @59 __check_object_size(ptr, n, to_user); f5509cc18daa7f Kees Cook 2016-06-07 60 } f5509cc18daa7f Kees Cook 2016-06-07 61 #else f5509cc18daa7f Kees Cook 2016-06-07 62 static inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 63 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 64 { } f5509cc18daa7f Kees Cook 2016-06-07 65 #endif /* CONFIG_HARDENED_USERCOPY */ f5509cc18daa7f Kees Cook 2016-06-07 66 :::::: The code at line 59 was first introduced by commit :::::: f5509cc18daa7f82bcc553be70df2117c8eedc16 mm: Hardened usercopy :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2722/2722] fs/ceph/snap.o: warning: objtool: ceph_update_snap_trace()+0xb8c: unreachable instruction
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 263072f655dcd6fd63f7d5dd1f9c5553134982fa commit: 4925e6790b8bb3d912820724a224fbe9bf7ad4cf [2722/2722] ceph: blocklist the kclient when receiving corrupted snap trace config: x86_64-buildonly-randconfig-002-20250205 (https://download.01.org/0day-ci/archive/20250208/202502082313.lZnwkvkI-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082313.lZnwkvkI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082313.lZnwkvkI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ceph/snap.o: warning: objtool: ceph_update_snap_trace()+0xb8c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2729/2729] mm/damon/core-test.h:284:2: warning: comparison of distinct pointer types ('typeof (__left) *' (aka 'unsigned int *') and 'typeof (__right) *' (aka 'int *'))
by kernel test robot 08 Feb '25

08 Feb '25

Hi SeongJae, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 263072f655dcd6fd63f7d5dd1f9c5553134982fa commit: 83b931be40b2829e20f38356509d8706ea6b6238 [2729/2729] mm/damon/core-test: test damon_set_regions config: x86_64-buildonly-randconfig-004-20250208 (https://download.01.org/0day-ci/archive/20250208/202502082340.S6mQ2xsd-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082340.S6mQ2xsd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082340.S6mQ2xsd-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/damon/core.c:13: In file included from include/linux/mm.h:1573: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/damon/core.c:1248: >> mm/damon/core-test.h:284:2: warning: comparison of distinct pointer types ('typeof (__left) *' (aka 'unsigned int *') and 'typeof (__right) *' (aka 'int *')) [-Wcompare-distinct-pointer-types] 284 | KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:1234:2: note: expanded from macro 'KUNIT_EXPECT_EQ' 1234 | KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:871:2: note: expanded from macro 'KUNIT_BINARY_EQ_ASSERTION' 871 | KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 872 | assert_type, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 873 | left, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 874 | right, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 875 | NULL) | ~~~~~ include/kunit/test.h:861:2: note: expanded from macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' 861 | KUNIT_BASE_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 862 | kunit_binary_assert, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 863 | KUNIT_INIT_BINARY_ASSERT_STRUCT, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 864 | assert_type, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 865 | left, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 866 | right, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 867 | fmt, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 868 | ##__VA_ARGS__) | ~~~~~~~~~~~~~~ include/kunit/test.h:772:2: note: expanded from macro 'KUNIT_BASE_EQ_MSG_ASSERTION' 772 | KUNIT_BASE_BINARY_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 773 | assert_class, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 774 | ASSERT_CLASS_INIT, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 775 | assert_type, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 776 | left, ==, right, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 777 | fmt, \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 778 | ##__VA_ARGS__) | ~~~~~~~~~~~~~~ include/kunit/test.h:748:9: note: expanded from macro 'KUNIT_BASE_BINARY_ASSERTION' 748 | ((void)__typecheck(__left, __right)); \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/minmax.h:20:28: note: expanded from macro '__typecheck' 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ 2 warnings generated. vim +284 mm/damon/core-test.h 269 270 static void damon_test_set_regions(struct kunit *test) 271 { 272 struct damon_target *t = damon_new_target(); 273 struct damon_region *r1 = damon_new_region(4, 16); 274 struct damon_region *r2 = damon_new_region(24, 32); 275 struct damon_addr_range range = {.start = 8, .end = 28}; 276 unsigned long expects[] = {8, 16, 16, 24, 24, 28}; 277 int expect_idx = 0; 278 struct damon_region *r; 279 280 damon_add_region(r1, t); 281 damon_add_region(r2, t); 282 damon_set_regions(t, &range, 1); 283 > 284 KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); 285 damon_for_each_region(r, t) { 286 KUNIT_EXPECT_EQ(test, r->ar.start, expects[expect_idx++]); 287 KUNIT_EXPECT_EQ(test, r->ar.end, expects[expect_idx++]); 288 } 289 damon_destroy_target(t); 290 } 291 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1418/1418] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-003-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082245.oXwKH6sI-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082245.oXwKH6sI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082245.oXwKH6sI-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/hugetlb.c:13: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/hugetlb.c:35: include/linux/mm_inline.h:33:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 33 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:35:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 35 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ mm/hugetlb.c:1370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ | static In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 5 warnings generated. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/.tmp_ioremap.o: warning: objtool: missing symbol for section .text
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: 004cface9c1c0b6351473934a4ce452193e05b07 [1418/1418] mm: Move vmap_range from mm/ioremap.c to mm/vmalloc.c config: x86_64-buildonly-randconfig-004-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082225.bZGoGhTq-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082225.bZGoGhTq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082225.bZGoGhTq-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/.tmp_ioremap.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1899/1899] mm/memcontrol.c:4428:12: warning: 'mem_cgroup_check_swap_for_v1' defined but not used
by kernel test robot 08 Feb '25

08 Feb '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 96ebabc25b2677a2a225de204946e424cf3887c1 commit: a095a940f784db58ea4e87df361f9a4fd0dd977f [1899/1899] memcg: add restrict to swap to cgroup1 config: x86_64-buildonly-randconfig-001-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082247.kdBxrDeT-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082247.kdBxrDeT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082247.kdBxrDeT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:4428:12: warning: 'mem_cgroup_check_swap_for_v1' defined but not used [-Wunused-function] 4428 | static int mem_cgroup_check_swap_for_v1(struct folio *folio, swp_entry_t entry) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/mem_cgroup_check_swap_for_v1 +4428 mm/memcontrol.c 4427 > 4428 static int mem_cgroup_check_swap_for_v1(struct folio *folio, swp_entry_t entry) 4429 { 4430 return 0; 4431 } 4432 #endif 4433 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/memcontrol.c:432:54: warning: array subscript nid is outside array bounds of 'struct mem_cgroup_per_node *[0]'
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cc7cb040bd0afe96f1da94c9f21eda5a986510a5 commit: fae91d6d8be5e20c47e459dbeb3d43bd5f9486f4 [1418/1418] mm/list_lru.c: set bit in memcg shrinker bitmap on first list_lru item appearance config: arm64-randconfig-002-20250207 (https://download.01.org/0day-ci/archive/20250208/202502082031.V2tZWUQg-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502082031.V2tZWUQg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502082031.V2tZWUQg-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/page_counter.h:6, from mm/memcontrol.c:34: mm/memcontrol.c: In function 'mem_cgroup_get_max': include/linux/kernel.h:845:45: warning: comparison of unsigned expression in '< 0' is always false [-Wtype-limits] 845 | #define min(x, y) __careful_cmp(x, y, <) | ^ include/linux/kernel.h:828:30: note: in definition of macro '__cmp' 828 | #define __cmp(x, y, op) ((x) op (y) ? (x) : (y)) | ^~ include/linux/kernel.h:845:25: note: in expansion of macro '__careful_cmp' 845 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ mm/memcontrol.c:1365:28: note: in expansion of macro 'min' 1365 | swap_max = min(swap_max, (unsigned long)total_swap_pages); | ^~~ In file included from mm/memcontrol.c:35: In function 'mem_cgroup_nodeinfo', inlined from 'invalidate_reclaim_iterators' at mm/memcontrol.c:1042:9, inlined from 'mem_cgroup_css_released' at mm/memcontrol.c:4526:2: include/linux/memcontrol.h:352:31: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 352 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_css_released': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'free_mem_cgroup_per_node_info', inlined from '__mem_cgroup_free' at mm/memcontrol.c:4353:3: mm/memcontrol.c:4339:57: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 4339 | struct mem_cgroup_per_node *pn = memcg->nodeinfo[node]; | ~~~~~~~~~~~~~~~^~~~~~ include/linux/memcontrol.h: In function '__mem_cgroup_free': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'alloc_mem_cgroup_per_node_info', inlined from 'mem_cgroup_alloc' at mm/memcontrol.c:4388:7: mm/memcontrol.c:4333:24: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 4333 | memcg->nodeinfo[node] = pn; | ~~~~~~~~~~~~~~~^~~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_alloc': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In file included from include/linux/compiler.h:245, from arch/arm64/include/asm/atomic.h:23, from include/linux/atomic.h:7, from include/linux/page_counter.h:5: In function 'memcg_alloc_shrinker_maps', inlined from 'mem_cgroup_css_online' at mm/memcontrol.c:4485:6: mm/memcontrol.c:391:51: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 391 | rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_map, map); | ~~~~~~~~~~~~~~~^~~~~ arch/arm64/include/asm/barrier.h:95:42: note: in definition of macro '__smp_store_release' 95 | : "=Q" (*p) \ | ^ include/linux/rcupdate.h:411:17: note: in expansion of macro 'smp_store_release' 411 | smp_store_release(&p, RCU_INITIALIZER((typeof(p))_r_a_p__v)); \ | ^~~~~~~~~~~~~~~~~ mm/memcontrol.c:391:17: note: in expansion of macro 'rcu_assign_pointer' 391 | rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_map, map); | ^~~~~~~~~~~~~~~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_css_online': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ mm/memcontrol.c: In function 'memcg_set_shrinker_bit': >> mm/memcontrol.c:432:54: warning: array subscript nid is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 432 | map = rcu_dereference(memcg->nodeinfo[nid]->shrinker_map); | ~~~~~~~~~~~~~~~^~~~~ include/linux/compiler.h:252:36: note: in definition of macro '__READ_ONCE' 252 | __read_once_size(&(x), __u.__c, sizeof(x)); \ | ^ include/linux/rcupdate.h:349:55: note: in expansion of macro 'READ_ONCE' 349 | typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \ | ^~~~~~~~~ include/linux/rcupdate.h:486:9: note: in expansion of macro '__rcu_dereference_check' 486 | __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu) | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/rcupdate.h:544:28: note: in expansion of macro 'rcu_dereference_check' 544 | #define rcu_dereference(p) rcu_dereference_check(p, 0) | ^~~~~~~~~~~~~~~~~~~~~ mm/memcontrol.c:432:23: note: in expansion of macro 'rcu_dereference' 432 | map = rcu_dereference(memcg->nodeinfo[nid]->shrinker_map); | ^~~~~~~~~~~~~~~ include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'mem_cgroup_nodeinfo', inlined from 'mem_cgroup_lruvec' at include/linux/memcontrol.h:375:7, inlined from 'mem_cgroup_node_nr_lru_pages' at mm/memcontrol.c:722:26: include/linux/memcontrol.h:352:31: warning: array subscript <unknown> is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 352 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_node_nr_lru_pages': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ In function 'mem_cgroup_nodeinfo', inlined from 'mem_cgroup_iter' at mm/memcontrol.c:937:8: include/linux/memcontrol.h:352:31: warning: array subscript <unknown> is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 352 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h: In function 'mem_cgroup_iter': include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ mm/memcontrol.c: In function '__mem_cgroup_threshold': mm/memcontrol.c:3473:45: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3473 | for (; i >= 0 && unlikely(t->entries[i].threshold > usage); i--) | ~~~~~~~~~~^~~ include/linux/compiler.h:77:45: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3474:42: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3474 | eventfd_signal(t->entries[i].eventfd, 1); | ~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3485:50: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3485 | for (; i < t->size && unlikely(t->entries[i].threshold <= usage); i++) | ~~~~~~~~~~^~~ include/linux/compiler.h:77:45: note: in definition of macro 'unlikely' 77 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3486:42: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3486 | eventfd_signal(t->entries[i].eventfd, 1); | ~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c: In function 'memcg_check_events.isra': mm/memcontrol.c:502:31: warning: array subscript 0 is outside array bounds of 'struct mem_cgroup_per_node *[0]' [-Warray-bounds=] 502 | return memcg->nodeinfo[nid]; | ~~~~~~~~~~~~~~~^~~~~ include/linux/memcontrol.h:309:37: note: while referencing 'nodeinfo' 309 | struct mem_cgroup_per_node *nodeinfo[0]; | ^~~~~~~~ mm/memcontrol.c: In function '__mem_cgroup_usage_unregister_event': mm/memcontrol.c:3680:49: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3680 | if (thresholds->primary->entries[i].eventfd == eventfd) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3683:63: warning: array subscript i is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3683 | new->entries[j] = thresholds->primary->entries[i]; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3683:29: warning: array subscript j is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3683 | new->entries[j] = thresholds->primary->entries[i]; | ~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' 162 | struct mem_cgroup_threshold entries[0]; | ^~~~~~~ mm/memcontrol.c:3684:33: warning: array subscript j is outside array bounds of 'struct mem_cgroup_threshold[0]' [-Warray-bounds=] 3684 | if (new->entries[j].threshold <= usage) { | ~~~~~~~~~~~~^~~ include/linux/memcontrol.h:162:37: note: while referencing 'entries' vim +432 mm/memcontrol.c 373 374 static int memcg_alloc_shrinker_maps(struct mem_cgroup *memcg) 375 { 376 struct memcg_shrinker_map *map; 377 int nid, size, ret = 0; 378 379 if (mem_cgroup_is_root(memcg)) 380 return 0; 381 382 mutex_lock(&memcg_shrinker_map_mutex); 383 size = memcg_shrinker_map_size; 384 for_each_node(nid) { 385 map = kvzalloc(sizeof(*map) + size, GFP_KERNEL); 386 if (!map) { 387 memcg_free_shrinker_maps(memcg); 388 ret = -ENOMEM; 389 break; 390 } > 391 rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_map, map); 392 } 393 mutex_unlock(&memcg_shrinker_map_mutex); 394 395 return ret; 396 } 397 398 int memcg_expand_shrinker_maps(int new_id) 399 { 400 int size, old_size, ret = 0; 401 struct mem_cgroup *memcg; 402 403 size = DIV_ROUND_UP(new_id + 1, BITS_PER_LONG) * sizeof(unsigned long); 404 old_size = memcg_shrinker_map_size; 405 if (size <= old_size) 406 return 0; 407 408 mutex_lock(&memcg_shrinker_map_mutex); 409 if (!root_mem_cgroup) 410 goto unlock; 411 412 for_each_mem_cgroup(memcg) { 413 if (mem_cgroup_is_root(memcg)) 414 continue; 415 ret = memcg_expand_one_shrinker_map(memcg, size, old_size); 416 if (ret) 417 goto unlock; 418 } 419 unlock: 420 if (!ret) 421 memcg_shrinker_map_size = size; 422 mutex_unlock(&memcg_shrinker_map_mutex); 423 return ret; 424 } 425 426 void memcg_set_shrinker_bit(struct mem_cgroup *memcg, int nid, int shrinker_id) 427 { 428 if (shrinker_id >= 0 && memcg && !mem_cgroup_is_root(memcg)) { 429 struct memcg_shrinker_map *map; 430 431 rcu_read_lock(); > 432 map = rcu_dereference(memcg->nodeinfo[nid]->shrinker_map); 433 set_bit(shrinker_id, map->map); 434 rcu_read_unlock(); 435 } 436 } 437 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1899/1899] mm/dynamic_pool.c:1612:51: warning: variable 'ret' is uninitialized when used here
by kernel test robot 08 Feb '25

08 Feb '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8673e7441a723dd5e885e372a4d0351658286304 commit: cf98ffbc116bc49dc4506c68e20b02e26519ad35 [1899/1899] mm/dynamic_pool: fill dpool with pagelist config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250208/202502081751.f1v777Vf-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502081751.f1v777Vf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502081751.f1v777Vf-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/dynamic_pool.c:10: In file included from include/linux/memblock.h:12: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ mm/dynamic_pool.c:836:6: warning: variable 'type' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 836 | if (!dpool->online) | ^~~~~~~~~~~~~~ mm/dynamic_pool.c:865:36: note: uninitialized use occurs here 865 | trace_dpool_alloc_hugepage(dpool, type, folio, pool->free_huge_pages, | ^~~~ mm/dynamic_pool.c:836:2: note: remove the 'if' if its condition is always false 836 | if (!dpool->online) | ^~~~~~~~~~~~~~~~~~~ 837 | goto unlock; | ~~~~~~~~~~~ mm/dynamic_pool.c:826:10: note: initialize the variable 'type' to silence this warning 826 | int type; | ^ | = 0 mm/dynamic_pool.c:836:6: warning: variable 'pool' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] 836 | if (!dpool->online) | ^~~~~~~~~~~~~~ mm/dynamic_pool.c:865:49: note: uninitialized use occurs here 865 | trace_dpool_alloc_hugepage(dpool, type, folio, pool->free_huge_pages, | ^~~~ mm/dynamic_pool.c:836:2: note: remove the 'if' if its condition is always false 836 | if (!dpool->online) | ^~~~~~~~~~~~~~~~~~~ 837 | goto unlock; | ~~~~~~~~~~~ mm/dynamic_pool.c:823:25: note: initialize the variable 'pool' to silence this warning 823 | struct pages_pool *pool; | ^ | = NULL >> mm/dynamic_pool.c:1612:51: warning: variable 'ret' is uninitialized when used here [-Wuninitialized] 1612 | pr_err("init failed, create failed. ret: %d\n", ret); | ^~~ include/linux/printk.h:498:33: note: expanded from macro 'pr_err' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~~ include/linux/printk.h:455:60: note: expanded from macro 'printk' 455 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ include/linux/printk.h:427:19: note: expanded from macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ mm/dynamic_pool.c:1586:9: note: initialize the variable 'ret' to silence this warning 1586 | int ret; | ^ | = 0 8 warnings generated. vim +/ret +1612 mm/dynamic_pool.c 1582 1583 int dpool_init(struct dpool_info *arg) 1584 { 1585 struct dynamic_pool *dpool; 1586 int ret; 1587 1588 if (!dpool_enabled) 1589 return -EINVAL; 1590 1591 if (!arg || !arg->memcg || arg->range_cnt <= 0) { 1592 pr_err("init failed, arg is invalid\n"); 1593 return -EINVAL; 1594 } 1595 1596 mutex_lock(&dpool_mutex); 1597 1598 if (dpool_global_pool || arg->memcg->dpool) { 1599 pr_err("init failed, dpool is already exist\n"); 1600 ret = -EINVAL; 1601 goto unlock; 1602 } 1603 1604 if (!(arg->memcg->css.cgroup->self.flags & CSS_ONLINE)) { 1605 pr_err("init failed, memcg is not online\n"); 1606 ret = -EINVAL; 1607 goto unlock; 1608 } 1609 1610 dpool = dpool_create(arg->memcg, &pagelist_dpool_ops); 1611 if (!dpool) { > 1612 pr_err("init failed, create failed. ret: %d\n", ret); 1613 ret = -ENOMEM; 1614 goto unlock; 1615 } 1616 1617 dpool_global_pool = dpool; 1618 1619 BUG_ON(!dpool->ops->fill_pool); 1620 ret = dpool->ops->fill_pool(dpool, arg); 1621 if (ret) 1622 dpool_put(dpool); 1623 1624 unlock: 1625 mutex_unlock(&dpool_mutex); 1626 1627 return ret; 1628 } 1629 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2729/2729] mm/khugepaged.c:1646: warning: Function parameter or member 'reliable' not described in 'collapse_file'
by kernel test robot 08 Feb '25

