- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 1834/1834] drivers/scsi/hpsa.o: warning: objtool: hpsa_find_cfg_addrs+0x123: unreachable instruction
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 241ad43fe7e9c24d5ba4cdd1ec22e731cdd22d14 [1834/1834] Compiler: Add clang's PGO support for kernel. config: x86_64-randconfig-102-20250122 (https://download.01.org/0day-ci/archive/20250122/202501220929.hTMn2Z7o-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501220929.hTMn2Z7o-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501220929.hTMn2Z7o-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/scsi/hpsa.c:24: In file included from include/linux/pci.h:1666: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ 5 warnings generated. >> drivers/scsi/hpsa.o: warning: objtool: hpsa_find_cfg_addrs+0x123: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1834/1834] drivers/net/can/spi/mcp251xfd/mcp251xfd-core.o: warning: objtool: mcp251xfd_chip_softreset+0x2fd: unreachable instruction
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 241ad43fe7e9c24d5ba4cdd1ec22e731cdd22d14 [1834/1834] Compiler: Add clang's PGO support for kernel. config: x86_64-randconfig-101-20250122 (https://download.01.org/0day-ci/archive/20250122/202501220937.KjMFVpWd-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501220937.KjMFVpWd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501220937.KjMFVpWd-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:24: In file included from drivers/net/can/spi/mcp251xfd/mcp251xfd.h:14: In file included from include/linux/can/core.h:18: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/x86/include/asm/cacheflush.h:5: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ 1 warning generated. >> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.o: warning: objtool: mcp251xfd_chip_softreset+0x2fd: unreachable instruction >> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.o: warning: objtool: mcp251xfd_chip_wait_for_osc_ready+0x32a: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1410/1410] mm/vmscan.c:3257:28: error: implicit declaration of function 'kernel_swap_enabled'; did you mean 'kernfs_ns_enabled'?
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: fdf62dff2537450d438667d817333e17ec71148a commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1410/1410] etmem: add original kernel swap enabled options config: x86_64-randconfig-102-20250121 (https://download.01.org/0day-ci/archive/20250122/202501220839.T9NIZlrQ-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501220839.T9NIZlrQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501220839.T9NIZlrQ-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/gpu/drm/ttm/ttm_object.c:60: error: Cannot parse struct or union! drivers/gpu/drm/ttm/ttm_object.c:98: warning: Function parameter or member 'mem_glob' not described in 'ttm_object_device' drivers/gpu/drm/ttm/ttm_object.c:98: warning: Function parameter or member 'ops' not described in 'ttm_object_device' drivers/gpu/drm/ttm/ttm_object.c:98: warning: Function parameter or member 'dmabuf_release' not described in 'ttm_object_device' drivers/gpu/drm/ttm/ttm_object.c:98: warning: Function parameter or member 'dma_buf_size' not described in 'ttm_object_device' drivers/gpu/drm/ttm/ttm_object.c:129: warning: Function parameter or member 'rcu_head' not described in 'ttm_ref_object' drivers/gpu/drm/ttm/ttm_object.c:129: warning: Function parameter or member 'tfile' not described in 'ttm_ref_object' drivers/gpu/drm/ttm/ttm_object.c:561: warning: Function parameter or member 'dmabuf' not described in 'get_dma_buf_unless_doomed' drivers/gpu/drm/ttm/ttm_object.c:561: warning: Excess function parameter 'dma_buf' description in 'get_dma_buf_unless_doomed' -- drivers/pinctrl/core.c:168: warning: Function parameter or member 'pin' not described in 'pin_get_name' drivers/pinctrl/core.c:168: warning: Excess function parameter 'name' description in 'pin_get_name' drivers/pinctrl/core.c:607: warning: Function parameter or member 'selector' not described in 'pinctrl_generic_get_group' drivers/pinctrl/core.c:607: warning: Excess function