08 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d446fe23ba300d0cceac22dff0e7e9a8d21646e1 commit: 6263994761a3d3ad6e5fa3beff9ca8cbd38d3bf3 [2729/2729] mm: thp: Add memory reliable support for hugepaged collapse config: x86_64-buildonly-randconfig-002-20250208 (https://download.01.org/0day-ci/archive/20250208/202502081316.Lfy85pbg-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502081316.Lfy85pbg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502081316.Lfy85pbg-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/khugepaged.c:102: warning: Function parameter or member 'nr_pte_mapped_thp' not described in 'mm_slot' mm/khugepaged.c:102: warning: Function parameter or member 'pte_mapped_thp' not described in 'mm_slot' mm/khugepaged.c:1443: warning: Function parameter or member 'mm' not described in 'collapse_pte_mapped_thp' mm/khugepaged.c:1443: warning: Function parameter or member 'addr' not described in 'collapse_pte_mapped_thp' mm/khugepaged.c:1646: warning: Function parameter or member 'mm' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'file' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'start' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'hpage' not described in 'collapse_file' mm/khugepaged.c:1646: warning: Function parameter or member 'node' not described in 'collapse_file' >> mm/khugepaged.c:1646: warning: Function parameter or member 'reliable' not described in 'collapse_file' vim +1646 mm/khugepaged.c f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1623 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1624 /** 99cb0dbd47a15d Song Liu 2019-09-23 1625 * collapse_file - collapse filemap/tmpfs/shmem pages into huge one. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1626 * f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1627 * Basic scheme is simple, details are more complex: 87c460a0bded56 Hugh Dickins 2018-11-30 1628 * - allocate and lock a new huge page; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1629 * - scan page cache replacing old pages with the new one 99cb0dbd47a15d Song Liu 2019-09-23 1630 * + swap/gup in pages if necessary; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1631 * + fill in gaps; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1632 * + keep old pages around in case rollback is required; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1633 * - if replacing succeeds: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1634 * + copy data over; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1635 * + free old pages; 87c460a0bded56 Hugh Dickins 2018-11-30 1636 * + unlock huge page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1637 * - if replacing failed; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1638 * + put all pages back and unfreeze them; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1639 * + restore gaps in the page cache; 87c460a0bded56 Hugh Dickins 2018-11-30 1640 * + unlock and free huge page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1641 */ 579c571e2efdb8 Song Liu 2019-09-23 1642 static void collapse_file(struct mm_struct *mm, 579c571e2efdb8 Song Liu 2019-09-23 1643 struct file *file, pgoff_t start, 6263994761a3d3 Ma Wupeng 2022-11-11 1644 struct page **hpage, int node, 6263994761a3d3 Ma Wupeng 2022-11-11 1645 bool reliable) f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 @1646 { 579c571e2efdb8 Song Liu 2019-09-23 1647 struct address_space *mapping = file->f_mapping; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1648 gfp_t gfp; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1649 struct page *new_page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1650 pgoff_t index, end = start + HPAGE_PMD_NR; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1651 LIST_HEAD(pagelist); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1652 XA_STATE_ORDER(xas, &mapping->i_pages, start, HPAGE_PMD_ORDER); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1653 int nr_none = 0, result = SCAN_SUCCEED; 99cb0dbd47a15d Song Liu 2019-09-23 1654 bool is_shmem = shmem_file(file); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1655 99cb0dbd47a15d Song Liu 2019-09-23 1656 VM_BUG_ON(!IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && !is_shmem); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1657 VM_BUG_ON(start & (HPAGE_PMD_NR - 1)); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1658 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1659 /* Only allocate from the target node */ 41b6167e8f746b Michal Hocko 2017-01-10 1660 gfp = alloc_hugepage_khugepaged_gfpmask() | __GFP_THISNODE; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1661 6263994761a3d3 Ma Wupeng 2022-11-11 1662 if (reliable) 6263994761a3d3 Ma Wupeng 2022-11-11 1663 gfp |= GFP_RELIABLE; 6263994761a3d3 Ma Wupeng 2022-11-11 1664 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1665 new_page = khugepaged_alloc_page(hpage, gfp, node); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1666 if (!new_page) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1667 result = SCAN_ALLOC_HUGE_PAGE_FAIL; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1668 goto out; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1669 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1670 d9eb1ea2bf8734 Johannes Weiner 2020-06-03 1671 if (unlikely(mem_cgroup_charge(new_page, mm, gfp))) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1672 result = SCAN_CGROUP_CHARGE_FAIL; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1673 goto out; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1674 } 9d82c69438d0df Johannes Weiner 2020-06-03 1675 count_memcg_page_event(new_page, THP_COLLAPSE_ALLOC); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1676 95feeabb77149f Hugh Dickins 2018-11-30 1677 /* This will be less messy when we use multi-index entries */ 95feeabb77149f Hugh Dickins 2018-11-30 1678 do { 95feeabb77149f Hugh Dickins 2018-11-30 1679 xas_lock_irq(&xas); 95feeabb77149f Hugh Dickins 2018-11-30 1680 xas_create_range(&xas); 95feeabb77149f Hugh Dickins 2018-11-30 1681 if (!xas_error(&xas)) 95feeabb77149f Hugh Dickins 2018-11-30 1682 break; 95feeabb77149f Hugh Dickins 2018-11-30 1683 xas_unlock_irq(&xas); 95feeabb77149f Hugh Dickins 2018-11-30 1684 if (!xas_nomem(&xas, GFP_KERNEL)) { 95feeabb77149f Hugh Dickins 2018-11-30 1685 result = SCAN_FAIL; 95feeabb77149f Hugh Dickins 2018-11-30 1686 goto out; 95feeabb77149f Hugh Dickins 2018-11-30 1687 } 95feeabb77149f Hugh Dickins 2018-11-30 1688 } while (1); 95feeabb77149f Hugh Dickins 2018-11-30 1689 042a30824871fa Hugh Dickins 2018-11-30 1690 __SetPageLocked(new_page); 99cb0dbd47a15d Song Liu 2019-09-23 1691 if (is_shmem) 042a30824871fa Hugh Dickins 2018-11-30 1692 __SetPageSwapBacked(new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1693 new_page->index = start; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1694 new_page->mapping = mapping; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1695 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1696 /* 87c460a0bded56 Hugh Dickins 2018-11-30 1697 * At this point the new_page is locked and not up-to-date. 87c460a0bded56 Hugh Dickins 2018-11-30 1698 * It's safe to insert it into the page cache, because nobody would 87c460a0bded56 Hugh Dickins 2018-11-30 1699 * be able to map it or use it in another way until we unlock it. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1700 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1701 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1702 xas_set(&xas, start); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1703 for (index = start; index < end; index++) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1704 struct page *page = xas_next(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1705 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1706 VM_BUG_ON(index != xas.xa_index); 99cb0dbd47a15d Song Liu 2019-09-23 1707 if (is_shmem) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1708 if (!page) { 701270fa193aad Hugh Dickins 2018-11-30 1709 /* 99cb0dbd47a15d Song Liu 2019-09-23 1710 * Stop if extent has been truncated or 99cb0dbd47a15d Song Liu 2019-09-23 1711 * hole-punched, and is now completely 99cb0dbd47a15d Song Liu 2019-09-23 1712 * empty. 701270fa193aad Hugh Dickins 2018-11-30 1713 */ 701270fa193aad Hugh Dickins 2018-11-30 1714 if (index == start) { 701270fa193aad Hugh Dickins 2018-11-30 1715 if (!xas_next_entry(&xas, end - 1)) { 701270fa193aad Hugh Dickins 2018-11-30 1716 result = SCAN_TRUNCATED; 042a30824871fa Hugh Dickins 2018-11-30 1717 goto xa_locked; 701270fa193aad Hugh Dickins 2018-11-30 1718 } 701270fa193aad Hugh Dickins 2018-11-30 1719 xas_set(&xas, index); 701270fa193aad Hugh Dickins 2018-11-30 1720 } 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1721 if (!shmem_charge(mapping->host, 1)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1722 result = SCAN_FAIL; 042a30824871fa Hugh Dickins 2018-11-30 1723 goto xa_locked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1724 } 4101196b19d7f9 Matthew Wilcox (Oracle 2019-09-23 1725) xas_store(&xas, new_page); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1726 nr_none++; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1727 continue; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1728 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1729 3159f943aafdba Matthew Wilcox 2017-11-03 1730 if (xa_is_value(page) || !PageUptodate(page)) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1731 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1732 /* swap in or instantiate fallocated page */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1733 if (shmem_getpage(mapping->host, index, &page, f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1734 SGP_NOHUGE)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1735 result = SCAN_FAIL; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1736 goto xa_unlocked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1737 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1738 } else if (trylock_page(page)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1739 get_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1740 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1741 } else { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1742 result = SCAN_PAGE_LOCK; 042a30824871fa Hugh Dickins 2018-11-30 1743 goto xa_locked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1744 } 99cb0dbd47a15d Song Liu 2019-09-23 1745 } else { /* !is_shmem */ 99cb0dbd47a15d Song Liu 2019-09-23 1746 if (!page || xa_is_value(page)) { 99cb0dbd47a15d Song Liu 2019-09-23 1747 xas_unlock_irq(&xas); 99cb0dbd47a15d Song Liu 2019-09-23 1748 page_cache_sync_readahead(mapping, &file->f_ra, 99cb0dbd47a15d Song Liu 2019-09-23 1749 file, index, e5a59d308f52bb David Howells 2020-09-04 1750 end - index); 99cb0dbd47a15d Song Liu 2019-09-23 1751 /* drain pagevecs to help isolate_lru_page() */ 99cb0dbd47a15d Song Liu 2019-09-23 1752 lru_add_drain(); 99cb0dbd47a15d Song Liu 2019-09-23 1753 page = find_lock_page(mapping, index); 99cb0dbd47a15d Song Liu 2019-09-23 1754 if (unlikely(page == NULL)) { 99cb0dbd47a15d Song Liu 2019-09-23 1755 result = SCAN_FAIL; 99cb0dbd47a15d Song Liu 2019-09-23 1756 goto xa_unlocked; 99cb0dbd47a15d Song Liu 2019-09-23 1757 } 75f360696ce9d8 Song Liu 2019-11-30 1758 } else if (PageDirty(page)) { 75f360696ce9d8 Song Liu 2019-11-30 1759 /* 75f360696ce9d8 Song Liu 2019-11-30 1760 * khugepaged only works on read-only fd, 75f360696ce9d8 Song Liu 2019-11-30 1761 * so this page is dirty because it hasn't 75f360696ce9d8 Song Liu 2019-11-30 1762 * been flushed since first write. There 75f360696ce9d8 Song Liu 2019-11-30 1763 * won't be new dirty pages. 75f360696ce9d8 Song Liu 2019-11-30 1764 * 75f360696ce9d8 Song Liu 2019-11-30 1765 * Trigger async flush here and hope the 75f360696ce9d8 Song Liu 2019-11-30 1766 * writeback is done when khugepaged 75f360696ce9d8 Song Liu 2019-11-30 1767 * revisits this page. 75f360696ce9d8 Song Liu 2019-11-30 1768 * 75f360696ce9d8 Song Liu 2019-11-30 1769 * This is a one-off situation. We are not 75f360696ce9d8 Song Liu 2019-11-30 1770 * forcing writeback in loop. 75f360696ce9d8 Song Liu 2019-11-30 1771 */ 75f360696ce9d8 Song Liu 2019-11-30 1772 xas_unlock_irq(&xas); 75f360696ce9d8 Song Liu 2019-11-30 1773 filemap_flush(mapping); 75f360696ce9d8 Song Liu 2019-11-30 1774 result = SCAN_FAIL; 75f360696ce9d8 Song Liu 2019-11-30 1775 goto xa_unlocked; ca1ab8b4a53297 Rongwei Wang 2021-11-15 1776 } else if (PageWriteback(page)) { ca1ab8b4a53297 Rongwei Wang 2021-11-15 1777 xas_unlock_irq(&xas); ca1ab8b4a53297 Rongwei Wang 2021-11-15 1778 result = SCAN_FAIL; ca1ab8b4a53297 Rongwei Wang 2021-11-15 1779 goto xa_unlocked; 99cb0dbd47a15d Song Liu 2019-09-23 1780 } else if (trylock_page(page)) { 99cb0dbd47a15d Song Liu 2019-09-23 1781 get_page(page); 99cb0dbd47a15d Song Liu 2019-09-23 1782 xas_unlock_irq(&xas); 99cb0dbd47a15d Song Liu 2019-09-23 1783 } else { 99cb0dbd47a15d Song Liu 2019-09-23 1784 result = SCAN_PAGE_LOCK; 99cb0dbd47a15d Song Liu 2019-09-23 1785 goto xa_locked; 99cb0dbd47a15d Song Liu 2019-09-23 1786 } 99cb0dbd47a15d Song Liu 2019-09-23 1787 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1788 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1789 /* b93b016313b3ba Matthew Wilcox 2018-04-10 1790 * The page must be locked, so we can drop the i_pages lock f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1791 * without racing with truncate. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1792 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1793 VM_BUG_ON_PAGE(!PageLocked(page), page); 4655e5e5f38726 Song Liu 2019-11-15 1794 4655e5e5f38726 Song Liu 2019-11-15 1795 /* make sure the page is up to date */ 4655e5e5f38726 Song Liu 2019-11-15 1796 if (unlikely(!PageUptodate(page))) { 4655e5e5f38726 Song Liu 2019-11-15 1797 result = SCAN_FAIL; 4655e5e5f38726 Song Liu 2019-11-15 1798 goto out_unlock; 4655e5e5f38726 Song Liu 2019-11-15 1799 } 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1800 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1801 /* 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1802 * If file was truncated then extended, or hole-punched, before 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1803 * we locked the first page, then a THP might be there already. 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1804 */ 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1805 if (PageTransCompound(page)) { 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1806 result = SCAN_PAGE_COMPOUND; 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1807 goto out_unlock; 06a5e1268a5fb9 Hugh Dickins 2018-11-30 1808 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1809 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1810 if (page_mapping(page) != mapping) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1811 result = SCAN_TRUNCATED; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1812 goto out_unlock; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1813 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1814 ca1ab8b4a53297 Rongwei Wang 2021-11-15 1815 if (!is_shmem && (PageDirty(page) || ca1ab8b4a53297 Rongwei Wang 2021-11-15 1816 PageWriteback(page))) { 4655e5e5f38726 Song Liu 2019-11-15 1817 /* 4655e5e5f38726 Song Liu 2019-11-15 1818 * khugepaged only works on read-only fd, so this 4655e5e5f38726 Song Liu 2019-11-15 1819 * page is dirty because it hasn't been flushed 4655e5e5f38726 Song Liu 2019-11-15 1820 * since first write. 4655e5e5f38726 Song Liu 2019-11-15 1821 */ 4655e5e5f38726 Song Liu 2019-11-15 1822 result = SCAN_FAIL; 4655e5e5f38726 Song Liu 2019-11-15 1823 goto out_unlock; 4655e5e5f38726 Song Liu 2019-11-15 1824 } 4655e5e5f38726 Song Liu 2019-11-15 1825 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1826 if (isolate_lru_page(page)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1827 result = SCAN_DEL_PAGE_LRU; 042a30824871fa Hugh Dickins 2018-11-30 1828 goto out_unlock; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1829 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1830 99cb0dbd47a15d Song Liu 2019-09-23 1831 if (page_has_private(page) && 99cb0dbd47a15d Song Liu 2019-09-23 1832 !try_to_release_page(page, GFP_KERNEL)) { 99cb0dbd47a15d Song Liu 2019-09-23 1833 result = SCAN_PAGE_HAS_PRIVATE; 2f33a706027c94 Hugh Dickins 2020-05-27 1834 putback_lru_page(page); 99cb0dbd47a15d Song Liu 2019-09-23 1835 goto out_unlock; 99cb0dbd47a15d Song Liu 2019-09-23 1836 } 99cb0dbd47a15d Song Liu 2019-09-23 1837 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1838 if (page_mapped(page)) 977fbdcd5986c9 Matthew Wilcox 2018-01-31 1839 unmap_mapping_pages(mapping, index, 1, false); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1840 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1841 xas_lock_irq(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1842 xas_set(&xas, index); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1843 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1844 VM_BUG_ON_PAGE(page != xas_load(&xas), page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1845 VM_BUG_ON_PAGE(page_mapped(page), page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1846 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1847 /* f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1848 * The page is expected to have page_count() == 3: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1849 * - we hold a pin on it; 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1850 * - one reference from page cache; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1851 * - one from isolate_lru_page; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1852 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1853 if (!page_ref_freeze(page, 3)) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1854 result = SCAN_PAGE_COUNT; 042a30824871fa Hugh Dickins 2018-11-30 1855 xas_unlock_irq(&xas); 042a30824871fa Hugh Dickins 2018-11-30 1856 putback_lru_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1857 goto out_unlock; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1858 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1859 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1860 /* f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1861 * Add the page to the list to be able to undo the collapse if f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1862 * something go wrong. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1863 */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1864 list_add_tail(&page->lru, &pagelist); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1865 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1866 /* Finally, replace with the new page. */ 4101196b19d7f9 Matthew Wilcox (Oracle 2019-09-23 1867) xas_store(&xas, new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1868 continue; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1869 out_unlock: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1870 unlock_page(page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1871 put_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1872 goto xa_unlocked; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1873 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1874 99cb0dbd47a15d Song Liu 2019-09-23 1875 if (is_shmem) 042a30824871fa Hugh Dickins 2018-11-30 1876 __inc_node_page_state(new_page, NR_SHMEM_THPS); 09d91cda0e8207 Song Liu 2019-09-23 1877 else { 99cb0dbd47a15d Song Liu 2019-09-23 1878 __inc_node_page_state(new_page, NR_FILE_THPS); 09d91cda0e8207 Song Liu 2019-09-23 1879 filemap_nr_thps_inc(mapping); 09d91cda0e8207 Song Liu 2019-09-23 1880 } 99cb0dbd47a15d Song Liu 2019-09-23 1881 042a30824871fa Hugh Dickins 2018-11-30 1882 if (nr_none) { 9d82c69438d0df Johannes Weiner 2020-06-03 1883 __mod_lruvec_page_state(new_page, NR_FILE_PAGES, nr_none); 99cb0dbd47a15d Song Liu 2019-09-23 1884 if (is_shmem) 9d82c69438d0df Johannes Weiner 2020-06-03 1885 __mod_lruvec_page_state(new_page, NR_SHMEM, nr_none); 042a30824871fa Hugh Dickins 2018-11-30 1886 } 042a30824871fa Hugh Dickins 2018-11-30 1887 042a30824871fa Hugh Dickins 2018-11-30 1888 xa_locked: 042a30824871fa Hugh Dickins 2018-11-30 1889 xas_unlock_irq(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1890 xa_unlocked: 042a30824871fa Hugh Dickins 2018-11-30 1891 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1892 if (result == SCAN_SUCCEED) { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1893 struct page *page, *tmp; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1894 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1895 /* 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1896 * Replacing old pages with new one has succeeded, now we 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1897 * need to copy the content and free the old pages. f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1898 */ 2af8ff291848cc Hugh Dickins 2018-11-30 1899 index = start; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1900 list_for_each_entry_safe(page, tmp, &pagelist, lru) { 2af8ff291848cc Hugh Dickins 2018-11-30 1901 while (index < page->index) { 2af8ff291848cc Hugh Dickins 2018-11-30 1902 clear_highpage(new_page + (index % HPAGE_PMD_NR)); 2af8ff291848cc Hugh Dickins 2018-11-30 1903 index++; 2af8ff291848cc Hugh Dickins 2018-11-30 1904 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1905 copy_highpage(new_page + (page->index % HPAGE_PMD_NR), f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1906 page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1907 list_del(&page->lru); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1908 page->mapping = NULL; 042a30824871fa Hugh Dickins 2018-11-30 1909 page_ref_unfreeze(page, 1); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1910 ClearPageActive(page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1911 ClearPageUnevictable(page); 042a30824871fa Hugh Dickins 2018-11-30 1912 unlock_page(page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1913 put_page(page); 2af8ff291848cc Hugh Dickins 2018-11-30 1914 index++; 2af8ff291848cc Hugh Dickins 2018-11-30 1915 } 2af8ff291848cc Hugh Dickins 2018-11-30 1916 while (index < end) { 2af8ff291848cc Hugh Dickins 2018-11-30 1917 clear_highpage(new_page + (index % HPAGE_PMD_NR)); 2af8ff291848cc Hugh Dickins 2018-11-30 1918 index++; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1919 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1920 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1921 SetPageUptodate(new_page); 87c460a0bded56 Hugh Dickins 2018-11-30 1922 page_ref_add(new_page, HPAGE_PMD_NR - 1); 6058eaec816f29 Johannes Weiner 2020-06-03 1923 if (is_shmem) 99cb0dbd47a15d Song Liu 2019-09-23 1924 set_page_dirty(new_page); 6058eaec816f29 Johannes Weiner 2020-06-03 1925 lru_cache_add(new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1926 042a30824871fa Hugh Dickins 2018-11-30 1927 /* 042a30824871fa Hugh Dickins 2018-11-30 1928 * Remove pte page tables, so we can re-fault the page as huge. 042a30824871fa Hugh Dickins 2018-11-30 1929 */ 042a30824871fa Hugh Dickins 2018-11-30 1930 retract_page_tables(mapping, start); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1931 *hpage = NULL; 87aa752906ecf6 Yang Shi 2018-08-17 1932 87aa752906ecf6 Yang Shi 2018-08-17 1933 khugepaged_pages_collapsed++; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1934 } else { 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1935 struct page *page; aaa52e340073b7 Hugh Dickins 2018-11-30 1936 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1937 /* Something went wrong: roll back page cache changes */ 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1938 xas_lock_irq(&xas); aaa52e340073b7 Hugh Dickins 2018-11-30 1939 mapping->nrpages -= nr_none; 99cb0dbd47a15d Song Liu 2019-09-23 1940 99cb0dbd47a15d Song Liu 2019-09-23 1941 if (is_shmem) aaa52e340073b7 Hugh Dickins 2018-11-30 1942 shmem_uncharge(mapping->host, nr_none); aaa52e340073b7 Hugh Dickins 2018-11-30 1943 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1944 xas_set(&xas, start); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1945 xas_for_each(&xas, page, end - 1) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1946 page = list_first_entry_or_null(&pagelist, f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1947 struct page, lru); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1948 if (!page || xas.xa_index < page->index) { f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1949 if (!nr_none) f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1950 break; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1951 nr_none--; 59749e6ce53735 Johannes Weiner 2016-12-12 1952 /* Put holes back where they were */ 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1953 xas_store(&xas, NULL); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1954 continue; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1955 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1956 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1957 VM_BUG_ON_PAGE(page->index != xas.xa_index, page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1958 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1959 /* Unfreeze the page. */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1960 list_del(&page->lru); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1961 page_ref_unfreeze(page, 2); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1962 xas_store(&xas, page); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1963 xas_pause(&xas); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1964 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1965 unlock_page(page); 042a30824871fa Hugh Dickins 2018-11-30 1966 putback_lru_page(page); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1967 xas_lock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1968 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1969 VM_BUG_ON(nr_none); 77da9389b9d5f0 Matthew Wilcox 2017-12-04 1970 xas_unlock_irq(&xas); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1971 f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1972 new_page->mapping = NULL; f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1973 } 042a30824871fa Hugh Dickins 2018-11-30 1974 042a30824871fa Hugh Dickins 2018-11-30 1975 unlock_page(new_page); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1976 out: f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1977 VM_BUG_ON(!list_empty(&pagelist)); 9d82c69438d0df Johannes Weiner 2020-06-03 1978 if (!IS_ERR_OR_NULL(*hpage)) 9d82c69438d0df Johannes Weiner 2020-06-03 1979 mem_cgroup_uncharge(*hpage); f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1980 /* TODO: tracepoints */ f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1981 } f3f0e1d2150b2b Kirill A. Shutemov 2016-07-26 1982 :::::: The code at line 1646 was first introduced by commit :::::: f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 khugepaged: add support of collapse for tmpfs/shmem pages :::::: TO: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinmux: Use sequential access to access desc->pinmux data
by Zhang Kunbo 08 Feb '25