parameter 'gselector' description in 'pinctrl_generic_get_group' >> drivers/pinctrl/core.c:1338: error: Cannot parse struct or union! drivers/pinctrl/core.c:2226: warning: Function parameter or member 'pctldev' not described in 'devm_pinctrl_register_and_init' -- mm/vmscan.c: In function 'kernel_swap_check': >> mm/vmscan.c:3257:28: error: implicit declaration of function 'kernel_swap_enabled'; did you mean 'kernfs_ns_enabled'? [-Werror=implicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^~~~~~~~~~~~~~~~~~~ | kernfs_ns_enabled cc1: some warnings being treated as errors vim +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION fdf62dff2537450d438667d817333e17ec71148a
by kernel test robot 22 Jan '25

22 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: fdf62dff2537450d438667d817333e17ec71148a !14254 [openEuler-1.0-LTS]fix wangxun 1G/10G drivers hardware tx unit hang. Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501220126.4njU5YRX-lkp@intel.com drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5164:6: warning: unused variable 'len' [-Wunused-variable] include/linux/uaccess.h:115:17: warning: 'gpu32' may be used uninitialized [-Wmaybe-uninitialized] kernel/.tmp_kthread.o: warning: objtool: kthread_destroy_worker()+0xdc: unreachable instruction kernel/rcu/tree.o: warning: objtool: rcu_note_context_switch()+0x2f9: can't find switch jump table Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-allnoconfig | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- arm64-defconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-randconfig-001-20250121 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-uaccess.h:warning:cap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:gpu32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ifreq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:info64-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:ioc_data-may-be-used-uninitialized |-- arm64-randconfig-003-20250121 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-randconfig-004-20250121 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-list.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- include-linux-plist.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node |-- arm64-randconfig-r121-20250122 | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-bus-fsl-mc-mc-sys.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-header-got-restricted-__le64-usertype | |-- drivers-firmware-meson-meson_sm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-got-void-noderef-__iomem-static-toplevel-sm_shmem_out_base | |-- drivers-firmware-meson-meson_sm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__iomem-static-toplevel-sm_shmem_in_base | |-- drivers-gpu-drm-sun4i-sun4i_tcon.c:sparse:sparse:symbol-sun4i_tcon_set_mux-was-not-declared.-Should-it-be-static | |-- drivers-iio-adc-at91-sama5d2_adc.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-irqchip-irq-gic-phytium-.c:sparse:sparse:dereference-of-noderef-expression | |-- drivers-irqchip-irq-gic-phytium-its.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__le64-usertype | |-- drivers-pci-endpoint-functions-pci-epf-test.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-got-void-noderef-__iomem-assigned-src_addr | |-- drivers-pci-endpoint-functions-pci-epf-test.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__iomem-assigned-dst_addr | |-- drivers-phy-qualcomm-phy-qcom-ufs.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-video-fbdev-sh_mobile_lcdcfb.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-char-noderef-__iomem-screen_base-got-void-fb_mem | |-- drivers-video-fbdev-ssd1307fb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-to-got-unsigned-char-noderef-usertype-__iomem-dst | |-- drivers-video-fbdev-ssd1307fb.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-char-noderef-usertype-__iomem-dst-got-void | |-- drivers-video-fbdev-ssd1307fb.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-char-usertype-vmem-got-char-noderef-__iomem-screen_base | |-- drivers-w1-slaves-w1_ds28e04.