08 Feb '25

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v6.6.66 commit 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIFR8 CVE: CVE-2024-47141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ] When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } } Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/pinctrl/pinmux.c [ Scope-based resource management is not merged yet (54da6a092431), so we lock the data-race region by hand ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/pinctrl/core.c | 3 +++ drivers/pinctrl/core.h | 1 + drivers/pinctrl/pinmux.c | 49 ++++++++++++++++++++++++++++++++++------ 3 files changed, 46 insertions(+), 7 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index b7a6bab4ac01..118c4975c777 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev, /* Set owner */ pindesc->pctldev = pctldev; +#ifdef CONFIG_PINMUX + mutex_init(&pindesc->mux_lock); +#endif /* Copy basic pin info */ if (pin->name) { diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h index 840103c40c14..f5e4ca19c17b 100644 --- a/drivers/pinctrl/core.h +++ b/drivers/pinctrl/core.h @@ -167,6 +167,7 @@ struct pin_desc { const char *mux_owner; const struct pinctrl_setting_mux *mux_setting; const char *gpio_owner; + struct mutex mux_lock; #endif }; diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index bab888fe3f8e..53fe25e9e864 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -27,6 +27,7 @@ #include <linux/pinctrl/pinmux.h> #include "core.h" #include "pinmux.h" +#include <linux/mutex.h> int pinmux_check_ops(struct pinctrl_dev *pctldev) { @@ -84,15 +85,21 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) { struct pin_desc *desc = pin_desc_get(pctldev, pin); const struct pinmux_ops *ops = pctldev->desc->pmxops; + bool can; /* Can't inspect pin, assume it can be used */ if (!desc || !ops) return true; - if (ops->strict && desc->mux_usecount) + mutex_lock(&desc->mux_lock); + if (ops->strict && desc->mux_usecount) { + mutex_unlock(&desc->mux_lock); return false; + } - return !(ops->strict && !!desc->gpio_owner); + can = !(ops->strict && !!desc->gpio_owner); + mutex_unlock(&desc->mux_lock); + return can; } /** @@ -123,11 +130,13 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n", pin, desc->name, owner); + mutex_lock(&desc->mux_lock); if ((!gpio_range || ops->strict) && desc->mux_usecount && strcmp(desc->mux_owner, owner)) { dev_err(pctldev->dev, "pin %s already requested by %s; cannot claim for %s\n", desc->name, desc->mux_owner, owner); + mutex_unlock(&desc->mux_lock); goto out; } @@ -135,6 +144,7 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_err(pctldev->dev, "pin %s already requested by %s; cannot claim for %s\n", desc->name, desc->gpio_owner, owner); + mutex_unlock(&desc->mux_lock); goto out; } @@ -142,11 +152,14 @@ static int pin_request(struct pinctrl_dev *pctldev, desc->gpio_owner = owner; } else { desc->mux_usecount++; - if (desc->mux_usecount > 1) + if (desc->mux_usecount > 1) { + mutex_unlock(&desc->mux_lock); return 0; + } desc->mux_owner = owner; } + mutex_unlock(&desc->mux_lock); /* Let each pin increase references to this module */ if (!try_module_get(pctldev->owner)) { @@ -176,6 +189,7 @@ static int pin_request(struct pinctrl_dev *pctldev, out_free_pin: if (status) { + mutex_lock(&desc->mux_lock); if (gpio_range) { desc->gpio_owner = NULL; } else { @@ -183,6 +197,7 @@ static int pin_request(struct pinctrl_dev *pctldev, if (!desc->mux_usecount) desc->mux_owner = NULL; } + mutex_unlock(&desc->mux_lock); } out: if (status) @@ -217,16 +232,22 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, return NULL; } + mutex_lock(&desc->mux_lock); if (!gpio_range) { /* * A pin should not be freed more times than allocated. */ - if (WARN_ON(!desc->mux_usecount)) + if (WARN_ON(!desc->mux_usecount)) { + mutex_unlock(&desc->mux_lock); return NULL; + } desc->mux_usecount--; - if (desc->mux_usecount) + if (desc->mux_usecount) { + mutex_unlock(&desc->mux_lock); return NULL; + } } + mutex_unlock(&desc->mux_lock); /* * If there is no kind of request function for the pin we just assume @@ -237,6 +258,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, else if (ops->free) ops->free(pctldev, pin); + mutex_lock(&desc->mux_lock); if (gpio_range) { owner = desc->gpio_owner; desc->gpio_owner = NULL; @@ -245,6 +267,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, desc->mux_owner = NULL; desc->mux_setting = NULL; } + mutex_unlock(&desc->mux_lock); module_put(pctldev->owner); @@ -457,7 +480,9 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } + mutex_lock(&desc->mux_lock); desc->mux_setting = &(setting->data.mux); + mutex_unlock(&desc->mux_lock); } ret = ops->set_mux(pctldev, setting->data.mux.func, @@ -471,8 +496,11 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) err_set_mux: for (i = 0; i < num_pins; i++) { desc = pin_desc_get(pctldev, pins[i]); - if (desc) + if (desc) { + mutex_lock(&desc->mux_lock); desc->mux_setting = NULL; + mutex_unlock(&desc->mux_lock); + } } err_pin_request: /* On error release all taken pins */ @@ -491,6 +519,7 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) unsigned num_pins = 0; int i; struct pin_desc *desc; + bool is_equal; if (pctlops->get_group_pins) ret = pctlops->get_group_pins(pctldev, setting->data.mux.group, @@ -516,7 +545,11 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } - if (desc->mux_setting == &(setting->data.mux)) { + mutex_lock(&desc->mux_lock); + is_equal = (desc->mux_setting == &(setting->data.mux)); + mutex_unlock(&desc->mux_lock); + + if (is_equal) { pin_free(pctldev, pins[i], NULL); } else { const char *gname; @@ -608,6 +641,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) if (desc == NULL) continue; + mutex_lock(&desc->mux_lock); if (desc->mux_owner && !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev))) is_hog = true; @@ -642,6 +676,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) desc->mux_setting->group)); else seq_putc(s, '\n'); + mutex_unlock(&desc->mux_lock); } mutex_unlock(&pctldev->mutex); -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3e25b4f1b2a403f9c9bbcabb005b882397477053
by kernel test robot 08 Feb '25

08 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3e25b4f1b2a403f9c9bbcabb005b882397477053 !15042 drm: adv7511: Fix use-after-free in adv7533_attach_dsi() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502072305.gE5j9Qd8-lkp@intel.com mm/ioremap.o: warning: objtool: missing symbol for section .text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len | |-- include-asm-generic-bitops-non-atomic.h:warning:array-subscript-long-unsigned-int-is-partly-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized | |-- include-net-netns-generic.h:warning:array-subscript-id-is-outside-array-bounds-of-void | `-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized |-- arm64-allnoconfig | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_AES-when-selected-by-RTLLIB_CRYPTO_CCMP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_ARC4-when-selected-by-RTLLIB_CRYPTO_TKIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_ARC4-when-selected-by-RTLLIB_CRYPTO_WEP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-CRYPTO_MICHAEL_MIC-when-selected-by-RTLLIB_CRYPTO_TKIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-FB_BACKLIGHT-when-selected-by-DRM_NOUVEAU | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HARDLOCKUP_DETECTOR-when-selected-by-SDEI_WATCHDOG | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-IIO_BUFFER_CB-when-selected-by-TOUCHSCREEN_ADC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PINCTRL_EXYNOS-when-selected-by-ARCH_EXYNOS | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SPI_PHYTIUM-when-selected-by-SPI_PHYTIUM_PCI | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SPI_PHYTIUM-when-selected-by-SPI_PHYTIUM_PLAT | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-UACCE-when-selected-by-CRYPTO_DEV_HISI_QM | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250207 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-list.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-tmp-in-((struct-list_head-)lip)-.prev | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- include-linux-plist.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node |-- arm64-randconfig-002-20250207 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-net-netns-generic.h:warning:array-subscript-id-is-outside-array-bounds-of-void | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-003-20250207 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250207 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-001-20250207 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250207 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-003-20250207 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250207 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | `-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-005-20250207 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-ioremap.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250207 | |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call | |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-defconfig |-- arch-x86-entry-entry_64.o:warning:objtool:.entry.text:unsupported-intra-function-call |-- arch-x86-entry-entry_64.o:warning:objtool:If-this-is-a-retpoline-please-patch-it-in-with-alternatives-and-annotate-it-with-ANNOTATE_NOSPEC_ALTERNATIVE. |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-long-long-unsigned-int-long-long-unsigne `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast elapsed time: 779m configs tested: 15 configs skipped: 112 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250207 gcc-14.2.0 arm64 randconfig-002-20250207 gcc-14.2.0 arm64 randconfig-003-20250207 gcc-14.2.0 arm64 randconfig-004-20250207 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250207 gcc-12 x86_64 buildonly-randconfig-002-20250207 clang-19 x86_64 buildonly-randconfig-003-20250207 clang-19 x86_64 buildonly-randconfig-004-20250207 clang-19 x86_64 buildonly-randconfig-005-20250207 clang-19 x86_64 buildonly-randconfig-006-20250207 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1901/1901] drivers/net/ethernet/huawei/hinic/hinic_main.c:204:30: error: member reference type 'int' is not a pointer
by kernel test robot 08 Feb '25

08 Feb '25

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be69fb5fc3212547e4408752b099094739f31aaa commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [1901/1901] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: x86_64-buildonly-randconfig-001-20250208 (https://download.01.org/0day-ci/archive/20250208/202502080513.W05LfnyB-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250208/202502080513.W05LfnyB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502080513.W05LfnyB-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/hinic/hinic_main.c:18: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ drivers/net/ethernet/huawei/hinic/hinic_main.c:204:9: error: call to undeclared function 'vlan_dev_priv'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 204 | ret = vlan_dev_priv(ndev)->real_dev; | ^ >> drivers/net/ethernet/huawei/hinic/hinic_main.c:204:30: error: member reference type 'int' is not a pointer 204 | ret = vlan_dev_priv(ndev)->real_dev; | ~~~~~~~~~~~~~~~~~~~ ^ drivers/net/ethernet/huawei/hinic/hinic_main.c:206:30: error: member reference type 'int' is not a pointer 206 | ret = vlan_dev_priv(ret)->real_dev; | ~~~~~~~~~~~~~~~~~~ ^ drivers/net/ethernet/huawei/hinic/hinic_main.c:182:5: warning: no previous prototype for function 'hinic_netdev_event' [-Wmissing-prototypes] 182 | int hinic_netdev_event(struct notifier_block *notifier, | ^ drivers/net/ethernet/huawei/hinic/hinic_main.c:182:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 182 | int hinic_netdev_event(struct notifier_block *notifier, | ^ | static drivers/net/ethernet/huawei/hinic/hinic_main.c:2291:21: error: no member named 'dcbnl_ops' in 'struct net_device' 2291 | adapter->netdev->dcbnl_ops = &hinic_dcbnl_ops; | ~~~~~~~~~~~~~~~ ^ drivers/net/ethernet/huawei/hinic/hinic_main.c:3058:6: warning: no previous prototype for function 'nic_event' [-Wmissing-prototypes] 3058 | void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, | ^ drivers/net/ethernet/huawei/hinic/hinic_main.c:3058:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3058 | void nic_event(struct hinic_lld_dev *lld_dev, void *adapter, | ^ | static 3 warnings and 4 errors generated. vim +/int +204 drivers/net/ethernet/huawei/hinic/hinic_main.c 176 177 #define HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT 2 178 #define HINIC_VLAN_CLEAR_OFFLOAD (NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \ 179 NETIF_F_SCTP_CRC | NETIF_F_RXCSUM | \ 180 NETIF_F_ALL_TSO) 181 182 int hinic_netdev_event(struct notifier_block *notifier, 183 unsigned long event, void *ptr) 184 { 185 struct net_device *ndev = netdev_notifier_info_to_dev(ptr); 186 struct net_device *real_dev, *ret; 187 struct hinic_nic_dev *nic_dev; 188 u16 vlan_depth; 189 190 if (!is_vlan_dev(ndev)) 191 return NOTIFY_DONE; 192 193 dev_hold(ndev); 194 195 switch (event) { 196 case NETDEV_REGISTER: 197 real_dev = vlan_dev_real_dev(ndev); 198 nic_dev = hinic_get_uld_dev_by_ifname(real_dev->name, 199 SERVICE_T_NIC); 200 if (!nic_dev) 201 goto out; 202 203 vlan_depth = 1; > 204 ret = vlan_dev_priv(ndev)->real_dev; 205 while (is_vlan_dev(ret)) { 206 ret = vlan_dev_priv(ret)->real_dev; 207 vlan_depth++; 208 } 209 210 if (vlan_depth == HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 211 ndev->vlan_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 212 } else if (vlan_depth > HINIC_MAX_VLAN_DEPTH_OFFLOAD_SUPPORT) { 213 ndev->hw_features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 214 ndev->features &= (~HINIC_VLAN_CLEAR_OFFLOAD); 215 } 216 217 break; 218 219 default: 220 break; 221 }; 222 223 out: 224 dev_put(ndev); 225 226 return NOTIFY_DONE; 227 } 228 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/ioremap.o: warning: objtool: missing symbol for section .text
by kernel test robot 07 Feb '25

07 Feb '25

Hi Nicholas, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3e25b4f1b2a403f9c9bbcabb005b882397477053 commit: 004cface9c1c0b6351473934a4ce452193e05b07 [1418/1418] mm: Move vmap_range from mm/ioremap.c to mm/vmalloc.c config: x86_64-buildonly-randconfig-005-20250207 (https://download.01.org/0day-ci/archive/20250207/202502072305.gE5j9Qd8-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250207/202502072305.gE5j9Qd8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502072305.gE5j9Qd8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/ioremap.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinmux: Use sequential access to access desc->pinmux data
by Zhang Kunbo 07 Feb '25

07 Feb '25

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v6.6.66 commit 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIFR8 CVE: CVE-2024-47141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ] When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } } Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/pinctrl/pinmux.c [ Scope-based resource management is not merged yet (54da6a092431), so we lock the data-race region by hand ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/pinctrl/core.c | 3 +++ drivers/pinctrl/core.h | 1 + drivers/pinctrl/pinmux.c | 39 ++++++++++++++++++++++++++++++++++----- 3 files changed, 38 insertions(+), 5 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index b7a6bab4ac01..118c4975c777 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev, /* Set owner */ pindesc->pctldev = pctldev; +#ifdef CONFIG_PINMUX + mutex_init(&pindesc->mux_lock); +#endif /* Copy basic pin info */ if (pin->name) { diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h index 840103c40c14..f5e4ca19c17b 100644 --- a/drivers/pinctrl/core.h +++ b/drivers/pinctrl/core.h @@ -167,6 +167,7 @@ struct pin_desc { const char *mux_owner; const struct pinctrl_setting_mux *mux_setting; const char *gpio_owner; + struct mutex mux_lock; #endif }; diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index bab888fe3f8e..9d38ef1a77be 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -27,6 +27,7 @@ #include <linux/pinctrl/pinmux.h> #include "core.h" #include "pinmux.h" +#include <linux/mutex.h> int pinmux_check_ops(struct pinctrl_dev *pctldev) { @@ -84,15 +85,21 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) { struct pin_desc *desc = pin_desc_get(pctldev, pin); const struct pinmux_ops *ops = pctldev->desc->pmxops; + bool can; /* Can't inspect pin, assume it can be used */ if (!desc || !ops) return true; - if (ops->strict && desc->mux_usecount) + mutex_lock(&desc->mux_lock); + if (ops->strict && desc->mux_usecount) { + mutex_unlock(&desc->mux_lock); return false; + } - return !(ops->strict && !!desc->gpio_owner); + can = !(ops->strict && !!desc->gpio_owner); + mutex_unlock(&desc->mux_lock); + return can; } /** @@ -123,11 +130,13 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n", pin, desc->name, owner); + mutex_lock(&desc->mux_lock); if ((!gpio_range || ops->strict) && desc->mux_usecount && strcmp(desc->mux_owner, owner)) { dev_err(pctldev->dev, "pin %s already requested by %s; cannot claim for %s\n", desc->name, desc->mux_owner, owner); + mutex_unlock(&desc->mux_lock); goto out; } @@ -135,6 +144,7 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_err(pctldev->dev, "pin %s already requested by %s; cannot claim for %s\n", desc->name, desc->gpio_owner, owner); + mutex_unlock(&desc->mux_lock); goto out; } @@ -142,11 +152,14 @@ static int pin_request(struct pinctrl_dev *pctldev, desc->gpio_owner = owner; } else { desc->mux_usecount++; - if (desc->mux_usecount > 1) + if (desc->mux_usecount > 1) { + mutex_unlock(&desc->mux_lock); return 0; + } desc->mux_owner = owner; } + mutex_unlock(&desc->mux_lock); /* Let each pin increase references to this module */ if (!try_module_get(pctldev->owner)) { @@ -176,6 +189,7 @@ static int pin_request(struct pinctrl_dev *pctldev, out_free_pin: if (status) { + mutex_lock(&desc->mux_lock); if (gpio_range) { desc->gpio_owner = NULL; } else { @@ -183,6 +197,7 @@ static int pin_request(struct pinctrl_dev *pctldev, if (!desc->mux_usecount) desc->mux_owner = NULL; } + mutex_unlock(&desc->mux_lock); } out: if (status) @@ -237,6 +252,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, else if (ops->free) ops->free(pctldev, pin); + mutex_lock(&desc->mux_lock); if (gpio_range) { owner = desc->gpio_owner; desc->gpio_owner = NULL; @@ -245,6 +261,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, desc->mux_owner = NULL; desc->mux_setting = NULL; } + mutex_unlock(&desc->mux_lock); module_put(pctldev->owner); @@ -457,7 +474,9 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } + mutex_lock(&desc->mux_lock); desc->mux_setting = &(setting->data.mux); + mutex_unlock(&desc->mux_lock); } ret = ops->set_mux(pctldev, setting->data.mux.func, @@ -471,8 +490,11 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) err_set_mux: for (i = 0; i < num_pins; i++) { desc = pin_desc_get(pctldev, pins[i]); - if (desc) + if (desc) { + mutex_lock(&desc->mux_lock); desc->mux_setting = NULL; + mutex_unlock(&desc->mux_lock); + } } err_pin_request: /* On error release all taken pins */ @@ -491,6 +513,7 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) unsigned num_pins = 0; int i; struct pin_desc *desc; + bool is_equal; if (pctlops->get_group_pins) ret = pctlops->get_group_pins(pctldev, setting->data.mux.group, @@ -516,7 +539,11 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } - if (desc->mux_setting == &(setting->data.mux)) { + mutex_lock(&desc->mux_lock); + is_equal = (desc->mux_setting == &(setting->data.mux)); + mutex_unlock(&desc->mux_lock); + + if (is_equal) { pin_free(pctldev, pins[i], NULL); } else { const char *gname; @@ -608,6 +635,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) if (desc == NULL) continue; + mutex_lock(&desc->mux_lock); if (desc->mux_owner && !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev))) is_hog = true; @@ -642,6 +670,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) desc->mux_setting->group)); else seq_putc(s, '\n'); + mutex_unlock(&desc->mux_lock); } mutex_unlock(&pctldev->mutex); -- 2.34.1

2 1

[openeuler:OLK-6.6 1897/1897] mm/memblock.c:1409:20: warning: no previous prototype for 'memblock_alloc_range_nid_flags'
by kernel test robot 07 Feb '25

07 Feb '25

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fdc8c83a12a8fc4b7c55971d552758ffe2f34c14 commit: 64018b291c1f49622c4b23b303364d760306d662 [1897/1897] mm/memblock: Introduce ability to alloc memory from specify memory region config: x86_64-alldefconfig (https://download.01.org/0day-ci/archive/20250207/202502071449.bIBBpkJp-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250207/202502071449.bIBBpkJp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502071449.bIBBpkJp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memblock.c:1409:20: warning: no previous prototype for 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1409 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> mm/memblock.c:1579: warning: expecting prototype for memblock_alloc_internal(). Prototype was for __memblock_alloc_internal() instead vim +/memblock_alloc_range_nid_flags +1409 mm/memblock.c 1386 1387 /** 1388 * memblock_alloc_range_nid_flags - allocate boot memory block with specify flag 1389 * @size: size of memory block to be allocated in bytes 1390 * @align: alignment of the region and block's size 1391 * @start: the lower bound of the memory region to allocate (phys address) 1392 * @end: the upper bound of the memory region to allocate (phys address) 1393 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1394 * @exact_nid: control the allocation fall back to other nodes 1395 * @flags: alloc memory from specify memblock flag 1396 * 1397 * The allocation is performed from memory region limited by 1398 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1399 * 1400 * If the specified node can not hold the requested memory and @exact_nid 1401 * is false, the allocation falls back to any node in the system. 1402 * 1403 * In addition, function sets the min_count to 0 using kmemleak_alloc_phys for 1404 * allocated boot memory block, so that it is never reported as leaks. 1405 * 1406 * Return: 1407 * Physical address of allocated memory block on success, %0 on failure. 1408 */ > 1409 phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, 1410 phys_addr_t align, phys_addr_t start, 1411 phys_addr_t end, int nid, 1412 bool exact_nid, 1413 enum memblock_flags flags) 1414 { 1415 phys_addr_t found; 1416 1417 if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) 1418 nid = NUMA_NO_NODE; 1419 1420 if (!align) { 1421 /* Can't use WARNs this early in boot on powerpc */ 1422 dump_stack(); 1423 align = SMP_CACHE_BYTES; 1424 } 1425 1426 again: 1427 found = memblock_find_in_range_node(size, align, start, end, nid, 1428 flags); 1429 if (found && !memblock_reserve(found, size)) 1430 goto done; 1431 1432 if (nid != NUMA_NO_NODE && !exact_nid) { 1433 found = memblock_find_in_range_node(size, align, start, 1434 end, NUMA_NO_NODE, 1435 flags); 1436 if (found && !memblock_reserve(found, size)) 1437 goto done; 1438 } 1439 1440 if (flags & MEMBLOCK_MIRROR) { 1441 flags &= ~MEMBLOCK_MIRROR; 1442 pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", 1443 &size); 1444 goto again; 1445 } 1446 1447 return 0; 1448 1449 done: 1450 /* 1451 * Skip kmemleak for those places like kasan_init() and 1452 * early_pgtable_alloc() due to high volume. 1453 */ 1454 if (end != MEMBLOCK_ALLOC_NOLEAKTRACE) 1455 /* 1456 * Memblock allocated blocks are never reported as 1457 * leaks. This is because many of these blocks are 1458 * only referred via the physical address which is 1459 * not looked up by kmemleak. 1460 */ 1461 kmemleak_alloc_phys(found, size, 0); 1462 1463 /* 1464 * Some Virtual Machine platforms, such as Intel TDX or AMD SEV-SNP, 1465 * require memory to be accepted before it can be used by the 1466 * guest. 1467 * 1468 * Accept the memory of the allocated buffer. 1469 */ 1470 accept_memory(found, found + size); 1471 1472 return found; 1473 } 1474 1475 /** 1476 * memblock_alloc_range_nid - allocate boot memory block 1477 * @size: size of memory block to be allocated in bytes 1478 * @align: alignment of the region and block's size 1479 * @start: the lower bound of the memory region to allocate (phys address) 1480 * @end: the upper bound of the memory region to allocate (phys address) 1481 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1482 * @exact_nid: control the allocation fall back to other nodes 1483 * 1484 * The allocation is performed from memory region limited by 1485 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1486 * 1487 * If the specified node can not hold the requested memory and @exact_nid 1488 * is false, the allocation falls back to any node in the system. 1489 * 1490 * For systems with memory mirroring, the allocation is attempted first 1491 * from the regions with mirroring enabled and then retried from any 1492 * memory region. 1493 * 1494 * In addition, function using kmemleak_alloc_phys for allocated boot 1495 * memory block, it is never reported as leaks. 1496 * 1497 * Return: 1498 * Physical address of allocated memory block on success, %0 on failure. 1499 */ 1500 phys_addr_t __init memblock_alloc_range_nid(phys_addr_t size, 1501 phys_addr_t align, phys_addr_t start, 1502 phys_addr_t end, int nid, 1503 bool exact_nid) 1504 { 1505 return memblock_alloc_range_nid_flags(size, align, start, end, nid, 1506 exact_nid, 1507 choose_memblock_flags()); 1508 } 1509 1510 /** 1511 * memblock_phys_alloc_range - allocate a memory block inside specified range 1512 * @size: size of memory block to be allocated in bytes 1513 * @align: alignment of the region and block's size 1514 * @start: the lower bound of the memory region to allocate (physical address) 1515 * @end: the upper bound of the memory region to allocate (physical address) 1516 * 1517 * Allocate @size bytes in the between @start and @end. 1518 * 1519 * Return: physical address of the allocated memory block on success, 1520 * %0 on failure. 1521 */ 1522 phys_addr_t __init memblock_phys_alloc_range(phys_addr_t size, 1523 phys_addr_t align, 1524 phys_addr_t start, 1525 phys_addr_t end) 1526 { 1527 memblock_dbg("%s: %llu bytes align=0x%llx from=%pa max_addr=%pa %pS\n", 1528 __func__, (u64)size, (u64)align, &start, &end, 1529 (void *)_RET_IP_); 1530 return memblock_alloc_range_nid(size, align, start, end, NUMA_NO_NODE, 1531 false); 1532 } 1533 1534 /** 1535 * memblock_phys_alloc_try_nid - allocate a memory block from specified NUMA node 1536 * @size: size of memory block to be allocated in bytes 1537 * @align: alignment of the region and block's size 1538 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1539 * 1540 * Allocates memory block from the specified NUMA node. If the node 1541 * has no available memory, attempts to allocated from any node in the 1542 * system. 1543 * 1544 * Return: physical address of the allocated memory block on success, 1545 * %0 on failure. 1546 */ 1547 phys_addr_t __init memblock_phys_alloc_try_nid(phys_addr_t size, phys_addr_t align, int nid) 1548 { 1549 return memblock_alloc_range_nid(size, align, 0, 1550 MEMBLOCK_ALLOC_ACCESSIBLE, nid, false); 1551 } 1552 1553 /** 1554 * memblock_alloc_internal - allocate boot memory block 1555 * @size: size of memory block to be allocated in bytes 1556 * @align: alignment of the region and block's size 1557 * @min_addr: the lower bound of the memory region to allocate (phys address) 1558 * @max_addr: the upper bound of the memory region to allocate (phys address) 1559 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1560 * @exact_nid: control the allocation fall back to other nodes 1561 * @flags: alloc memory from specify memblock flag 1562 * 1563 * Allocates memory block using memblock_alloc_range_nid() and 1564 * converts the returned physical address to virtual. 1565 * 1566 * The @min_addr limit is dropped if it can not be satisfied and the allocation 1567 * will fall back to memory below @min_addr. Other constraints, such 1568 * as node and mirrored memory will be handled again in 1569 * memblock_alloc_range_nid(). 1570 * 1571 * Return: 1572 * Virtual address of allocated memory block on success, NULL on failure. 1573 */ 1574 static void * __init __memblock_alloc_internal( 1575 phys_addr_t size, phys_addr_t align, 1576 phys_addr_t min_addr, phys_addr_t max_addr, 1577 int nid, bool exact_nid, 1578 enum memblock_flags flags) > 1579 { 1580 phys_addr_t alloc; 1581 1582 /* 1583 * Detect any accidental use of these APIs after slab is ready, as at 1584 * this moment memblock may be deinitialized already and its 1585 * internal data may be destroyed (after execution of memblock_free_all) 1586 */ 1587 if (WARN_ON_ONCE(slab_is_available())) 1588 return kzalloc_node(size, GFP_NOWAIT, nid); 1589 1590 if (max_addr > memblock.current_limit) 1591 max_addr = memblock.current_limit; 1592 1593 alloc = memblock_alloc_range_nid_flags(size, align, min_addr, max_addr, nid, 1594 exact_nid, flags); 1595 1596 /* retry allocation without lower limit */ 1597 if (!alloc && min_addr) 1598 alloc = memblock_alloc_range_nid_flags(size, align, 0, max_addr, nid, 1599 exact_nid, flags); 1600 1601 if (!alloc) 1602 return NULL; 1603 1604 return phys_to_virt(alloc); 1605 } 1606 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1897/1897] mm/madvise.c:297:6: warning: no previous prototype for 'force_swapin_vma'
by kernel test robot 07 Feb '25

07 Feb '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fdc8c83a12a8fc4b7c55971d552758ffe2f34c14 commit: 92a0eb9bde6c03412b39f9f3d20968c091ea3b46 [1897/1897] memcg: introduce per-memcg swapin interface config: x86_64-alldefconfig (https://download.01.org/0day-ci/archive/20250207/202502071345.oFOjxkvF-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250207/202502071345.oFOjxkvF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502071345.oFOjxkvF-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/madvise.c:297:6: warning: no previous prototype for 'force_swapin_vma' [-Wmissing-prototypes] 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^~~~~~~~~~~~~~~~ vim +/force_swapin_vma +297 mm/madvise.c 280 281 #ifdef CONFIG_MEMCG_SWAP_QOS 282 void force_swapin_vma(struct vm_area_struct *vma) 283 { 284 struct file *file = vma->vm_file; 285 286 if (!can_madv_lru_vma(vma)) 287 return; 288 289 if (!file) { 290 walk_page_vma(vma, &swapin_walk_ops, vma); 291 lru_add_drain(); 292 } else if (shmem_mapping(file->f_mapping)) 293 shmem_swapin_range(vma, vma->vm_start, 294 vma->vm_end, file->f_mapping); 295 } 296 #else > 297 void force_swapin_vma(struct vm_area_struct *vma) 298 { 299 } 300 #endif 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
by Wang Wensheng 07 Feb '25

07 Feb '25

From: Issam Hamdi <ih(a)simonwunderlich.de> stable inclusion from stable-v6.6.70 commit 86772872f9f5097cd03d0e1c6813238bd38c250b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2X CVE: CVE-2024-57899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49dba1ded8dd5a6a12748631403240b2ab245c34 ] On 32-bit systems, the size of an unsigned long is 4 bytes, while a u64 is 8 bytes. Therefore, when using or_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE), the code is incorrectly searching for a bit in a 32-bit variable that is expected to be 64 bits in size, leading to incorrect bit finding. Solution: Ensure that the size of the bits variable is correctly adjusted for each architecture. Call Trace: ? show_regs+0x54/0x58 ? __warn+0x6b/0xd4 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? report_bug+0x113/0x150 ? exc_overflow+0x30/0x30 ? handle_bug+0x27/0x44 ? exc_invalid_op+0x18/0x50 ? handle_exception+0xf6/0xf6 ? exc_overflow+0x30/0x30 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? exc_overflow+0x30/0x30 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? ieee80211_mesh_work+0xff/0x260 [mac80211] ? cfg80211_wiphy_work+0x72/0x98 [cfg80211] ? process_one_work+0xf1/0x1fc ? worker_thread+0x2c0/0x3b4 ? kthread+0xc7/0xf0 ? mod_delayed_work_on+0x4c/0x4c ? kthread_complete_and_exit+0x14/0x14 ? ret_from_fork+0x24/0x38 ? kthread_complete_and_exit+0x14/0x14 ? ret_from_fork_asm+0xf/0x14 ? entry_INT80_32+0xf0/0xf0 Signed-off-by: Issam Hamdi <ih(a)simonwunderlich.de> Link: https://patch.msgid.link/20241125162920.2711462-1-ih@simonwunderlich.de [restore no-op path for no changes] Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- net/mac80211/mesh.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c index 25223184d6e5..a5e7edd2f2d1 100644 --- a/net/mac80211/mesh.c +++ b/net/mac80211/mesh.c @@ -1173,14 +1173,14 @@ void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata, u64 changed) { struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; - unsigned long bits = changed; + unsigned long bits[] = { BITMAP_FROM_U64(changed) }; u32 bit; - if (!bits) + if (!changed) return; /* if we race with running work, worst case this work becomes a noop */ - for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE) + for_each_set_bit(bit, bits, sizeof(changed) * BITS_PER_BYTE) set_bit(bit, ifmsh->mbss_changed); set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags); wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work); -- 2.22.0

2 1

[openeuler:OLK-6.6] BUILD REGRESSION f8c09dd64fa7e103726a43d76017f3cbd4f5b8c0
by kernel test robot 07 Feb '25

07 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f8c09dd64fa7e103726a43d76017f3cbd4f5b8c0 !14988 net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- loongarch-allmodconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- loongarch-randconfig-002-20250206 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | `-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-buildonly-randconfig-006-20250206 `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) elapsed time: 925m configs tested: 20 configs skipped: 112 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250206 clang-21 arm64 randconfig-002-20250206 clang-21 arm64 randconfig-003-20250206 clang-15 arm64 randconfig-004-20250206 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250206 gcc-14.2.0 loongarch randconfig-002-20250206 gcc-14.2.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250206 clang-19 x86_64 buildonly-randconfig-002-20250206 clang-19 x86_64 buildonly-randconfig-003-20250206 clang-19 x86_64 buildonly-randconfig-004-20250206 clang-19 x86_64 buildonly-randconfig-005-20250206 clang-19 x86_64 buildonly-randconfig-006-20250206 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
by Zheng Zucheng 07 Feb '25

07 Feb '25

From: Biju Das <biju.das.jz(a)bp.renesas.com> stable inclusion from stable-v5.10.234 commit acec80d9f126cd3fa764bbe3d96bc0cb5cd2b087 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2S CVE: CVE-2024-57887 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 ] The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() in error path of probe() and also in the remove(). Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device") Cc: stable(a)vger.kernel.org Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241119192040.152657-2-biju.… Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/bridge/adv7511/adv7511_drv.c drivers/gpu/drm/bridge/adv7511/adv7533.c [Context differences.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 ++++- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 -- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c index 31bce3a37b20..faf64f6c2a53 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c @@ -1125,7 +1125,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) ret = adv7511_init_regulators(adv7511); if (ret) { dev_err(dev, "failed to init regulators\n"); - return ret; + goto err_of_node_put; } /* @@ -1235,6 +1235,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) i2c_unregister_device(adv7511->i2c_edid); uninit_regulators: adv7511_uninit_regulators(adv7511); +err_of_node_put: + of_node_put(adv7511->host_node); return ret; } @@ -1249,6 +1251,7 @@ static int adv7511_remove(struct i2c_client *i2c) if (adv7511->cec_clk) clk_disable_unprepare(adv7511->cec_clk); + of_node_put(adv7511->host_node); adv7511_uninit_regulators(adv7511); drm_bridge_remove(&adv7511->bridge); diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c index 185b6d842166..de0bd603baf1 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7533.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c @@ -210,8 +210,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) if (!adv->host_node) return -ENODEV; - of_node_put(adv->host_node); - adv->use_timing_gen = !of_property_read_bool(np, "adi,disable-timing-generator"); -- 2.34.1

2 1

[PATCH OLK-6.6] gve: guard XDP xmit NDO on existence of xdp queues
by Wang Liang 07 Feb '25

07 Feb '25

From: Joshua Washington <joshwash(a)google.com> stable inclusion from stable-v6.6.70 commit cbe9eb2c39d09f3c8574febcfa39d8c09d0c7cb5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6O9 CVE: CVE-2024-57932 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ff7c2dea9dd1a436fc79d6273adffdcc4a7ffea3 upstream. In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should return early if either of these conditions are false. In the case of no loaded XDP program, priv->num_xdp_queues=0 which can cause a divide-by-zero error, and in the case of interface down, num_xdp_queues remains untouched to persist XDP queue count for the next interface up, but the TX pointer itself would be NULL. The XDP xmit callback also needs to synchronize with a device transitioning from open to close. This synchronization will happen via the GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call, which waits for any RCU critical sections at call-time to complete. Fixes: 39a7f4aa3e4a ("gve: Add XDP REDIRECT support for GQI-QPL format") Cc: stable(a)vger.kernel.org Signed-off-by: Joshua Washington <joshwash(a)google.com> Signed-off-by: Praveen Kaligineedi <pkaligineedi(a)google.com> Reviewed-by: Praveen Kaligineedi <pkaligineedi(a)google.com> Reviewed-by: Shailend Chand <shailend(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/google/gve/gve_main.c | 3 +++ drivers/net/ethernet/google/gve/gve_tx.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c index 5703240474e5..1b0b45ca88b6 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1757,6 +1757,9 @@ static void gve_turndown(struct gve_priv *priv) gve_clear_napi_enabled(priv); gve_clear_report_stats(priv); + + /* Make sure that all traffic is finished processing. */ + synchronize_net(); } static void gve_turnup(struct gve_priv *priv) diff --git a/drivers/net/ethernet/google/gve/gve_tx.c b/drivers/net/ethernet/google/gve/gve_tx.c index 2ae891a62875..29987624791a 100644 --- a/drivers/net/ethernet/google/gve/gve_tx.c +++ b/drivers/net/ethernet/google/gve/gve_tx.c @@ -777,9 +777,12 @@ int gve_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, struct gve_tx_ring *tx; int i, err = 0, qid; - if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) + if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK) || !priv->xdp_prog) return -EINVAL; + if (!gve_get_napi_enabled(priv)) + return -ENETDOWN; + qid = gve_xdp_tx_queue_id(priv, smp_processor_id() % priv->num_xdp_queues); -- 2.34.1

2 1

[PATCH OLK-6.6] gve: guard XSK operations on the existence of queues
by Wang Liang 07 Feb '25

07 Feb '25

From: Joshua Washington <joshwash(a)google.com> stable inclusion from stable-v6.6.70 commit 771d66f2bd8c4dba1286a9163ab982cecd825718 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6P5 CVE: CVE-2024-57933 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 40338d7987d810fcaa95c500b1068a52b08eec9b upstream. This patch predicates the enabling and disabling of XSK pools on the existence of queues. As it stands, if the interface is down, disabling or enabling XSK pools would result in a crash, as the RX queue pointer would be NULL. XSK pool registration will occur as part of the next interface up. Similarly, xsk_wakeup needs be guarded against queues disappearing while the function is executing, so a check against the GVE_PRIV_FLAGS_NAPI_ENABLED flag is added to synchronize with the disabling of the bit and the synchronize_net() in gve_turndown. Fixes: fd8e40321a12 ("gve: Add AF_XDP zero-copy support for GQI-QPL format") Cc: stable(a)vger.kernel.org Signed-off-by: Joshua Washington <joshwash(a)google.com> Signed-off-by: Praveen Kaligineedi <pkaligineedi(a)google.com> Reviewed-by: Praveen Kaligineedi <pkaligineedi(a)google.com> Reviewed-by: Shailend Chand <shailend(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Larysa Zaremba <larysa.zaremba(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/google/gve/gve_main.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c index 5703240474e5..5a763149b06a 100644 --- a/drivers/net/ethernet/google/gve/gve_main.c +++ b/drivers/net/ethernet/google/gve/gve_main.c @@ -1528,8 +1528,8 @@ static int gve_xsk_pool_enable(struct net_device *dev, if (err) return err; - /* If XDP prog is not installed, return */ - if (!priv->xdp_prog) + /* If XDP prog is not installed or interface is down, return. */ + if (!priv->xdp_prog || !netif_running(dev)) return 0; rx = &priv->rx[qid]; @@ -1574,21 +1574,16 @@ static int gve_xsk_pool_disable(struct net_device *dev, if (qid >= priv->rx_cfg.num_queues) return -EINVAL; - /* If XDP prog is not installed, unmap DMA and return */ - if (!priv->xdp_prog) + /* If XDP prog is not installed or interface is down, unmap DMA and + * return. + */ + if (!priv->xdp_prog || !netif_running(dev)) goto done; - tx_qid = gve_xdp_tx_queue_id(priv, qid); - if (!netif_running(dev)) { - priv->rx[qid].xsk_pool = NULL; - xdp_rxq_info_unreg(&priv->rx[qid].xsk_rxq); - priv->tx[tx_qid].xsk_pool = NULL; - goto done; - } - napi_rx = &priv->ntfy_blocks[priv->rx[qid].ntfy_id].napi; napi_disable(napi_rx); /* make sure current rx poll is done */ + tx_qid = gve_xdp_tx_queue_id(priv, qid); napi_tx = &priv->ntfy_blocks[priv->tx[tx_qid].ntfy_id].napi; napi_disable(napi_tx); /* make sure current tx poll is done */ @@ -1616,6 +1611,9 @@ static int gve_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags) struct gve_priv *priv = netdev_priv(dev); int tx_queue_id = gve_xdp_tx_queue_id(priv, queue_id); + if (!gve_get_napi_enabled(priv)) + return -ENETDOWN; + if (queue_id >= priv->rx_cfg.num_queues || !priv->xdp_prog) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] mptcp: fix TCP options overflow.
by Wang Liang 07 Feb '25

07 Feb '25

From: Paolo Abeni <pabeni(a)redhat.com> stable inclusion from stable-v6.6.70 commit 53fe947f67c93a5334aed3a7259fcc8a204f8bb6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID34 CVE: CVE-2024-57882 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cbb26f7d8451fe56ccac802c6db48d16240feebd upstream. Syzbot reported the following splat: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 UID: 0 PID: 5836 Comm: sshd Not tainted 6.13.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 RIP: 0010:_compound_head include/linux/page-flags.h:242 [inline] RIP: 0010:put_page+0x23/0x260 include/linux/mm.h:1552 Code: 90 90 90 90 90 90 90 55 41 57 41 56 53 49 89 fe 48 bd 00 00 00 00 00 fc ff df e8 f8 5e 12 f8 49 8d 5e 08 48 89 d8 48 c1 e8 03 <80> 3c 28 00 74 08 48 89 df e8 8f c7 78 f8 48 8b 1b 48 89 de 48 83 RSP: 0000:ffffc90003916c90 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff888030458000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: dffffc0000000000 R08: ffffffff898ca81d R09: 1ffff110054414ac R10: dffffc0000000000 R11: ffffed10054414ad R12: 0000000000000007 R13: ffff88802a20a542 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f34f496e800(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9d6ec9ec28 CR3: 000000004d260000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x483/0x8a0 net/core/skbuff.c:1119 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb+0x55/0x70 net/core/skbuff.c:1204 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3436 [inline] tcp_ack+0x2442/0x6bc0 net/ipv4/tcp_input.c:4032 tcp_rcv_state_process+0x8eb/0x44e0 net/ipv4/tcp_input.c:6805 tcp_v4_do_rcv+0x77d/0xc70 net/ipv4/tcp_ipv4.c:1939 tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2351 ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314 __netif_receive_skb_one_core net/core/dev.c:5672 [inline] __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5785 process_backlog+0x662/0x15b0 net/core/dev.c:6117 __napi_poll+0xcb/0x490 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:7074 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0033:0x7f34f4519ad5 Code: 85 d2 74 0d 0f 10 02 48 8d 54 24 20 0f 11 44 24 20 64 8b 04 25 18 00 00 00 85 c0 75 27 41 b8 08 00 00 00 b8 0f 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 75 48 8b 15 24 73 0d 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffec5b32ce0 EFLAGS: 00000246 RAX: 0000000000000001 RBX: 00000000000668a0 RCX: 00007f34f4519ad5 RDX: 00007ffec5b32d00 RSI: 0000000000000004 RDI: 0000564f4bc6cae0 RBP: 0000564f4bc6b5a0 R08: 0000000000000008 R09: 0000000000000000 R10: 00007ffec5b32de8 R11: 0000000000000246 R12: 0000564f48ea8aa4 R13: 0000000000000001 R14: 0000564f48ea93e8 R15: 00007ffec5b32d68 </TASK> Eric noted a probable shinfo->nr_frags corruption, which indeed occurs. The root cause is a buggy MPTCP option len computation in some circumstances: the ADD_ADDR option should be mutually exclusive with DSS since the blamed commit. Still, mptcp_established_options_add_addr() tries to set the relevant info in mptcp_out_options, if the remaining space is large enough even when DSS is present. Since the ADD_ADDR infos and the DSS share the same union fields, adding first corrupts the latter. In the worst-case scenario, such corruption increases the DSS binary layout, exceeding the computed length and possibly overwriting the skb shared info. Address the issue by enforcing mutual exclusion in mptcp_established_options_add_addr(), too. Cc: stable(a)vger.kernel.org Reported-by: syzbot+38a095a81f30d82884c1(a)syzkaller.appspotmail.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/538 Fixes: 1bff1e43a30e ("mptcp: optimize out option generation") Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/025d9df8cde3c9a557befc47e9bc08fbbe3476e5.173477104… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mptcp/options.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index afbb1c2b7543..8bce5e8d57a5 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -667,8 +667,15 @@ static bool mptcp_established_options_add_addr(struct sock *sk, struct sk_buff * &echo, &drop_other_suboptions)) return false; + /* + * Later on, mptcp_write_options() will enforce mutually exclusion with + * DSS, bail out if such option is set and we can't drop it. + */ if (drop_other_suboptions) remaining += opt_size; + else if (opts->suboptions & OPTION_MPTCP_DSS) + return false; + len = mptcp_add_addr_len(opts->addr.family, echo, !!opts->addr.port); if (remaining < len) return false; -- 2.34.1