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-const-noderef-__user-got-char-const-buf | |-- drivers-w1-slaves-w1_ds28e04.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-char-noderef-__user-got-char-buf | |-- fs-ext4-super.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-got-char-noderef-__rcu | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- kernel-cred.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-p-got-int-const-noderef-__rcu | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-addr-got-void-noderef-__iomem-mem_base | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-__iomem-mem_base-got-void | |-- kernel-dma-coherent.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-virt_base-got-void-noderef-__iomem-mem_base | |-- kernel-module.c:sparse:sparse:symbol-set_module_sig_enforced-was-not-declared.-Should-it-be-static | |-- mm-kmemleak.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__percpu-ptr-got-void-const-ptr | |-- mm-kmemleak.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-ptr-got-void-const-noderef-__percpu-ptr | `-- mm-kmemleak.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__percpu-ptr-got-void-const-ptr |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c:warning:unused-variable-len |-- x86_64-buildonly-randconfig-001-20250121 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-staging-media-zoran-zoran_procfs.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- x86_64-buildonly-randconfig-002-20250121 | |-- drivers-regulator-sy8106a-regulator.c:warning:unused-variable-sy8106a_i2c_of_match | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250121 | |-- drivers-video-fbdev-omap2-omapfb-dss-hdmi4.o:warning:objtool:missing-symbol-for-section-.init.text | |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- net-ipv4-bpfilter-sockopt.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-soc-rockchip-rockchip_pcm.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-004-20250121 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- kernel-rcu-tree.o:warning:objtool:rcu_note_context_switch:can-t-find-switch-jump-table |-- x86_64-buildonly-randconfig-005-20250121 | |-- kernel-.tmp_kthread.o:warning:objtool:kthread_destroy_worker:unreachable-instruction | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250121 | |-- drivers-video-fbdev-omap2-omapfb-dss-hdmi4.o:warning:objtool:missing-symbol-for-section-.init.text | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- sound-soc-rockchip-rockchip_pcm.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-defconfig | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- x86_64-randconfig-102-20250121 | |-- drivers-gpu-drm-ttm-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled `-- x86_64-randconfig-161-20250122 |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 723m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250121 gcc-14.2.0 arm64 randconfig-002-20250121 gcc-14.2.0 arm64 randconfig-003-20250121 gcc-14.2.0 arm64 randconfig-004-20250121 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250121 gcc-12 x86_64 buildonly-randconfig-002-20250121 clang-19 x86_64 buildonly-randconfig-003-20250121 gcc-12 x86_64 buildonly-randconfig-004-20250121 clang-19 x86_64 buildonly-randconfig-005-20250121 clang-19 x86_64 buildonly-randconfig-006-20250121 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1834/1834] mm/memcontrol.c:4061:5: sparse: sparse: symbol 'sysctl_memcg_oom_prio' was not declared. Should it be static?
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 44391f3171b05060096ff496f3507033f2460161 [1834/1834] memcg: Add sysctl memcg_qos_enable config: x86_64-randconfig-121-20250122 (https://download.01.org/0day-ci/archive/20250122/202501220758.6wiUFGfn-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501220758.6wiUFGfn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501220758.6wiUFGfn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/memcontrol.c:4061:5: sparse: sparse: symbol 'sysctl_memcg_oom_prio' was not declared. Should it be static? mm/memcontrol.c:4223:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/memcontrol.c:4223:50: sparse: expected void * mm/memcontrol.c:4223:50: sparse: got void [noderef] __user *buffer >> mm/memcontrol.c:4245:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/memcontrol.c:4245:35: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/memcontrol.c:4245:35: sparse: got int ( * )( ... ) mm/memcontrol.c:4504:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4504:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4504:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4506:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4506:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4506:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4662:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4662:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4662:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4756:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4756:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4756:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:6799:23: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:6799:23: sparse: struct task_struct [noderef] __rcu * mm/memcontrol.c:6799:23: sparse: struct task_struct * mm/memcontrol.c:7016:52: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:7016:52: sparse: struct task_struct [noderef] __rcu * mm/memcontrol.c:7016:52: sparse: struct task_struct * mm/memcontrol.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true mm/memcontrol.c: note: in included file: include/linux/memcontrol.h:782:9: sparse: sparse: context imbalance in 'folio_lruvec_lock' - wrong count at exit include/linux/memcontrol.h:782:9: sparse: sparse: context imbalance in 'folio_lruvec_lock_irq' - wrong count at exit include/linux/memcontrol.h:782:9: sparse: sparse: context imbalance in 'folio_lruvec_lock_irqsave' - wrong count at exit mm/memcontrol.c:2134:6: sparse: sparse: context imbalance in 'folio_memcg_lock' - wrong count at exit mm/memcontrol.c:2181:17: sparse: sparse: context imbalance in '__folio_memcg_unlock' - unexpected unlock mm/memcontrol.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true mm/memcontrol.c: note: in included file (through include/linux/rculist.h, include/linux/pid.h, include/linux/sched.h, ...): include/linux/rcupdate.h:780:9: sparse: sparse: context imbalance in 'mem_cgroup_count_precharge_pte_range' - unexpected unlock include/linux/rcupdate.h:780:9: sparse: sparse: context imbalance in 'mem_cgroup_move_charge_pte_range' - unexpected unlock vim +/sysctl_memcg_oom_prio +4061 mm/memcontrol.c 4057 4058 #ifdef CONFIG_MEMCG_OOM_PRIORITY 4059 #define ENABLE_MEMCG_OOM_PROIRITY 1 4060 #define DISABLE_MEMCG_OOM_PROIRITY 0 > 4061 int sysctl_memcg_oom_prio = DISABLE_MEMCG_OOM_PROIRITY; 4062 4063 bool memcg_oom_prio_disabled(void) 4064 { 4065 return READ_ONCE(sysctl_memcg_oom_prio) == DISABLE_MEMCG_OOM_PROIRITY; 4066 } 4067 4068 static void memcg_oom_prio_init(struct mem_cgroup *memcg) 4069 { 4070 struct mem_cgroup *parent = parent_mem_cgroup(memcg); 4071 int oom_prio; 4072 4073 if (!parent) 4074 return; 4075 4076 oom_prio = READ_ONCE(parent->oom_prio); 4077 WRITE_ONCE(memcg->oom_prio, oom_prio); 4078 } 4079 4080 static s64 memcg_oom_prio_read(struct cgroup_subsys_state *css, 4081 struct cftype *cft) 4082 { 4083 struct mem_cgroup *memcg = mem_cgroup_from_css(css); 4084 4085 if (memcg_oom_prio_disabled()) 4086 return 0; 4087 4088 return READ_ONCE(memcg->oom_prio); 4089 } 4090 4091 static int memcg_oom_prio_write(struct cgroup_subsys_state *css, 4092 struct cftype *cft, s64 val) 4093 { 4094 struct mem_cgroup *memcg = mem_cgroup_from_css(css); 4095 struct mem_cgroup *iter_memcg; 4096 struct cgroup_subsys_state *iter_css; 4097 4098 if (memcg_oom_prio_disabled()) 4099 return -EACCES; 4100 4101 if (mem_cgroup_is_root(memcg)) 4102 return -EINVAL; 4103 4104 if (val != MEMCG_LOW_OOM_PRIORITY && val != MEMCG_HIGH_OOM_PRIORITY) 4105 return -EINVAL; 4106 4107 rcu_read_lock(); 4108 css_for_each_descendant_pre(iter_css, &memcg->css) { 4109 iter_memcg = mem_cgroup_from_css(iter_css); 4110 4111 WRITE_ONCE(iter_memcg->oom_prio, val); 4112 } 4113 rcu_read_unlock(); 4114 4115 return 0; 4116 } 4117 4118 static struct mem_cgroup *memcg_find_max_usage(struct