2 1

[PATCH OLK-6.6] net: fix memory leak in tcp_conn_request()
by Wang Liang 07 Feb '25

07 Feb '25

stable inclusion from stable-v6.6.70 commit 2af69905180b3fea12f9c1db374b153a06977021 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2D CVE: CVE-2024-57841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f4aa4aa28142d53f8b06585c478476cfe325cfc ] If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req. Here is the kmemleak stack: unreferenced object 0xffff8881198631c0 (size 240): comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s) hex dump (first 32 bytes): 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................ 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U.............. backtrace: [<ffffffffb93e8d4c>] kmem_cache_alloc+0x60c/0xa80 [<ffffffffba11b4c5>] dst_alloc+0x55/0x250 [<ffffffffba227bf6>] rt_dst_alloc+0x46/0x1d0 [<ffffffffba23050a>] __mkroute_output+0x29a/0xa50 [<ffffffffba23456b>] ip_route_output_key_hash+0x10b/0x240 [<ffffffffba2346bd>] ip_route_output_flow+0x1d/0x90 [<ffffffffba254855>] inet_csk_route_req+0x2c5/0x500 [<ffffffffba26b331>] tcp_conn_request+0x691/0x12c0 [<ffffffffba27bd08>] tcp_rcv_state_process+0x3c8/0x11b0 [<ffffffffba2965c6>] tcp_v4_do_rcv+0x156/0x3b0 [<ffffffffba299c98>] tcp_v4_rcv+0x1cf8/0x1d80 [<ffffffffba239656>] ip_protocol_deliver_rcu+0xf6/0x360 [<ffffffffba2399a6>] ip_local_deliver_finish+0xe6/0x1e0 [<ffffffffba239b8e>] ip_local_deliver+0xee/0x360 [<ffffffffba239ead>] ip_rcv+0xad/0x2f0 [<ffffffffba110943>] __netif_receive_skb_one_core+0x123/0x140 Call dst_release() to free the dst memory when inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request(). Fixes: ff46e3b44219 ("Fix race for duplicate reqsk on identical SYN") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Link: https://patch.msgid.link/20241219072859.3783576-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/tcp_input.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 69406fbc13bd..7418f64dd851 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -7225,6 +7225,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, if (unlikely(!inet_csk_reqsk_queue_hash_add(sk, req, req->timeout))) { reqsk_free(req); + dst_release(dst); return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] net/smc: check smcd_v2_ext_offset when receiving proposal msg
by Wang Liang 07 Feb '25

07 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 935caf324b445fe73d7708fae6f7176fb243f357 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC6V CVE: CVE-2024-47408 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9ab332deb671d8f7e66d82a2ff2b3f715bc3a4ad ] When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be fully trusted. Once the value of smcd_v2_ext_offset exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the value of smcd_v2_ext_offset before using it. Fixes: 5c21c4ccafe8 ("net/smc: determine accepted ISM devices") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 2 ++ net/smc/smc_clc.h | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 6881fd03ef25..d5c686ea380b 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2153,6 +2153,8 @@ static void smc_find_ism_v2_device_serv(struct smc_sock *new_smc, pclc_smcd = smc_get_clc_msg_smcd(pclc); smc_v2_ext = smc_get_clc_v2_ext(pclc); smcd_v2_ext = smc_get_clc_smcd_v2_ext(smc_v2_ext); + if (!pclc_smcd || !smc_v2_ext || !smcd_v2_ext) + goto not_found; mutex_lock(&smcd_dev_list.mutex); if (pclc_smcd->ism.chid) { diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h index 58777b6a0dfe..eab3544a401c 100644 --- a/net/smc/smc_clc.h +++ b/net/smc/smc_clc.h @@ -380,9 +380,15 @@ smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop) static inline struct smc_clc_smcd_v2_extension * smc_get_clc_smcd_v2_ext(struct smc_clc_v2_extension *prop_v2ext) { + u16 max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_smcd_v2_ext) - + offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) - + offsetof(struct smc_clc_v2_extension, hdr) - + offsetofend(struct smc_clnt_opts_area_hdr, smcd_v2_ext_offset); + if (!prop_v2ext) return NULL; - if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset)) + if (!ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) || + ntohs(prop_v2ext->hdr.smcd_v2_ext_offset) > max_offset) return NULL; return (struct smc_clc_smcd_v2_extension *) -- 2.34.1

2 1

[PATCH OLK-6.6] net/smc: check return value of sock_recvmsg when draining clc data
by Wang Liang 07 Feb '25

07 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 7a6927814b4256d603e202ae7c5e38db3b338896 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCNG CVE: CVE-2024-57791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c5b8ee5022a19464783058dc6042e8eefa34e8cd ] When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and the value should not be fully trusted as it is from the network. Once the value of length exceeds the value of buflen in function smc_clc_wait_msg it may run into deadloop when trying to drain the remaining data exceeding buflen. This patch checks the return value of sock_recvmsg when draining data in case of deadloop in draining. Fixes: fb4f79264c0f ("net/smc: tolerate future SMCD versions") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/smc_clc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index d96ad04e7dcf..e3c027502f2e 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -764,6 +764,11 @@ int smc_clc_wait_msg(struct smc_sock *smc, void *buf, int buflen, SMC_CLC_RECV_BUF_LEN : datlen; iov_iter_kvec(&msg.msg_iter, ITER_DEST, &vec, 1, recvlen); len = sock_recvmsg(smc->clcsock, &msg, krflags); + if (len < recvlen) { + smc->sk.sk_err = EPROTO; + reason_code = -EPROTO; + goto out; + } datlen -= len; } if (clcm->type == SMC_CLC_DECLINE) { -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 0dfa6b9ea8d763e5e5134ce053f30ad87a65095a
by kernel test robot 07 Feb '25

07 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0dfa6b9ea8d763e5e5134ce053f30ad87a65095a !15010 nvme-rdma: unquiesce admin_q before destroy it Error/Warning (recently discovered and may have been fixed): drivers/gpu/drm/vc4/vc4_crtc.o: warning: objtool: vc4_crtc_disable()+0x1a5: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-004-20250206 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | `-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets |-- x86_64-buildonly-randconfig-001-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250205 | `-- drivers-gpu-drm-vc4-vc4_crtc.o:warning:objtool:vc4_crtc_disable:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-003-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250206 | |-- block-blk-settings.o:warning:objtool:blk_queue_set_zoned:unreachable-instruction | |-- drivers-base-regmap-regmap-debugfs.o:warning:objtool:regmap_reg_ranges_read_file:unreachable-instruction | |-- drivers-char-xillybus-xillybus_core.o:warning:objtool:xillybus_read:unreachable-instruction | |-- drivers-counter-counter.o:warning:objtool:devm_counter_match:unreachable-instruction | |-- drivers-media-dvb-core-dvb_ringbuffer.o:warning:objtool:dvb_ringbuffer_read_user:unreachable-instruction | |-- drivers-misc-lkdtm-usercopy.o:warning:objtool:do_usercopy_heap_size:unreachable-instruction | |-- drivers-mtd-ubi-cdev.o:warning:objtool:vol_cdev_read:unreachable-instruction | |-- drivers-mtd-ubi-upd.o:warning:objtool:ubi_more_update_data:unreachable-instruction | |-- drivers-thunderbolt-ctl.o:warning:objtool:tb_ctl_tx:unreachable-instruction | |-- drivers-thunderbolt-switch.o:warning:objtool:tb_wait_for_port:unreachable-instruction | |-- drivers-thunderbolt-tunnel.o:warning:objtool:tb_dp_xchg_caps:unreachable-instruction | |-- fs-libfs.o:warning:objtool:simple_read_from_buffer:unreachable-instruction | |-- fs-pstore-ram_core.o:warning:objtool:persistent_ram_update_user:unreachable-instruction | |-- kernel-dma-map_benchmark.o:warning:objtool:map_benchmark_thread:unreachable-instruction | |-- kernel-sched-membarrier.o:warning:objtool:membarrier_register_private_expedited:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250206 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-platform-x86-toshiba_acpi.c:warning:fan_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:keys_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:lcd_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:video_proc_ops-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page `-- x86_64-defconfig |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page elapsed time: 723m configs tested: 15 configs skipped: 96 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250206 clang-21 arm64 randconfig-002-20250206 clang-21 arm64 randconfig-003-20250206 clang-15 arm64 randconfig-004-20250206 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250206 clang-19 x86_64 buildonly-randconfig-002-20250206 clang-19 x86_64 buildonly-randconfig-003-20250206 clang-19 x86_64 buildonly-randconfig-004-20250206 clang-19 x86_64 buildonly-randconfig-005-20250206 clang-19 x86_64 buildonly-randconfig-006-20250206 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] pinmux: Use sequential access to access desc->pinmux data
by Zhang Kunbo 06 Feb '25

06 Feb '25

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v6.6.66 commit 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIFR8 CVE: CVE-2024-47141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ] When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } } Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/pinctrl/pinmux.c [ Scope-based resource management is not merged yet (54da6a092431), so we lock the data-race region by hand ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/pinctrl/core.c | 3 +++ drivers/pinctrl/core.h | 1 + drivers/pinctrl/pinmux.c | 25 +++++++++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index b7a6bab4ac01..118c4975c777 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev, /* Set owner */ pindesc->pctldev = pctldev; +#ifdef CONFIG_PINMUX + mutex_init(&pindesc->mux_lock); +#endif /* Copy basic pin info */ if (pin->name) { diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h index 840103c40c14..f5e4ca19c17b 100644 --- a/drivers/pinctrl/core.h +++ b/drivers/pinctrl/core.h @@ -167,6 +167,7 @@ struct pin_desc { const char *mux_owner; const struct pinctrl_setting_mux *mux_setting; const char *gpio_owner; + struct mutex mux_lock; #endif }; diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index bab888fe3f8e..bfab925dbf04 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -27,6 +27,7 @@ #include <linux/pinctrl/pinmux.h> #include "core.h" #include "pinmux.h" +#include <linux/mutex.h> int pinmux_check_ops(struct pinctrl_dev *pctldev) { @@ -89,9 +90,11 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) if (!desc || !ops) return true; + mutex_lock(&desc->mux_lock); if (ops->strict && desc->mux_usecount) return false; + mutex_unlock(&desc->mux_lock); return !(ops->strict && !!desc->gpio_owner); } @@ -123,6 +126,7 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n", pin, desc->name, owner); + mutex_lock(&desc->mux_lock); if ((!gpio_range || ops->strict) && desc->mux_usecount && strcmp(desc->mux_owner, owner)) { dev_err(pctldev->dev, @@ -147,6 +151,7 @@ static int pin_request(struct pinctrl_dev *pctldev, desc->mux_owner = owner; } + mutex_unlock(&desc->mux_lock); /* Let each pin increase references to this module */ if (!try_module_get(pctldev->owner)) { @@ -176,6 +181,7 @@ static int pin_request(struct pinctrl_dev *pctldev, out_free_pin: if (status) { + mutex_lock(&desc->mux_lock); if (gpio_range) { desc->gpio_owner = NULL; } else { @@ -183,6 +189,7 @@ static int pin_request(struct pinctrl_dev *pctldev, if (!desc->mux_usecount) desc->mux_owner = NULL; } + mutex_unlock(&desc->mux_lock); } out: if (status) @@ -237,6 +244,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, else if (ops->free) ops->free(pctldev, pin); + mutex_lock(&desc->mux_lock); if (gpio_range) { owner = desc->gpio_owner; desc->gpio_owner = NULL; @@ -245,6 +253,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, desc->mux_owner = NULL; desc->mux_setting = NULL; } + mutex_unlock(&desc->mux_lock); module_put(pctldev->owner); @@ -457,7 +466,9 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } + mutex_lock(&desc->mux_lock); desc->mux_setting = &(setting->data.mux); + mutex_unlock(&desc->mux_lock); } ret = ops->set_mux(pctldev, setting->data.mux.func, @@ -471,8 +482,11 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) err_set_mux: for (i = 0; i < num_pins; i++) { desc = pin_desc_get(pctldev, pins[i]); - if (desc) + if (desc) { + mutex_lock(&desc->mux_lock); desc->mux_setting = NULL; + mutex_unlock(&desc->mux_lock); + } } err_pin_request: /* On error release all taken pins */ @@ -491,6 +505,7 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) unsigned num_pins = 0; int i; struct pin_desc *desc; + bool is_equal; if (pctlops->get_group_pins) ret = pctlops->get_group_pins(pctldev, setting->data.mux.group, @@ -516,7 +531,11 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } - if (desc->mux_setting == &(setting->data.mux)) { + mutex_lock(&desc->mux_lock); + is_equal = (desc->mux_setting == &(setting->data.mux)); + mutex_unlock(&desc->mux_lock); + + if (is_equal) { pin_free(pctldev, pins[i], NULL); } else { const char *gname; @@ -608,6 +627,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) if (desc == NULL) continue; + mutex_lock(&desc->mux_lock); if (desc->mux_owner && !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev))) is_hog = true; @@ -642,6 +662,7 @@ static int pinmux_pins_show(struct seq_file *s, void *what) desc->mux_setting->group)); else seq_putc(s, '\n'); + mutex_unlock(&desc->mux_lock); } mutex_unlock(&pctldev->mutex); -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56724
by Liao Chen 06 Feb '25

06 Feb '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] brd: fix AA deadlock for concurrent brd_probe()
by Yu Kuai 06 Feb '25

06 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIWBN CVE: NA ---------------------------------------- For concurrent brd_probe(), the first one will create brd disk and set partition number to 0, however, the second one will found the brd disk and keep the partition number as disk fist minor. This will case AA deadlock for the caller because bdev is part0 while bdev->bd_partno is not zero. Fix the problem by always return NULL in brd_probe, hence brd_probe() will be covered by exact_match() from __device_add_disk(). Fixes: 937af5ecd059 ("brd: Fix all partitions BUGs") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/block/brd.c | 30 ++++++------------------------ 1 file changed, 6 insertions(+), 24 deletions(-) diff --git a/drivers/block/brd.c b/drivers/block/brd.c index 02e8fff3f828..6a74b91126f0 100644 --- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -418,25 +418,15 @@ static void brd_free(struct brd_device *brd) kfree(brd); } -static struct brd_device *brd_init_one(int i, bool *new) +static void brd_init_one(int i) { struct brd_device *brd; - *new = false; - list_for_each_entry(brd, &brd_devices, brd_list) { + list_for_each_entry(brd, &brd_devices, brd_list) if (brd->brd_number == i) - goto out; - } + return; - brd = brd_alloc(i); - if (brd) { - brd->brd_disk->queue = brd->brd_queue; - add_disk(brd->brd_disk); - list_add_tail(&brd->brd_list, &brd_devices); - } - *new = true; -out: - return brd; + brd_alloc(i); } static void brd_del_one(struct brd_device *brd) @@ -448,19 +438,11 @@ static void brd_del_one(struct brd_device *brd) static struct kobject *brd_probe(dev_t dev, int *part, void *data) { - struct brd_device *brd; - struct kobject *kobj; - bool new; - mutex_lock(&brd_devices_mutex); - brd = brd_init_one(MINOR(dev) / max_part, &new); - kobj = brd ? get_disk_and_module(brd->brd_disk) : NULL; + brd_init_one(MINOR(dev) / max_part); mutex_unlock(&brd_devices_mutex); - if (new) - *part = 0; - - return kobj; + return NULL; } static inline void brd_check_and_reset_par(void) -- 2.39.2

3 2

[PATCH OLK-5.10] brd: fix AA deadlock for concurrent brd_probe()
by Yu Kuai 06 Feb '25

06 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIWBN CVE: NA ---------------------------------------- For concurrent brd_probe(), the first one will create brd disk and set partition number to 0, however, the second one will found the brd disk and keep the partition number as disk fist minor. This will case AA deadlock for the caller because bdev is part0 while bdev->bd_partno is not zero. Fix the problem by always return NULL in brd_probe, hence brd_probe() will be covered by exact_match() from __device_add_disk(). Fixes: 937af5ecd059 ("brd: Fix all partitions BUGs") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/block/brd.c | 32 ++++++-------------------------- 1 file changed, 6 insertions(+), 26 deletions(-) diff --git a/drivers/block/brd.c b/drivers/block/brd.c index bb3ccaebc9aa..1bbfc8c3d1eb 100644 --- a/drivers/block/brd.c +++ b/drivers/block/brd.c @@ -429,27 +429,15 @@ static int brd_alloc(int i) return err; } -static struct brd_device *brd_init_one(int i, bool *new) +static void brd_init_one(int i) { struct brd_device *brd; - int err; - *new = false; - list_for_each_entry(brd, &brd_devices, brd_list) { + list_for_each_entry(brd, &brd_devices, brd_list) if (brd->brd_number == i) - goto out; - } + return; - *new = true; - err = brd_alloc(i); - if (err) - return NULL; - list_for_each_entry(brd, &brd_devices, brd_list) { - if (brd->brd_number == i) - goto out; - } -out: - return brd; + brd_alloc(i); } static void brd_del_one(struct brd_device *brd) @@ -463,19 +451,11 @@ static void brd_del_one(struct brd_device *brd) static struct kobject *brd_probe(dev_t dev, int *part, void *data) { - struct brd_device *brd; - struct kobject *kobj; - bool new; - mutex_lock(&brd_devices_mutex); - brd = brd_init_one(MINOR(dev) / max_part, &new); - kobj = brd ? get_disk_and_module(brd->brd_disk) : NULL; + brd_init_one(MINOR(dev) / max_part); mutex_unlock(&brd_devices_mutex); - if (new) - *part = 0; - - return kobj; + return NULL; } static inline void brd_check_and_reset_par(void) -- 2.39.2

2 1

[PATCH OLK-6.6] nbd: don't allow reconnect after disconnect
by Yu Kuai 06 Feb '25

06 Feb '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGB8Q CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commi… ---------------------------------------- Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference: nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail. Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command") Reported-by: syzbot+6b0df248918b92c33e6a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/ Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> --- drivers/block/nbd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 74d1f9c26ecc..7eeb4b6de6de 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2169,6 +2169,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) flush_workqueue(nbd->recv_workq); nbd_clear_que(nbd); nbd->task_setup = NULL; + clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); mutex_unlock(&nbd->config_lock); if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] nbd: don't allow reconnect after disconnect
by Yu Kuai 06 Feb '25

06 Feb '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGB8Q CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commi… ---------------------------------------- Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial reference: nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero 3) nbd_genl_reconfigure() queue recv_work() again; nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work) 4) step 1) release the reference; 5) Finially, recv_work() will trigger UAF: recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail. Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command") Reported-by: syzbot+6b0df248918b92c33e6a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/ Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> --- drivers/block/nbd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 9d413c4fd64c..fbc4cdb5a5b9 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2083,6 +2083,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) mutex_lock(&nbd->config_lock); nbd_disconnect(nbd); nbd_clear_sock(nbd); + clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags); mutex_unlock(&nbd->config_lock); /* * Make sure recv thread has finished, so it does not drop the last -- 2.39.2

2 1

[PATCH OLK-6.6] wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
by Wang Wensheng 06 Feb '25

06 Feb '25

From: Issam Hamdi <ih(a)simonwunderlich.de> stable inclusion from stable-v6.6.70 commit 86772872f9f5097cd03d0e1c6813238bd38c250b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBID2X CVE: CVE-2024-57899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 49dba1ded8dd5a6a12748631403240b2ab245c34 ] On 32-bit systems, the size of an unsigned long is 4 bytes, while a u64 is 8 bytes. Therefore, when using or_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE), the code is incorrectly searching for a bit in a 32-bit variable that is expected to be 64 bits in size, leading to incorrect bit finding. Solution: Ensure that the size of the bits variable is correctly adjusted for each architecture. Call Trace: ? show_regs+0x54/0x58 ? __warn+0x6b/0xd4 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? report_bug+0x113/0x150 ? exc_overflow+0x30/0x30 ? handle_bug+0x27/0x44 ? exc_invalid_op+0x18/0x50 ? handle_exception+0xf6/0xf6 ? exc_overflow+0x30/0x30 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? exc_overflow+0x30/0x30 ? ieee80211_link_info_change_notify+0xcc/0xd4 [mac80211] ? ieee80211_mesh_work+0xff/0x260 [mac80211] ? cfg80211_wiphy_work+0x72/0x98 [cfg80211] ? process_one_work+0xf1/0x1fc ? worker_thread+0x2c0/0x3b4 ? kthread+0xc7/0xf0 ? mod_delayed_work_on+0x4c/0x4c ? kthread_complete_and_exit+0x14/0x14 ? ret_from_fork+0x24/0x38 ? kthread_complete_and_exit+0x14/0x14 ? ret_from_fork_asm+0xf/0x14 ? entry_INT80_32+0xf0/0xf0 Signed-off-by: Issam Hamdi <ih(a)simonwunderlich.de> Link: https://patch.msgid.link/20241125162920.2711462-1-ih@simonwunderlich.de [restore no-op path for no changes] Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- net/mac80211/mesh.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c index 25223184d6e5..a5e7edd2f2d1 100644 --- a/net/mac80211/mesh.c +++ b/net/mac80211/mesh.c @@ -1173,14 +1173,14 @@ void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata, u64 changed) { struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; - unsigned long bits = changed; + unsigned long bits[] = { BITMAP_FROM_U64(changed) }; u32 bit; - if (!bits) + if (!changed) return; /* if we race with running work, worst case this work becomes a noop */ - for_each_set_bit(bit, &bits, sizeof(changed) * BITS_PER_BYTE) + for_each_set_bit(bit, bits, sizeof(changed) * BITS_PER_BYTE) set_bit(bit, ifmsh->mbss_changed); set_bit(MESH_WORK_MBSS_CHANGED, &ifmsh->wrkq_flags); wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
by Zheng Zucheng 06 Feb '25

06 Feb '25

From: Biju Das <biju.das.jz(a)bp.renesas.com> stable inclusion from stable-v5.10.234 commit 49881fcef3d4b8733fcdcf76f1bc12ec291b74be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2S CVE: CVE-2024-57887 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 ] The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() in error path of probe() and also in the remove(). Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device") Cc: stable(a)vger.kernel.org Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241119192040.152657-2-biju.… Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/bridge/adv7511/adv7511_drv.c drivers/gpu/drm/bridge/adv7511/adv7533.c [Context differences.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 ++++- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 -- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c index 31bce3a37b20..faf64f6c2a53 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c @@ -1125,7 +1125,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) ret = adv7511_init_regulators(adv7511); if (ret) { dev_err(dev, "failed to init regulators\n"); - return ret; + goto err_of_node_put; } /* @@ -1235,6 +1235,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) i2c_unregister_device(adv7511->i2c_edid); uninit_regulators: adv7511_uninit_regulators(adv7511); +err_of_node_put: + of_node_put(adv7511->host_node); return ret; } @@ -1249,6 +1251,7 @@ static int adv7511_remove(struct i2c_client *i2c) if (adv7511->cec_clk) clk_disable_unprepare(adv7511->cec_clk); + of_node_put(adv7511->host_node); adv7511_uninit_regulators(adv7511); drm_bridge_remove(&adv7511->bridge); diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c index 185b6d842166..de0bd603baf1 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7533.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c @@ -210,8 +210,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) if (!adv->host_node) return -ENODEV; - of_node_put(adv->host_node); - adv->use_timing_gen = !of_property_read_bool(np, "adi,disable-timing-generator"); -- 2.34.1

2 1

[PATCH OLK-6.6] pinmux: Use sequential access to access desc->pinmux data
by Zhang Kunbo 06 Feb '25

06 Feb '25

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v6.6.66 commit 2da32aed4a97ca1d70fb8b77926f72f30ce5fb4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIFR8 CVE: CVE-2024-47141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ] When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } } Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Link: https://lore.kernel.org/20241014192930.1539673-1-quic_mojha@quicinc.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/pinctrl/core.c | 3 + drivers/pinctrl/core.h | 1 + drivers/pinctrl/pinmux.c | 173 ++++++++++++++++++++++----------------- 3 files changed, 100 insertions(+), 77 deletions(-) diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c index 88ee086e1376..7342148c6572 100644 --- a/drivers/pinctrl/core.c +++ b/drivers/pinctrl/core.c @@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev, /* Set owner */ pindesc->pctldev = pctldev; +#ifdef CONFIG_PINMUX + mutex_init(&pindesc->mux_lock); +#endif /* Copy basic pin info */ if (pin->name) { diff --git a/drivers/pinctrl/core.h b/drivers/pinctrl/core.h index 530370443c19..ece4b9c71c97 100644 --- a/drivers/pinctrl/core.h +++ b/drivers/pinctrl/core.h @@ -177,6 +177,7 @@ struct pin_desc { const char *mux_owner; const struct pinctrl_setting_mux *mux_setting; const char *gpio_owner; + struct mutex mux_lock; #endif }; diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index 2a180a5d64a4..97e8af88df85 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -13,6 +13,7 @@ #define pr_fmt(fmt) "pinmux core: " fmt #include <linux/ctype.h> +#include <linux/cleanup.h> #include <linux/debugfs.h> #include <linux/device.h> #include <linux/err.h> @@ -93,6 +94,7 @@ bool pinmux_can_be_used_for_gpio(struct pinctrl_dev *pctldev, unsigned pin) if (!desc || !ops) return true; + guard(mutex)(&desc->mux_lock); if (ops->strict && desc->mux_usecount) return false; @@ -127,29 +129,31 @@ static int pin_request(struct pinctrl_dev *pctldev, dev_dbg(pctldev->dev, "request pin %d (%s) for %s\n", pin, desc->name, owner); - if ((!gpio_range || ops->strict) && - desc->mux_usecount && strcmp(desc->mux_owner, owner)) { - dev_err(pctldev->dev, - "pin %s already requested by %s; cannot claim for %s\n", - desc->name, desc->mux_owner, owner); - goto out; - } + scoped_guard(mutex, &desc->mux_lock) { + if ((!gpio_range || ops->strict) && + desc->mux_usecount && strcmp(desc->mux_owner, owner)) { + dev_err(pctldev->dev, + "pin %s already requested by %s; cannot claim for %s\n", + desc->name, desc->mux_owner, owner); + goto out; + } - if ((gpio_range || ops->strict) && desc->gpio_owner) { - dev_err(pctldev->dev, - "pin %s already requested by %s; cannot claim for %s\n", - desc->name, desc->gpio_owner, owner); - goto out; - } + if ((gpio_range || ops->strict) && desc->gpio_owner) { + dev_err(pctldev->dev, + "pin %s already requested by %s; cannot claim for %s\n", + desc->name, desc->gpio_owner, owner); + goto out; + } - if (gpio_range) { - desc->gpio_owner = owner; - } else { - desc->mux_usecount++; - if (desc->mux_usecount > 1) - return 0; + if (gpio_range) { + desc->gpio_owner = owner; + } else { + desc->mux_usecount++; + if (desc->mux_usecount > 1) + return 0; - desc->mux_owner = owner; + desc->mux_owner = owner; + } } /* Let each pin increase references to this module */ @@ -180,12 +184,14 @@ static int pin_request(struct pinctrl_dev *pctldev, out_free_pin: if (status) { - if (gpio_range) { - desc->gpio_owner = NULL; - } else { - desc->mux_usecount--; - if (!desc->mux_usecount) - desc->mux_owner = NULL; + scoped_guard(mutex, &desc->mux_lock) { + if (gpio_range) { + desc->gpio_owner = NULL; + } else { + desc->mux_usecount--; + if (!desc->mux_usecount) + desc->mux_owner = NULL; + } } } out: @@ -221,15 +227,17 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, return NULL; } - if (!gpio_range) { - /* - * A pin should not be freed more times than allocated. - */ - if (WARN_ON(!desc->mux_usecount)) - return NULL; - desc->mux_usecount--; - if (desc->mux_usecount) - return NULL; + scoped_guard(mutex, &desc->mux_lock) { + if (!gpio_range) { + /* + * A pin should not be freed more times than allocated. + */ + if (WARN_ON(!desc->mux_usecount)) + return NULL; + desc->mux_usecount--; + if (desc->mux_usecount) + return NULL; + } } /* @@ -241,13 +249,15 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, else if (ops->free) ops->free(pctldev, pin); - if (gpio_range) { - owner = desc->gpio_owner; - desc->gpio_owner = NULL; - } else { - owner = desc->mux_owner; - desc->mux_owner = NULL; - desc->mux_setting = NULL; + scoped_guard(mutex, &desc->mux_lock) { + if (gpio_range) { + owner = desc->gpio_owner; + desc->gpio_owner = NULL; + } else { + owner = desc->mux_owner; + desc->mux_owner = NULL; + desc->mux_setting = NULL; + } } module_put(pctldev->owner); @@ -461,7 +471,8 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } - desc->mux_setting = &(setting->data.mux); + scoped_guard(mutex, &desc->mux_lock) + desc->mux_setting = &(setting->data.mux); } ret = ops->set_mux(pctldev, setting->data.mux.func, @@ -475,8 +486,10 @@ int pinmux_enable_setting(const struct pinctrl_setting *setting) err_set_mux: for (i = 0; i < num_pins; i++) { desc = pin_desc_get(pctldev, pins[i]); - if (desc) - desc->mux_setting = NULL; + if (desc) { + scoped_guard(mutex, &desc->mux_lock) + desc->mux_setting = NULL; + } } err_pin_request: /* On error release all taken pins */ @@ -495,6 +508,7 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) unsigned num_pins = 0; int i; struct pin_desc *desc; + bool is_equal; if (pctlops->get_group_pins) ret = pctlops->get_group_pins(pctldev, setting->data.mux.group, @@ -520,7 +534,10 @@ void pinmux_disable_setting(const struct pinctrl_setting *setting) pins[i]); continue; } - if (desc->mux_setting == &(setting->data.mux)) { + scoped_guard(mutex, &desc->mux_lock) + is_equal = (desc->mux_setting == &(setting->data.mux)); + + if (is_equal) { pin_free(pctldev, pins[i], NULL); } else { const char *gname; @@ -612,40 +629,42 @@ static int pinmux_pins_show(struct seq_file *s, void *what) if (desc == NULL) continue; - if (desc->mux_owner && - !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev))) - is_hog = true; - - if (pmxops->strict) { - if (desc->mux_owner) - seq_printf(s, "pin %d (%s): device %s%s", - pin, desc->name, desc->mux_owner, + scoped_guard(mutex, &desc->mux_lock) { + if (desc->mux_owner && + !strcmp(desc->mux_owner, pinctrl_dev_get_name(pctldev))) + is_hog = true; + + if (pmxops->strict) { + if (desc->mux_owner) + seq_printf(s, "pin %d (%s): device %s%s", + pin, desc->name, desc->mux_owner, + is_hog ? " (HOG)" : ""); + else if (desc->gpio_owner) + seq_printf(s, "pin %d (%s): GPIO %s", + pin, desc->name, desc->gpio_owner); + else + seq_printf(s, "pin %d (%s): UNCLAIMED", + pin, desc->name); + } else { + /* For non-strict controllers */ + seq_printf(s, "pin %d (%s): %s %s%s", pin, desc->name, + desc->mux_owner ? desc->mux_owner + : "(MUX UNCLAIMED)", + desc->gpio_owner ? desc->gpio_owner + : "(GPIO UNCLAIMED)", is_hog ? " (HOG)" : ""); - else if (desc->gpio_owner) - seq_printf(s, "pin %d (%s): GPIO %s", - pin, desc->name, desc->gpio_owner); + } + + /* If mux: print function+group claiming the pin */ + if (desc->mux_setting) + seq_printf(s, " function %s group %s\n", + pmxops->get_function_name(pctldev, + desc->mux_setting->func), + pctlops->get_group_name(pctldev, + desc->mux_setting->group)); else - seq_printf(s, "pin %d (%s): UNCLAIMED", - pin, desc->name); - } else { - /* For non-strict controllers */ - seq_printf(s, "pin %d (%s): %s %s%s", pin, desc->name, - desc->mux_owner ? desc->mux_owner - : "(MUX UNCLAIMED)", - desc->gpio_owner ? desc->gpio_owner - : "(GPIO UNCLAIMED)", - is_hog ? " (HOG)" : ""); + seq_putc(s, '\n'); } - - /* If mux: print function+group claiming the pin */ - if (desc->mux_setting) - seq_printf(s, " function %s group %s\n", - pmxops->get_function_name(pctldev, - desc->mux_setting->func), - pctlops->get_group_name(pctldev, - desc->mux_setting->group)); - else - seq_putc(s, '\n'); } mutex_unlock(&pctldev->mutex); -- 2.34.1

2 1

[openeuler:OLK-5.10 2723/2723] net/tls/tls_device.o: warning: objtool: tls_device_rx_resync_new_rec()+0x941: unreachable instruction
by kernel test robot 06 Feb '25

06 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 86893ebd6e3edffebb8d7dc1091533735c6bb082 commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [2723/2723] tracing: Make tracepoint lockdep check actually test something config: x86_64-randconfig-102-20250206 (https://download.01.org/0day-ci/archive/20250206/202502061607.3EO2vKCF-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250206/202502061607.3EO2vKCF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502061607.3EO2vKCF-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/tls/tls_device.o: warning: objtool: tls_device_rx_resync_new_rec()+0x941: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/8] arm64/mpam: Support MATA monitor feature for MPAM
by Zeng Heng 06 Feb '25

06 Feb '25

Zeng Heng (8): arm64/mpam: Support MATA monitor feature for MPAM arm64/mpam: Add judgment to distinguish MSMON_MBWU_CAPTURE definition arm64/mpam: fix MBA granularity conversion formula arm64/mpam: fix bug in percent_to_mbw_max() arm64/mpam: Fix out-of-bound access of mbwu_state array arm64/mpam: Fix out-of-bound access of cfg array arm64/mpam: Improve conversion accuracy between percent and fixed-point fraction arm64/mpam: Add write memory barrier to guarantee monitor results arch/x86/kernel/cpu/resctrl/monitor.c | 52 ++++++++++ drivers/platform/mpam/mpam_devices.c | 40 ++++++-- drivers/platform/mpam/mpam_resctrl.c | 138 +++++++++++++++++++++----- fs/resctrl/internal.h | 15 --- fs/resctrl/monitor.c | 47 +-------- include/linux/resctrl.h | 17 ++++ 6 files changed, 216 insertions(+), 93 deletions(-) -- 2.25.1

2 9

[PATCH OLK-6.6] net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
by Wang Liang 06 Feb '25

06 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 91a7c27c1444ed4677b83fd5308d2cf03f5f0851 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC74 CVE: CVE-2024-49571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a29e220d3c8edbf0e1beb0f028878a4a85966556 ] When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field iparea_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks iparea_offset and ipv6_prefixes_cnt before using them. Fixes: e7b7a64a8493 ("smc: support variable CLC proposal messages") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 6 +++++- net/smc/smc_clc.c | 4 ++++ net/smc/smc_clc.h | 6 +++++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 6881fd03ef25..a63aabfd82fc 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2040,6 +2040,8 @@ static int smc_listen_prfx_check(struct smc_sock *new_smc, if (pclc->hdr.typev1 == SMC_TYPE_N) return 0; pclc_prfx = smc_clc_proposal_get_prefix(pclc); + if (!pclc_prfx) + return -EPROTO; if (smc_clc_prfx_match(newclcsock, pclc_prfx)) return SMC_CLC_DECL_DIFFPREFIX; @@ -2229,7 +2231,9 @@ static void smc_find_ism_v1_device_serv(struct smc_sock *new_smc, int rc = 0; /* check if ISM V1 is available */ - if (!(ini->smcd_version & SMC_V1) || !smcd_indicated(ini->smc_type_v1)) + if (!(ini->smcd_version & SMC_V1) || + !smcd_indicated(ini->smc_type_v1) || + !pclc_smcd) goto not_found; ini->is_smcd = true; /* prepare ISM check */ ini->ism_peer_gid[0].gid = ntohll(pclc_smcd->ism.gid); diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index d96ad04e7dcf..c28107afdb5b 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -354,6 +354,10 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) v2_ext = smc_get_clc_v2_ext(pclc); pclc_prfx = smc_clc_proposal_get_prefix(pclc); + if (!pclc_prfx || + pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX) + return false; + if (hdr->version == SMC_V1) { if (hdr->typev1 == SMC_TYPE_N) return false; diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h index 58777b6a0dfe..81b247e38e7a 100644 --- a/net/smc/smc_clc.h +++ b/net/smc/smc_clc.h @@ -326,8 +326,12 @@ struct smc_clc_msg_decline_v2 { /* clc decline message */ static inline struct smc_clc_msg_proposal_prefix * smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc) { + u16 offset = ntohs(pclc->iparea_offset); + + if (offset > sizeof(struct smc_clc_msg_smcd)) + return NULL; return (struct smc_clc_msg_proposal_prefix *) - ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset)); + ((u8 *)pclc + sizeof(*pclc) + offset); } static inline bool smcr_indicated(int smc_type) -- 2.34.1

2 1

[PATCH OLK-5.10] net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
by Wang Liang 06 Feb '25

06 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v5.10.233 commit 846bada23bfcdeb83621b045ed85dc06c7833ff0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC74 CVE: CVE-2024-49571 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a29e220d3c8edbf0e1beb0f028878a4a85966556 ] When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field iparea_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks iparea_offset and ipv6_prefixes_cnt before using them. Fixes: e7b7a64a8493 ("smc: support variable CLC proposal messages") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 6 +++++- net/smc/smc_clc.c | 4 ++++ net/smc/smc_clc.h | 6 +++++- 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index f7a409132e2a..a365ea2f5484 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1761,6 +1761,8 @@ static int smc_listen_prfx_check(struct smc_sock *new_smc, if (pclc->hdr.typev1 == SMC_TYPE_N) return 0; pclc_prfx = smc_clc_proposal_get_prefix(pclc); + if (!pclc_prfx) + return -EPROTO; if (smc_clc_prfx_match(newclcsock, pclc_prfx)) return SMC_CLC_DECL_DIFFPREFIX; @@ -1917,7 +1919,9 @@ static void smc_find_ism_v1_device_serv(struct smc_sock *new_smc, struct smc_clc_msg_smcd *pclc_smcd = smc_get_clc_msg_smcd(pclc); /* check if ISM V1 is available */ - if (!(ini->smcd_version & SMC_V1) || !smcd_indicated(ini->smc_type_v1)) + if (!(ini->smcd_version & SMC_V1) || + !smcd_indicated(ini->smc_type_v1) || + !pclc_smcd) goto not_found; ini->is_smcd = true; /* prepare ISM check */ ini->ism_peer_gid[0] = ntohll(pclc_smcd->ism.gid); diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index 838470f897d0..614b48c490e2 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -49,6 +49,10 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) v2_ext = smc_get_clc_v2_ext(pclc); pclc_prfx = smc_clc_proposal_get_prefix(pclc); + if (!pclc_prfx || + pclc_prfx->ipv6_prefixes_cnt > SMC_CLC_MAX_V6_PREFIX) + return false; + if (hdr->version == SMC_V1) { if (hdr->typev1 == SMC_TYPE_N) return false; diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h index 49291909ffca..4b68eb626aa2 100644 --- a/net/smc/smc_clc.h +++ b/net/smc/smc_clc.h @@ -259,8 +259,12 @@ struct smc_clc_msg_decline { /* clc decline message */ static inline struct smc_clc_msg_proposal_prefix * smc_clc_proposal_get_prefix(struct smc_clc_msg_proposal *pclc) { + u16 offset = ntohs(pclc->iparea_offset); + + if (offset > sizeof(struct smc_clc_msg_smcd)) + return NULL; return (struct smc_clc_msg_proposal_prefix *) - ((u8 *)pclc + sizeof(*pclc) + ntohs(pclc->iparea_offset)); + ((u8 *)pclc + sizeof(*pclc) + offset); } static inline bool smcr_indicated(int smc_type) -- 2.34.1

2 1

[PATCH OLK-6.6] arm64/mpam: Add write memory barrier to guarantee monitor results
by Zeng Heng 06 Feb '25

06 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8T2RT -------------------------------- Before configure the PARTID of monitor instances, make sure CFG_MON_SEL register has already selected the target instance self. By the same reason, ensure the PARTID has been configured properly before reading counter result of the monitor instance. Fixes: bb66b4d115e5 ("arm_mpam: Add mpam_msmon_read() to read monitor value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 5ffa3cc8fb82..f266ff88686d 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -942,6 +942,9 @@ static void __ris_msmon_read(void *arg) FIELD_PREP(MSMON_CFG_MON_SEL_RIS, ris->ris_idx); mpam_write_monsel_reg(msc, CFG_MON_SEL, mon_sel); + /* Selects a monitor instance to configure PARTID. */ + wmb(); + if (m->type == mpam_feat_msmon_mbwu) { mbwu_state = &ris->mbwu_state[ctx->mon]; if (mbwu_state) { @@ -962,6 +965,12 @@ static void __ris_msmon_read(void *arg) if (config_mismatch || reset_on_next_read) write_msmon_ctl_flt_vals(m, ctl_val, flt_val); + /* + * Selects the monitor instance associated to the specified PARTID + * to read counter value. + */ + wmb(); + switch (m->type) { case mpam_feat_msmon_csu: now = mpam_read_monsel_reg(msc, CSU); -- 2.25.1

2 1

[PATCH OLK-6.6] bpf: Correct kabi breakage fixes for ext_mutex in struct bpf_prog_aux
by Tengda Wu 06 Feb '25

06 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIADD CVE: CVE-2024-47794 -------------------------------- The size of ext_mutex can vary from 32 to 160 bytes, depending on the number of macros enabled. When it reaches 160 bytes, ext_mutex requires at least 20 reserved fields, which exceeds the existing 8 reserved fields available in the 'bpf_prog_aux' structure. Use the KABI_EXTEND instead, which has no field size limitation, to fix this issue. Fixes: 87db4635bc89 ("bpf: Fix kabi breakage in struct bpf_prog_aux") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- include/linux/bpf.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index 8853a032cd26..c44d2557b3f1 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1544,17 +1544,14 @@ struct bpf_prog_aux { }; KABI_USE(1, u64 prog_array_member_cnt) /* counts how many times as member of prog_array */ -#ifdef __GENKSYMS__ KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) KABI_RESERVE(5) -#else - struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */ -#endif KABI_RESERVE(6) KABI_RESERVE(7) KABI_RESERVE(8) + KABI_EXTEND(struct mutex ext_mutex) /* mutex for is_extended and prog_array_member_cnt */ }; struct bpf_prog { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
by Zheng Zucheng 06 Feb '25

06 Feb '25

From: Biju Das <biju.das.jz(a)bp.renesas.com> stable inclusion from stable-v5.10.234 commit 49881fcef3d4b8733fcdcf76f1bc12ec291b74be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2S CVE: CVE-2024-57887 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 81adbd3ff21c1182e06aa02c6be0bfd9ea02d8e8 ] The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-free issue by dropping of_node_put() in adv7533_parse_dt() and calling of_node_put() in error path of probe() and also in the remove(). Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device") Cc: stable(a)vger.kernel.org Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas(a)ideasonboard.com> Signed-off-by: Biju Das <biju.das.jz(a)bp.renesas.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241119192040.152657-2-biju.… Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/bridge/adv7511/adv7511_drv.c [Context differences.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 5 ++++- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 -- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c index 31bce3a37b20..faf64f6c2a53 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c @@ -1125,7 +1125,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) ret = adv7511_init_regulators(adv7511); if (ret) { dev_err(dev, "failed to init regulators\n"); - return ret; + goto err_of_node_put; } /* @@ -1235,6 +1235,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) i2c_unregister_device(adv7511->i2c_edid); uninit_regulators: adv7511_uninit_regulators(adv7511); +err_of_node_put: + of_node_put(adv7511->host_node); return ret; } @@ -1249,6 +1251,7 @@ static int adv7511_remove(struct i2c_client *i2c) if (adv7511->cec_clk) clk_disable_unprepare(adv7511->cec_clk); + of_node_put(adv7511->host_node); adv7511_uninit_regulators(adv7511); drm_bridge_remove(&adv7511->bridge); diff --git a/drivers/gpu/drm/bridge/adv7511/adv7533.c b/drivers/gpu/drm/bridge/adv7511/adv7533.c index 185b6d842166..de0bd603baf1 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7533.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7533.c @@ -210,8 +210,6 @@ int adv7533_parse_dt(struct device_node *np, struct adv7511 *adv) if (!adv->host_node) return -ENODEV; - of_node_put(adv->host_node); - adv->use_timing_gen = !of_property_read_bool(np, "adi,disable-timing-generator"); -- 2.34.1

2 1

[PATCH OLK-6.6] drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
by Guo Mengqi 06 Feb '25

06 Feb '25

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> stable inclusion from stable-v6.6.68 commit b39de5a71bac5641d0fda33d1cf5682d82cf1ae5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBISDQ CVE: CVE-2024-56369 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9398332f23fab10c5ec57c168b44e72997d6318e upstream. drm_mode_vrefresh() is trying to avoid divide by zero by checking whether htotal or vtotal are zero. But we may still end up with a div-by-zero of vtotal*htotal*... Cc: stable(a)vger.kernel.org Reported-by: syzbot+622bba18029bcde672e1(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=622bba18029bcde672e1 Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241129042629.18280-2-ville.… Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/gpu/drm/drm_modes.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c index ac9a406250c5..9325b015c6c0 100644 --- a/drivers/gpu/drm/drm_modes.c +++ b/drivers/gpu/drm/drm_modes.c @@ -1285,14 +1285,11 @@ EXPORT_SYMBOL(drm_mode_set_name); */ int drm_mode_vrefresh(const struct drm_display_mode *mode) { - unsigned int num, den; + unsigned int num = 1, den = 1; if (mode->htotal == 0 || mode->vtotal == 0) return 0; - num = mode->clock; - den = mode->htotal * mode->vtotal; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) num *= 2; if (mode->flags & DRM_MODE_FLAG_DBLSCAN) @@ -1300,6 +1297,12 @@ int drm_mode_vrefresh(const struct drm_display_mode *mode) if (mode->vscan > 1) den *= mode->vscan; + if (check_mul_overflow(mode->clock, num, &num)) + return 0; + + if (check_mul_overflow(mode->htotal * mode->vtotal, den, &den)) + return 0; + return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den); } EXPORT_SYMBOL(drm_mode_vrefresh); -- 2.22.0

2 1

[PATCH OLK-6.6] platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
by Guo Mengqi 06 Feb '25

06 Feb '25

From: "Maciej S. Szmigiero" <mail(a)maciej.szmigiero.name> stable inclusion from stable-v6.6.72 commit 5cc621085e2b7a9b1905a98f8e5a86bb4aea2016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQOR CVE: CVE-2025-21645 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dd410d784402c5775f66faf8b624e85e41c38aaf ] Wakeup for IRQ1 should be disabled only in cases where i8042 had actually enabled it, otherwise "wake_depth" for this IRQ will try to drop below zero and there will be an unpleasant WARN() logged: kernel: atkbd serio0: Disabling IRQ1 wakeup source to avoid platform firmware bug kernel: ------------[ cut here ]------------ kernel: Unbalanced IRQ 1 wake disable kernel: WARNING: CPU: 10 PID: 6431 at kernel/irq/manage.c:920 irq_set_irq_wake+0x147/0x1a0 The PMC driver uses DEFINE_SIMPLE_DEV_PM_OPS() to define its dev_pm_ops which sets amd_pmc_suspend_handler() to the .suspend, .freeze, and .poweroff handlers. i8042_pm_suspend(), however, is only set as the .suspend handler. Fix the issue by call PMC suspend handler only from the same set of dev_pm_ops handlers as i8042_pm_suspend(), which currently means just the .suspend handler. To reproduce this issue try hibernating (S4) the machine after a fresh boot without putting it into s2idle first. Fixes: 8e60615e8932 ("platform/x86/amd: pmc: Disable IRQ1 wakeup for RN/CZN") Reviewed-by: Mario Limonciello <mario.limonciello(a)amd.com> Signed-off-by: Maciej S. Szmigiero <mail(a)maciej.szmigiero.name> Link: https://lore.kernel.org/r/c8f28c002ca3c66fbeeb850904a1f43118e17200.17361846… [ij: edited the commit message.] Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/platform/x86/amd/pmc/pmc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/platform/x86/amd/pmc/pmc.c b/drivers/platform/x86/amd/pmc/pmc.c index f49b1bb258c7..70907e8f3ea9 100644 --- a/drivers/platform/x86/amd/pmc/pmc.c +++ b/drivers/platform/x86/amd/pmc/pmc.c @@ -878,6 +878,10 @@ static int amd_pmc_suspend_handler(struct device *dev) { struct amd_pmc_dev *pdev = dev_get_drvdata(dev); + /* + * Must be called only from the same set of dev_pm_ops handlers + * as i8042_pm_suspend() is called: currently just from .suspend. + */ if (pdev->disable_8042_wakeup && !disable_workarounds) { int rc = amd_pmc_wa_irq1(pdev); @@ -890,7 +894,9 @@ static int amd_pmc_suspend_handler(struct device *dev) return 0; } -static DEFINE_SIMPLE_DEV_PM_OPS(amd_pmc_pm, amd_pmc_suspend_handler, NULL); +static const struct dev_pm_ops amd_pmc_pm = { + .suspend = amd_pmc_suspend_handler, +}; static const struct pci_device_id pmc_pci_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_PS) }, -- 2.22.0

2 1

[PATCH OLK-6.6] [Backport] misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
by Lin Ruifeng 06 Feb '25

06 Feb '25

From: Rengarajan S <rengarajan.s(a)microchip.com> stable inclusion from stable-v6.6.72 commit 25692750c0259c5b65afec467d97201a485e8a00 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQWF CVE: CVE-2024-57916 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 194f9f94a5169547d682e9bbcc5ae6d18a564735 upstream. Resolve kernel panic caused by improper handling of IRQs while accessing GPIO values. This is done by replacing generic_handle_irq with handle_nested_irq. Fixes: 1f4d8ae231f4 ("misc: microchip: pci1xxxx: Add gpio irq handler and irq helper functions irq_ack, irq_mask, irq_unmask and irq_set_type of irq_chip.") Cc: stable <stable(a)kernel.org> Signed-off-by: Rengarajan S <rengarajan.s(a)microchip.com> Link: https://lore.kernel.org/r/20241205133626.1483499-2-rengarajan.s@microchip.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c index e616e3ec2b42..558290bdb938 100644 --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_gpio.c @@ -277,7 +277,7 @@ static irqreturn_t pci1xxxx_gpio_irq_handler(int irq, void *dev_id) writel(BIT(bit), priv->reg_base + INTR_STATUS_OFFSET(gpiobank)); spin_unlock_irqrestore(&priv->lock, flags); irq = irq_find_mapping(gc->irq.domain, (bit + (gpiobank * 32))); - generic_handle_irq(irq); + handle_nested_irq(irq); } } spin_lock_irqsave(&priv->lock, flags); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] spi: mpc52xx: Add cancel_work_sync before module remove
by Zhang Kunbo 06 Feb '25

06 Feb '25

From: Pei Xiao <xiaopei01(a)kylinos.cn> stable inclusion from stable-v5.10.231 commit e0c6ce8424095c2da32a063d3fc027494c689817 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCM5 CVE: CVE-2024-50051 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 984836621aad98802d92c4a3047114cf518074c8 ] If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove. Fixes: ca632f556697 ("spi: reorganize drivers") Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Link: https://patch.msgid.link/1f16f8ae0e50ca9adb1dc849bf2ac65a40c9ceb9.173278300… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/spi/spi-mpc52xx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c index 0e55784a3ad9..99eb2cee6f37 100644 --- a/drivers/spi/spi-mpc52xx.c +++ b/drivers/spi/spi-mpc52xx.c @@ -520,6 +520,7 @@ static int mpc52xx_spi_remove(struct platform_device *op) struct mpc52xx_spi *ms = spi_master_get_devdata(master); int i; + cancel_work_sync(&ms->work); free_irq(ms->irq0, ms); free_irq(ms->irq1, ms); -- 2.34.1

2 1

[PATCH OLK-6.6] spi: mpc52xx: Add cancel_work_sync before module remove
by Zhang Kunbo 06 Feb '25

06 Feb '25

From: Pei Xiao <xiaopei01(a)kylinos.cn> stable inclusion from stable-v6.6.66 commit f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCM5 CVE: CVE-2024-50051 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 984836621aad98802d92c4a3047114cf518074c8 ] If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove. Fixes: ca632f556697 ("spi: reorganize drivers") Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Link: https://patch.msgid.link/1f16f8ae0e50ca9adb1dc849bf2ac65a40c9ceb9.173278300… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/spi/spi-mpc52xx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c index ab7df5f64342..b8e2d9263fc8 100644 --- a/drivers/spi/spi-mpc52xx.c +++ b/drivers/spi/spi-mpc52xx.c @@ -519,6 +519,7 @@ static void mpc52xx_spi_remove(struct platform_device *op) struct mpc52xx_spi *ms = spi_master_get_devdata(master); int i; + cancel_work_sync(&ms->work); free_irq(ms->irq0, ms); free_irq(ms->irq1, ms); -- 2.34.1

2 1

[PATCH OLK-5.10] spi: mpc52xx: Add cancel_work_sync before module remove
by Zhang Kunbo 06 Feb '25

06 Feb '25

From: Pei Xiao <xiaopei01(a)kylinos.cn> stable inclusion from stable-v5.10.231 commit e0c6ce8424095c2da32a063d3fc027494c689817 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCM5 CVE: CVE-2024-50051 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 984836621aad98802d92c4a3047114cf518074c8 ] If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove. Fixes: ca632f556697 ("spi: reorganize drivers") Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Link: https://patch.msgid.link/1f16f8ae0e50ca9adb1dc849bf2ac65a40c9ceb9.173278300… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/spi/spi-mpc52xx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/spi/spi-mpc52xx.c b/drivers/spi/spi-mpc52xx.c index ef2f24420460..be99efafabbc 100644 --- a/drivers/spi/spi-mpc52xx.c +++ b/drivers/spi/spi-mpc52xx.c @@ -519,6 +519,7 @@ static int mpc52xx_spi_remove(struct platform_device *op) struct mpc52xx_spi *ms = spi_master_get_devdata(master); int i; + cancel_work_sync(&ms->work); free_irq(ms->irq0, ms); free_irq(ms->irq1, ms); -- 2.34.1

2 1

[PATCH v2 OLK-5.10] nilfs2: prevent use of deleted inode
by Xiangwei Li 06 Feb '25

06 Feb '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v5.10.233 commit 5d4ed71327b0b5f3b179a19dc3c06be9509ab3db category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC7J CVE: CVE-2024-53690 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 901ce9705fbb9f330ff1f19600e5daf9770b0175 upstream. syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trigger warning in nilfs_rmdir. Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means that this inode has been deleted, and iput is executed to reclaim it. [1] WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407 ... Call Trace: <TASK> nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394 do_rmdir+0x3b5/0x580 fs/namei.c:4453 __do_sys_rmdir fs/namei.c:4472 [inline] __se_sys_rmdir fs/namei.c:4470 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://lkml.kernel.org/r/20241209065759.6781-1-konishi.ryusuke@gmail.com Fixes: d25006523d0b ("nilfs2: pathname operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9260555647a5132edd48 Tested-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/nilfs2/inode.c | 8 +++++++- fs/nilfs2/namei.c | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 06f4deb550c9..fe3f005d5d55 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -618,8 +618,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, inode = nilfs_iget_locked(sb, root, ino); if (unlikely(!inode)) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + + if (!(inode->i_state & I_NEW)) { + if (!inode->i_nlink) { + iput(inode); + return ERR_PTR(-ESTALE); + } return inode; + } err = __nilfs_read_inode(sb, root, ino, inode); if (unlikely(err)) { diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index eeccd69cd797..446af9c21a29 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) inode = NULL; } else { inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); + if (inode == ERR_PTR(-ESTALE)) { + nilfs_error(dir->i_sb, + "deleted inode referenced: %lu", ino); + return ERR_PTR(-EIO); + } } return d_splice_alias(inode, dentry); -- 2.25.1

2 1

[PATCH v2 OLK-6.6] nilfs2: prevent use of deleted inode
by Xiangwei Li 06 Feb '25

06 Feb '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.68 commit 284760b320a0bac411b18108316939707dccb12b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC7J CVE: CVE-2024-53690 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 901ce9705fbb9f330ff1f19600e5daf9770b0175 upstream. syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trigger warning in nilfs_rmdir. Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means that this inode has been deleted, and iput is executed to reclaim it. [1] WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407 ... Call Trace: <TASK> nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394 do_rmdir+0x3b5/0x580 fs/namei.c:4453 __do_sys_rmdir fs/namei.c:4472 [inline] __se_sys_rmdir fs/namei.c:4470 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://lkml.kernel.org/r/20241209065759.6781-1-konishi.ryusuke@gmail.com Fixes: d25006523d0b ("nilfs2: pathname operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9260555647a5132edd48 Tested-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/nilfs2/inode.c | 8 +++++++- fs/nilfs2/namei.c | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 8e1afa39a62e..d8bf86ec6d8d 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -614,8 +614,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, inode = nilfs_iget_locked(sb, root, ino); if (unlikely(!inode)) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + + if (!(inode->i_state & I_NEW)) { + if (!inode->i_nlink) { + iput(inode); + return ERR_PTR(-ESTALE); + } return inode; + } err = __nilfs_read_inode(sb, root, ino, inode); if (unlikely(err)) { diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index 7f71aa354f36..ac0adeb58e41 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) inode = NULL; } else { inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); + if (inode == ERR_PTR(-ESTALE)) { + nilfs_error(dir->i_sb, + "deleted inode referenced: %lu", ino); + return ERR_PTR(-EIO); + } } return d_splice_alias(inode, dentry); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Bluetooth: L2CAP: fix CVE-2024-56605
by Lin Ruifeng 06 Feb '25

06 Feb '25

Bluetooth: L2CAP: fix CVE-2024-56605 Fedor Pchelkin (1): Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc Ignat Korchagin (1): Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() net/bluetooth/l2cap_sock.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS 0/2] Bluetooth: L2CAP: fix CVE-2024-56605
by Lin Ruifeng 06 Feb '25

06 Feb '25

Bluetooth: L2CAP: fix CVE-2024-56605 Fedor Pchelkin (1): Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc Ignat Korchagin (1): Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() net/bluetooth/l2cap_sock.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.22.0

2 3

[PATCH OLK-5.10] nvme-rdma: unquiesce admin_q before destroy it
by Yu Kuai 06 Feb '25

06 Feb '25

From: "Chunguang.xu" <chunguang.xu(a)shopee.com> mainline inclusion from mainline-v6.13-rc2 commit 5858b687559809f05393af745cbadf06dee61295 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLET CVE: CVE-2024-49569 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362 #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b This due to we have quiesced admi_q before cancel requests, but forgot to unquiesce before destroy it, as a result we fail to drain the pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and simplify the code. Fixes: 958dc1d32c80 ("nvme-rdma: add clean action for failed reconnection") Reported-by: Yingfu.zhou <yingfu.zhou(a)shopee.com> Signed-off-by: Chunguang.xu <chunguang.xu(a)shopee.com> Signed-off-by: Yue.zhao <yue.zhao(a)shopee.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/rdma.c [Lots of patches change context] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/nvme/host/rdma.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index e7d5385ebc0b..1e6aa0731719 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -1167,11 +1167,7 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) nvme_rdma_destroy_io_queues(ctrl, new); } destroy_admin: - nvme_stop_admin_queue(&ctrl->ctrl); - blk_sync_queue(ctrl->ctrl.admin_q); - nvme_rdma_stop_queue(&ctrl->queues[0]); - nvme_cancel_admin_tagset(&ctrl->ctrl); - nvme_rdma_destroy_admin_queue(ctrl, new); + nvme_rdma_teardown_admin_queue(ctrl, new); return ret; } -- 2.39.2

2 1

[PATCH OLK-6.6] i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
by Yu Kuai 06 Feb '25

06 Feb '25

From: Jarkko Nikula <jarkko.nikula(a)linux.intel.com> stable inclusion from stable-v6.6.66 commit a6dc4b4fda2e147e557050eaae51ff15edeb680b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLEV CVE: CVE-2024-45828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 ] Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when the ring is being stopped. Depending on timing between ring stop request completion, interrupt handler removal and code execution this may lead to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run after the io_data pointer is set to NULL in hci_dma_cleanup(). Prevent this my masking the ring interrupts before ring stop request. Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com> Link: https://lore.kernel.org/r/20240920144432.62370-2-jarkko.nikula@linux.intel.… Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c index edc3a69bfe31..bcc0c7d4131f 100644 --- a/drivers/i3c/master/mipi-i3c-hci/dma.c +++ b/drivers/i3c/master/mipi-i3c-hci/dma.c @@ -174,10 +174,10 @@ static void hci_dma_cleanup(struct i3c_hci *hci) for (i = 0; i < rings->total; i++) { rh = &rings->headers[i]; + rh_reg_write(INTR_SIGNAL_ENABLE, 0); rh_reg_write(RING_CONTROL, 0); rh_reg_write(CR_SETUP, 0); rh_reg_write(IBI_SETUP, 0); - rh_reg_write(INTR_SIGNAL_ENABLE, 0); if (rh->xfer) dma_free_coherent(&hci->master.dev, -- 2.39.2

2 1

[PATCH OLK-6.6] nvme-rdma: unquiesce admin_q before destroy it
by Yu Kuai 06 Feb '25

06 Feb '25

From: "Chunguang.xu" <chunguang.xu(a)shopee.com> mainline inclusion from mainline-v6.13-rc2 commit 5858b687559809f05393af745cbadf06dee61295 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLET CVE: CVE-2024-49569 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362 #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b This due to we have quiesced admi_q before cancel requests, but forgot to unquiesce before destroy it, as a result we fail to drain the pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and simplify the code. Fixes: 958dc1d32c80 ("nvme-rdma: add clean action for failed reconnection") Reported-by: Yingfu.zhou <yingfu.zhou(a)shopee.com> Signed-off-by: Chunguang.xu <chunguang.xu(a)shopee.com> Signed-off-by: Yue.zhao <yue.zhao(a)shopee.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/rdma.c [commit 3af755a46881 ("nvme: move nvme_stop_keep_alive() back to original position") is not backported.] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/nvme/host/rdma.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index c04317a966b3..055b95d2ce93 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -1083,13 +1083,7 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) nvme_rdma_free_io_queues(ctrl); } destroy_admin: - nvme_quiesce_admin_queue(&ctrl->ctrl); - blk_sync_queue(ctrl->ctrl.admin_q); - nvme_rdma_stop_queue(&ctrl->queues[0]); - nvme_cancel_admin_tagset(&ctrl->ctrl); - if (new) - nvme_remove_admin_tag_set(&ctrl->ctrl); - nvme_rdma_destroy_admin_queue(ctrl); + nvme_rdma_teardown_admin_queue(ctrl, new); return ret; } -- 2.39.2

2 1

[PATCH OLK-6.6] iio: adc: at91: call input_free_device() on allocated iio_dev
by Wupeng Ma 06 Feb '25

06 Feb '25

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v6.6.72 commit 09e067e3c83e0695d338e8a26916e3c2bc44be02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQWA CVE: CVE-2024-57904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de6a73bad1743e9e81ea5a24c178c67429ff510b upstream. Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input. Fixes: 84882b060301 ("iio: adc: at91_adc: Add support for touchscreens without TSMR") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Link: https://patch.msgid.link/20241207043045.1255409-1-joe@pf.is.s.u-tokyo.ac.jp Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/iio/adc/at91_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c index de6650f9c4b1c..55f0c1afe505e 100644 --- a/drivers/iio/adc/at91_adc.c +++ b/drivers/iio/adc/at91_adc.c @@ -984,7 +984,7 @@ static int at91_ts_register(struct iio_dev *idev, return ret; err: - input_free_device(st->ts_input); + input_free_device(input); return ret; } -- 2.43.0

2 1

[openeuler:OLK-6.6] BUILD REGRESSION ab9846a05b4f9f25dc949268252f3a898041dd7d
by kernel test robot 06 Feb '25

06 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: ab9846a05b4f9f25dc949268252f3a898041dd7d !14952 drm/mediatek: Set private->all_drm_private[i Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-004-20250205 | |-- drivers-cpufreq-cppc_cpufreq.c:error:invalid-use-of-undefined-type-struct-fb_ctr_pair | |-- drivers-cpufreq-cppc_cpufreq.c:error:storage-size-of-fb_ctrs-isn-t-known | |-- drivers-cpufreq-cppc_cpufreq.c:error:struct-fb_ctr_pair-has-no-member-named-cpu | |-- drivers-cpufreq-cppc_cpufreq.c:error:variable-fb_ctrs-has-initializer-but-incomplete-type | |-- drivers-cpufreq-cppc_cpufreq.c:warning:excess-elements-in-struct-initializer | `-- drivers-cpufreq-cppc_cpufreq.c:warning:unused-variable-fb_ctrs |-- loongarch-allmodconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-buildonly-randconfig-002-20250205 `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_dev_user.o:warning:objtool:nbl_dev_start_user_dev-falls-through-to-next-function-__cfi_nbl_mdev_device_release() elapsed time: 938m configs tested: 19 configs skipped: 123 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250205 gcc-14.2.0 arm64 randconfig-002-20250205 gcc-14.2.0 arm64 randconfig-003-20250205 gcc-14.2.0 arm64 randconfig-004-20250205 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250205 gcc-14.2.0 loongarch randconfig-002-20250205 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250205 clang-19 x86_64 buildonly-randconfig-002-20250205 clang-19 x86_64 buildonly-randconfig-003-20250205 clang-19 x86_64 buildonly-randconfig-004-20250205 gcc-12 x86_64 buildonly-randconfig-005-20250205 clang-19 x86_64 buildonly-randconfig-006-20250205 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 86893ebd6e3edffebb8d7dc1091533735c6bb082
by kernel test robot 06 Feb '25

06 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 86893ebd6e3edffebb8d7dc1091533735c6bb082 !14995 mm/compaction: fix UBSAN shift-out-of-bounds warning Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502051727.gu6nNdpL-lkp@intel.com ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-001-20250205 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-002-20250205 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-003-20250205 | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-004-20250205 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:error:struct-iommu_iotlb_gather-has-no-member-named-end | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:error:struct-iommu_iotlb_gather-has-no-member-named-pgsize | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:error:struct-iommu_iotlb_gather-has-no-member-named-start | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | `-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets |-- x86_64-buildonly-randconfig-001-20250205 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250205 | |-- block-blk-cgroup.o:warning:objtool:local_lock_release:unreachable-instruction | |-- block-blk-ioc.o:warning:objtool:local_lock_release:unreachable-instruction | |-- block-genhd.o:warning:objtool:local_lock_release:unreachable-instruction | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-firewire-core-cdev.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-misc-cardreader-rtsx_pcr.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-misc-pci_endpoint_test.o:warning:objtool:pci_endpoint_test_ioctl:unreachable-instruction | |-- drivers-misc-tifm_core.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-scsi-sg.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-thunderbolt-ctl.o:warning:objtool:tb_ctl_tx:unreachable-instruction | |-- drivers-thunderbolt-nhi.o:warning:objtool:tb_ring_start:unreachable-instruction | |-- drivers-thunderbolt-path.o:warning:objtool:tb_path_deactivate:unreachable-instruction | |-- drivers-thunderbolt-switch.o:warning:objtool:tb_wait_for_port:unreachable-instruction | |-- drivers-thunderbolt-tunnel.o:warning:objtool:tb_dp_xchg_caps:unreachable-instruction | |-- fs-btrfs-extent_io.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-btrfs-reada.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-btrfs-reflink.o:warning:objtool:clone_copy_inline_extent:unreachable-instruction | |-- fs-btrfs-volumes.o:warning:objtool:btrfs_shrink_device:unreachable-instruction | |-- fs-xfs-xfs_icache.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-xfs-xfs_mount.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-xfs-xfs_mru_cache.o:warning:objtool:local_lock_release:unreachable-instruction | |-- kernel-cgroup-cgroup.o:warning:objtool:local_lock_release:unreachable-instruction | |-- kernel-irq-irqdomain.o:warning:objtool:irq_create_mapping_affinity:unreachable-instruction | |-- kernel-locking-mutex.o:warning:objtool:mutex_trylock:unreachable-instruction | |-- kernel-rcu-update.o:warning:objtool:rcutorture_sched_setaffinity:unreachable-instruction | |-- kernel-sched-completion.o:warning:objtool:complete_all:unreachable-instruction | `-- mm-swap.o:warning:objtool:local_lock_acquire:unreachable-instruction |-- x86_64-buildonly-randconfig-003-20250205 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250205 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-005-20250205 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250205 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-defconfig |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page elapsed time: 737m configs tested: 15 configs skipped: 102 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250205 gcc-14.2.0 arm64 randconfig-002-20250205 gcc-14.2.0 arm64 randconfig-003-20250205 gcc-14.2.0 arm64 randconfig-004-20250205 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250205 clang-19 x86_64 buildonly-randconfig-002-20250205 clang-19 x86_64 buildonly-randconfig-003-20250205 clang-19 x86_64 buildonly-randconfig-004-20250205 gcc-12 x86_64 buildonly-randconfig-005-20250205 clang-19 x86_64 buildonly-randconfig-006-20250205 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2722/2722] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:417:21: error: 'struct iommu_iotlb_gather' has no member named 'start'
by kernel test robot 05 Feb '25

05 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 630e9af0966732abe6cd6abe26c09a26f5771a43 commit: 3302f7f978fd408550824b3b33cb7b9922a8331a [2722/2722] net: hns3: add sync command to sync io-pgtable config: arm64-randconfig-004-20250205 (https://download.01.org/0day-ci/archive/20250205/202502051858.byDv5m4A-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250205/202502051858.byDv5m4A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502051858.byDv5m4A-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_dma_map_sync': >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:417:21: error: 'struct iommu_iotlb_gather' has no member named 'start' 417 | iotlb_gather.start = iova; | ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:418:21: error: 'struct iommu_iotlb_gather' has no member named 'end' 418 | iotlb_gather.end = iova + granule - 1; | ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:419:21: error: 'struct iommu_iotlb_gather' has no member named 'pgsize' 419 | iotlb_gather.pgsize = granule; | ^ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_client_init': drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5895:1: warning: label 'out_dbg_init' defined but not used [-Wunused-label] 5895 | out_dbg_init: | ^~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_reset_notify_init_enet': drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:6207:1: warning: label 'err_init_guid_fail' defined but not used [-Wunused-label] 6207 | err_init_guid_fail: | ^~~~~~~~~~~~~~~~~~ vim +417 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 402 403 #define HNS3_INVALID_PTYPE \ 404 ARRAY_SIZE(hns3_rx_ptype_tbl) 405 406 static void hns3_dma_map_sync(struct device *dev, unsigned long iova) 407 { 408 struct iommu_domain *domain = iommu_get_domain_for_dev(dev); 409 struct iommu_iotlb_gather iotlb_gather; 410 size_t granule; 411 412 if (!domain || domain->type != IOMMU_DOMAIN_DMA) 413 return; 414 415 granule = 1 << __ffs(domain->pgsize_bitmap); 416 iova = ALIGN_DOWN(iova, granule); > 417 iotlb_gather.start = iova; > 418 iotlb_gather.end = iova + granule - 1; > 419 iotlb_gather.pgsize = granule; 420 421 iommu_iotlb_sync(domain, &iotlb_gather); 422 } 423 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] nilfs2: prevent use of deleted inode
by Xiangwei Li 05 Feb '25

05 Feb '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v5.10.233 commit 5d4ed71327b0b5f3b179a19dc3c06be9509ab3db category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBJC7J CVE: CVE-2024-53690 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 901ce9705fbb9f330ff1f19600e5daf9770b0175 upstream. syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trigger warning in nilfs_rmdir. Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means that this inode has been deleted, and iput is executed to reclaim it. [1] WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407 ... Call Trace: <TASK> nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394 do_rmdir+0x3b5/0x580 fs/namei.c:4453 __do_sys_rmdir fs/namei.c:4472 [inline] __se_sys_rmdir fs/namei.c:4470 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://lkml.kernel.org/r/20241209065759.6781-1-konishi.ryusuke@gmail.com Fixes: d25006523d0b ("nilfs2: pathname operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9260555647a5132edd48 Tested-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/nilfs2/inode.c | 8 +++++++- fs/nilfs2/namei.c | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 06f4deb550c9..fe3f005d5d55 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -618,8 +618,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, inode = nilfs_iget_locked(sb, root, ino); if (unlikely(!inode)) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + + if (!(inode->i_state & I_NEW)) { + if (!inode->i_nlink) { + iput(inode); + return ERR_PTR(-ESTALE); + } return inode; + } err = __nilfs_read_inode(sb, root, ino, inode); if (unlikely(err)) { diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index eeccd69cd797..446af9c21a29 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) inode = NULL; } else { inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); + if (inode == ERR_PTR(-ESTALE)) { + nilfs_error(dir->i_sb, + "deleted inode referenced: %lu", ino); + return ERR_PTR(-EIO); + } } return d_splice_alias(inode, dentry); -- 2.25.1

2 1

[PATCH OLK-6.6] nilfs2: prevent use of deleted inode
by Xiangwei Li 05 Feb '25

05 Feb '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.68 commit 284760b320a0bac411b18108316939707dccb12b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBJC7J CVE: CVE-2024-53690 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 901ce9705fbb9f330ff1f19600e5daf9770b0175 upstream. syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trigger warning in nilfs_rmdir. Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means that this inode has been deleted, and iput is executed to reclaim it. [1] WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407 ... Call Trace: <TASK> nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394 do_rmdir+0x3b5/0x580 fs/namei.c:4453 __do_sys_rmdir fs/namei.c:4472 [inline] __se_sys_rmdir fs/namei.c:4470 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://lkml.kernel.org/r/20241209065759.6781-1-konishi.ryusuke@gmail.com Fixes: d25006523d0b ("nilfs2: pathname operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9260555647a5132edd48 Tested-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/nilfs2/inode.c | 8 +++++++- fs/nilfs2/namei.c | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 8e1afa39a62e..d8bf86ec6d8d 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -614,8 +614,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, inode = nilfs_iget_locked(sb, root, ino); if (unlikely(!inode)) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + + if (!(inode->i_state & I_NEW)) { + if (!inode->i_nlink) { + iput(inode); + return ERR_PTR(-ESTALE); + } return inode; + } err = __nilfs_read_inode(sb, root, ino, inode); if (unlikely(err)) { diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index 7f71aa354f36..ac0adeb58e41 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) inode = NULL; } else { inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); + if (inode == ERR_PTR(-ESTALE)) { + nilfs_error(dir->i_sb, + "deleted inode referenced: %lu", ino); + return ERR_PTR(-EIO); + } } return d_splice_alias(inode, dentry); -- 2.25.1

2 1

[openeuler:OLK-5.10 2722/2722] ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined
by kernel test robot 05 Feb '25

05 Feb '25

Hi Sean, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 86893ebd6e3edffebb8d7dc1091533735c6bb082 commit: 5476cb89ef2297bd36f8b38e27b54617b6f63236 [2722/2722] x86/vdso: Implement a vDSO for Intel SGX enclave call config: x86_64-buildonly-randconfig-001-20250205 (https://download.01.org/0day-ci/archive/20250205/202502051727.gu6nNdpL-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250205/202502051727.gu6nNdpL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502051727.gu6nNdpL-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined >> llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory -- >> llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] [Backport] riscv: Fix sleeping in invalid context in die()
by Yongjian Sun 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.12-rc3 commit 6a97f4118ac07cfdc316433f385dbdc12af5025e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6SH CVE: CVE-2024-57939 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. That causes the following warning: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex preempt_count: 110001, expected: 0 RCU nest depth: 0, expected: 0 CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234 Hardware name: riscv-virtio,qemu (DT) Call Trace: dump_backtrace+0x1c/0x24 show_stack+0x2c/0x38 dump_stack_lvl+0x5a/0x72 dump_stack+0x14/0x1c __might_resched+0x130/0x13a rt_spin_lock+0x2a/0x5c die+0x24/0x112 do_trap_insn_illegal+0xa0/0xea _new_vmalloc_restore_context_a0+0xcc/0xd8 Oops - illegal instruction [#1] Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT enabled. Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") Signed-off-by: Nam Cao <namcao(a)linutronix.de> Cc: stable(a)vger.kernel.org Reviewed-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Link: https://lore.kernel.org/r/20241118091333.1185288-1-namcao@linutronix.de Signed-off-by: Palmer Dabbelt <palmer(a)rivosinc.com> Conflicts: arch/riscv/kernel/traps.c [Context Changed] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- arch/riscv/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c index c02e3c6df4eb..a37ca944b1b3 100644 --- a/arch/riscv/kernel/traps.c +++ b/arch/riscv/kernel/traps.c @@ -37,7 +37,7 @@ int show_unhandled_signals = 1; -static DEFINE_SPINLOCK(die_lock); +static DEFINE_RAW_SPINLOCK(die_lock); static void dump_kernel_instr(const char *loglvl, struct pt_regs *regs) { @@ -69,7 +69,7 @@ void die(struct pt_regs *regs, const char *str) oops_enter(); - spin_lock_irqsave(&die_lock, flags); + raw_spin_lock_irqsave(&die_lock, flags); console_verbose(); bust_spinlocks(1); @@ -88,7 +88,7 @@ void die(struct pt_regs *regs, const char *str) bust_spinlocks(0); add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); - spin_unlock_irqrestore(&die_lock, flags); + raw_spin_unlock_irqrestore(&die_lock, flags); oops_exit(); if (in_interrupt()) -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] CVE-2025-21668
by Lin Yujun 05 Feb '25

05 Feb '25

Xiaolei Wang (1): pmdomain: imx8mp-blk-ctrl: add missing loop break condition drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] scsi: bfa: Fix use-after-free in bfad_im_module_exit()
by Chen Zhongjin 05 Feb '25

05 Feb '25

From: Ye Bin <yebin10(a)huawei.com> stable inclusion from stable-v4.19.325 commit 0ceac8012d3ddea3317f0d82934293d05feb8af1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFA CVE: CVE-2024-53227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ] BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: <TASK> dump_stack_lvl+0x95/0xe0 print_report+0xcb/0x620 kasan_report+0xbd/0xf0 __lock_acquire+0x2aca/0x3a20 lock_acquire+0x19b/0x520 _raw_spin_lock+0x2b/0x40 attribute_container_unregister+0x30/0x160 fc_release_transport+0x19/0x90 [scsi_transport_fc] bfad_im_module_exit+0x23/0x60 [bfa] bfad_init+0xdb/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] bfad_im_module_init+0x17/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kfree+0x212/0x480 bfad_im_module_init+0x7e/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Above issue happens as follows: bfad_init error = bfad_im_module_init() fc_release_transport(bfad_im_scsi_transport_template); if (error) goto ext; ext: bfad_im_module_exit(); fc_release_transport(bfad_im_scsi_transport_template); --> Trigger double release Don't call bfad_im_module_exit() if bfad_im_module_init() failed. Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/scsi/bfa/bfad.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c index bd7e6a6fc1f1..7a2a9b05ed09 100644 --- a/drivers/scsi/bfa/bfad.c +++ b/drivers/scsi/bfa/bfad.c @@ -1711,9 +1711,8 @@ bfad_init(void) error = bfad_im_module_init(); if (error) { - error = -ENOMEM; printk(KERN_WARNING "bfad_im_module_init failure\n"); - goto ext; + return -ENOMEM; } if (strcmp(FCPI_NAME, " fcpim") == 0) -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
by Wang Wensheng 05 Feb '25

05 Feb '25

From: Ping-Ke Shih <pkshih(a)realtek.com> stable inclusion from stable-v6.6.66 commit 1a0f54cb3fea5d087440b2bae03202c445156a8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI835 CVE: CVE-2024-48873 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c ] The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access. Addresses-Coverity-ID: 1529805 ("Dereference null return value") Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240919081216.28505-2-pkshih@realtek.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 468cfa43ec04..a8e2efae6e52 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -3662,6 +3662,9 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev, skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr, NULL, 0, req->ie_len); + if (!skb) + return -ENOMEM; + skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]); skb_put_data(skb, ies->common_ies, ies->common_ie_len); hdr = (struct ieee80211_hdr *)skb->data; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] mm/compaction: fix UBSAN shift-out-of-bounds warning
by Liu Shixin 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.14-rc1 commit d1366e74342e75555af2648a2964deb2d5c92200 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBK3VP CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus compound_order can be any value because it is union with flags. Add back the MAX_PAGE_ORDER check to fix the warning. Link: https://lkml.kernel.org/r/20250123021029.2826736-1-liushixin2@huawei.com Fixes: 3da0272a4c7d ("mm/compaction: correctly return failure with bogus compound_order in strict mode") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kemeng Shi <shikemeng(a)huaweicloud.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/compaction.c [ This is partial revert of commit 343e35e561bc. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/compaction.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compaction.c index 8010521ff969..e7c1ffc23c9a 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -476,7 +476,8 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, if (PageCompound(page)) { const unsigned int order = compound_order(page); - if (blockpfn + (1UL << order) <= end_pfn) { + if (likely(order < MAX_ORDER) && + (blockpfn + (1UL << order) <= end_pfn)) { blockpfn += (1UL << order) - 1; cursor += (1UL << order) - 1; } -- 2.34.1

2 1

[PATCH OLK-5.10] mm/compaction: fix UBSAN shift-out-of-bounds warning
by Liu Shixin 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.14-rc1 commit d1366e74342e75555af2648a2964deb2d5c92200 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBK36F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus compound_order can be any value because it is union with flags. Add back the MAX_PAGE_ORDER check to fix the warning. Link: https://lkml.kernel.org/r/20250123021029.2826736-1-liushixin2@huawei.com Fixes: 3da0272a4c7d ("mm/compaction: correctly return failure with bogus compound_order in strict mode") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kemeng Shi <shikemeng(a)huaweicloud.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/compaction.c [ This is partial revert of commit 5d2cd4265a04. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/compaction.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compaction.c index 6035aa46c8ac..c0874138ec3a 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -599,7 +599,8 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, if (PageCompound(page)) { const unsigned int order = compound_order(page); - if (blockpfn + (1UL << order) <= end_pfn) { + if (likely(order < MAX_ORDER) && + (blockpfn + (1UL << order) <= end_pfn)) { blockpfn += (1UL << order) - 1; cursor += (1UL << order) - 1; } -- 2.34.1

2 1

[PATCH OLK-6.6] mm/compaction: fix UBSAN shift-out-of-bounds warning
by Liu Shixin 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.14-rc1 commit d1366e74342e75555af2648a2964deb2d5c92200 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBK4CZ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus compound_order can be any value because it is union with flags. Add back the MAX_PAGE_ORDER check to fix the warning. Link: https://lkml.kernel.org/r/20250123021029.2826736-1-liushixin2@huawei.com Fixes: 3da0272a4c7d ("mm/compaction: correctly return failure with bogus compound_order in strict mode") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kemeng Shi <shikemeng(a)huaweicloud.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/compaction.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compaction.c index e2735752c374..4a3a5c7607f3 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -650,7 +650,8 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, if (PageCompound(page)) { const unsigned int order = compound_order(page); - if (blockpfn + (1UL << order) <= end_pfn) { + if ((order <= MAX_PAGE_ORDER) && + (blockpfn + (1UL << order) <= end_pfn)) { blockpfn += (1UL << order) - 1; page += (1UL << order) - 1; nr_scanned += (1UL << order) - 1; -- 2.34.1

2 1

[PATCH OLK-6.6] arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
by Liu Mingrui 05 Feb '25

05 Feb '25

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.66 commit 96035c0093db258975b8887676afe59a64c34a72 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBH1XN CVE: CVE-2024-57874 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca62d90085f4af36de745883faab9f8a7cbb45d3 upstream. Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and rejects other values, a partial SETREGSET attempt will randomly succeed or fail depending on the value of the uninitialized value, and the exposure is significantly limited. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing value of the tagged address ctrl will be retained. The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the user_aarch64_view used by a native AArch64 task to manipulate another native AArch64 task. As get_tagged_addr_ctrl() only returns an error value when called for a compat task, tagged_addr_ctrl_get() and tagged_addr_ctrl_set() should never observe an error value from get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that such an error would be unexpected, and error handlnig is not missing in either case. Fixes: 2200aa7154cb ("arm64: mte: ptrace: Add NT_ARM_TAGGED_ADDR_CTRL regset") Cc: <stable(a)vger.kernel.org> # 5.10.x Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20241205121655.1824269-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- arch/arm64/kernel/ptrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 28a5ddcf0a1e..d34b57caad49 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -1384,7 +1384,7 @@ static int tagged_addr_ctrl_get(struct task_struct *target, { long ctrl = get_tagged_addr_ctrl(target); - if (IS_ERR_VALUE(ctrl)) + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) return ctrl; return membuf_write(&to, &ctrl, sizeof(ctrl)); @@ -1398,6 +1398,10 @@ static int tagged_addr_ctrl_set(struct task_struct *target, const struct int ret; long ctrl; + ctrl = get_tagged_addr_ctrl(target); + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) + return ctrl; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1); if (ret) return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: seq: oss: Fix races at processing SysEx messages
by Gu Bowen 05 Feb '25

05 Feb '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.70 commit d2392b79d8af3714ea8878b71c66dc49d3110f44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2T CVE: CVE-2024-57893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0179488ca992d79908b8e26b9213f1554fc5bacc upstream. OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets. Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> Closes: https://lore.kernel.org/2B7E93E4-B13A-4AE4-8E87-306A8EE9BBB7@m.fudan.edu.cn Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20241230110543.32454-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: sound/core/seq/oss/seq_oss_synth.c [Commit 54da6a092431("locking: Introduce __cleanup() based infrastructure") not merged, The guard() function is not introduced.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- sound/core/seq/oss/seq_oss_synth.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c index c93945917235..33dbe0223326 100644 --- a/sound/core/seq/oss/seq_oss_synth.c +++ b/sound/core/seq/oss/seq_oss_synth.c @@ -79,6 +79,7 @@ static struct seq_oss_synth midi_synth_dev = { }; static DEFINE_SPINLOCK(register_lock); +static DEFINE_MUTEX(sysex_mutex); /* * prototypes @@ -504,16 +505,20 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, unsigned char *dest; struct seq_oss_synth_sysex *sysex; struct seq_oss_synthinfo *info; + int err = -EINVAL; info = snd_seq_oss_synth_info(dp, dev); if (!info) return -ENXIO; + mutex_lock(&sysex_mutex); sysex = info->sysex; if (sysex == NULL) { sysex = kzalloc(sizeof(*sysex), GFP_KERNEL); - if (sysex == NULL) - return -ENOMEM; + if (sysex == NULL) { + err = -ENOMEM; + goto unlock_sysex; + } info->sysex = sysex; } @@ -538,19 +543,25 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, if (sysex->skip) { sysex->skip = 0; sysex->len = 0; - return -EINVAL; /* skip */ + err = -EINVAL; /* skip */ + goto unlock_sysex; } /* copy the data to event record and send it */ ev->flags = SNDRV_SEQ_EVENT_LENGTH_VARIABLE; - if (snd_seq_oss_synth_addr(dp, dev, ev)) - return -EINVAL; + if (snd_seq_oss_synth_addr(dp, dev, ev)) { + err = -EINVAL; + goto unlock_sysex; + } ev->data.ext.len = sysex->len; ev->data.ext.ptr = sysex->buf; sysex->len = 0; + mutex_unlock(&sysex_mutex); return 0; } - return -EINVAL; /* skip */ +unlock_sysex: + mutex_unlock(&sysex_mutex); + return err; /* skip */ } /* -- 2.25.1

2 1

[PATCH OLK-5.10] usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
by GONG Ruiqi 05 Feb '25

05 Feb '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.13-rc1 commit e56aac6e5a25630645607b6856d4b2a17b2311a5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFV CVE: CVE-2024-53203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow. Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.moun… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/typec/ucsi/ucsi_ccg.c [It comes from two reasons: 1. the lack of commit 13f2ec3115c8, which refactors ucsi_ccg_sync_write() to ucsi_ccg_sync_control(); 2. a possible error within the original upstream patch, causing the imbalance of pm_runtime_{get,put}_sync().] Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c index 6db7c8ddd51c..2f2cb3fc8581 100644 --- a/drivers/usb/typec/ucsi/ucsi_ccg.c +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c @@ -571,6 +571,10 @@ static int ucsi_ccg_sync_write(struct ucsi *ucsi, unsigned int offset, uc->has_multiple_dp) { con_index = (uc->last_cmd_sent >> 16) & UCSI_CMD_CONNECTOR_MASK; + if (con_index == 0) { + ret = -EINVAL; + goto err_clear_bit; + } con = &uc->ucsi->connector[con_index - 1]; ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); } -- 2.25.1

2 1