mem_cgroup *last) 4119 { 4120 struct mem_cgroup *iter, *max_memcg = NULL; 4121 struct cgroup_subsys_state *css; 4122 unsigned long usage, max_usage = 0; 4123 int oom_prio; 4124 4125 rcu_read_lock(); 4126 css_for_each_descendant_pre(css, &root_mem_cgroup->css) { 4127 iter = mem_cgroup_from_css(css); 4128 oom_prio = READ_ONCE(iter->oom_prio); 4129 4130 if (oom_prio == MEMCG_HIGH_OOM_PRIORITY || 4131 iter == root_mem_cgroup || 4132 iter == last) 4133 continue; 4134 4135 usage = mem_cgroup_usage(iter, false); 4136 if (usage > max_usage) { 4137 max_usage = usage; 4138 max_memcg = iter; 4139 } 4140 } 4141 rcu_read_unlock(); 4142 4143 return max_memcg; 4144 } 4145 4146 bool memcg_oom_prio_scan_tasks(int (*fn)(struct task_struct *, void *), 4147 void *arg) 4148 { 4149 struct mem_cgroup *max, *last = NULL; 4150 struct oom_control *oc = arg; 4151 struct css_task_iter it; 4152 struct task_struct *task; 4153 int ret = 0; 4154 bool retry = true; 4155 4156 if (memcg_oom_prio_disabled()) 4157 return false; 4158 retry: 4159 max = memcg_find_max_usage(last); 4160 if (!max) 4161 return false; 4162 4163 css_task_iter_start(&max->css, 0, &it); 4164 while (!ret && (task = css_task_iter_next(&it))) { 4165 if (test_tsk_thread_flag(task, TIF_MEMDIE)) 4166 continue; 4167 4168 ret = fn(task, arg); 4169 } 4170 css_task_iter_end(&it); 4171 4172 if (ret) 4173 return false; 4174 4175 if (!oc->chosen && retry) { 4176 last = max; 4177 retry = false; 4178 goto retry; 4179 } 4180 4181 if (oc->chosen) 4182 pr_info("The bad task [%d:%s] is from low-priority memcg.\n", 4183 oc->chosen->pid, oc->chosen->comm); 4184 4185 return oc->chosen ? true : false; 4186 } 4187 4188 void memcg_print_bad_task(struct oom_control *oc) 4189 { 4190 if (memcg_oom_prio_disabled()) 4191 return; 4192 4193 if (oc->chosen) { 4194 struct mem_cgroup *memcg; 4195 4196 rcu_read_lock(); 4197 memcg = mem_cgroup_from_task(oc->chosen); 4198 if (READ_ONCE(memcg->oom_prio) == MEMCG_LOW_OOM_PRIORITY) 4199 pr_info("The bad task [%d:%s] is from low-priority memcg.\n", 4200 oc->chosen->pid, oc->chosen->comm); 4201 rcu_read_unlock(); 4202 } 4203 } 4204 4205 static void memcg_oom_prio_reset(void) 4206 { 4207 struct mem_cgroup *iter; 4208 struct cgroup_subsys_state *css; 4209 4210 rcu_read_lock(); 4211 css_for_each_descendant_pre(css, &root_mem_cgroup->css) { 4212 iter = mem_cgroup_from_css(css); 4213 WRITE_ONCE(iter->oom_prio, 0); 4214 } 4215 rcu_read_unlock(); 4216 } 4217 4218 static int sysctl_memcg_oom_prio_handler(struct ctl_table *table, int write, 4219 void __user *buffer, size_t *length, loff_t *ppos) 4220 { 4221 int ret; 4222 4223 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 4224 if (ret) 4225 return ret; 4226 4227 if (write) { 4228 if (READ_ONCE(sysctl_memcg_oom_prio) == DISABLE_MEMCG_OOM_PROIRITY) 4229 memcg_oom_prio_reset(); 4230 } 4231 4232 return ret; 4233 } 4234 4235 static struct ctl_table memcg_oom_prio_sysctls[] = { 4236 { 4237 /* 4238 * This sysctl is used to control memcg oom priority 4239 * feature, the sysctl name is for compatibility. 4240 */ 4241 .procname = "memcg_qos_enable", 4242 .data = &sysctl_memcg_oom_prio, 4243 .maxlen = sizeof(int), 4244 .mode = 0644, > 4245 .proc_handler = sysctl_memcg_oom_prio_handler, 4246 .extra1 = SYSCTL_ZERO, 4247 .extra2 = SYSCTL_ONE, 4248 }, 4249 }; 4250 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1834/1834] drivers/crypto/montage/tsse/tsse_dev.h:84:6: warning: variable 'cpu' set but not used
by kernel test robot 22 Jan '25

22 Jan '25

Hi Carrie.Cai, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 811debd4ea52033d7393d4a7de2be11f71c70348 [1834/1834] add support for Mont-TSSE Driver config: x86_64-randconfig-101-20250122 (https://download.01.org/0day-ci/archive/20250122/202501220636.mvJm5Jtb-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501220636.mvJm5Jtb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501220636.mvJm5Jtb-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/crypto/montage/tsse/tsse_dev_mgr.c:13: In file included from include/linux/iommu.h:10: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from drivers/crypto/montage/tsse/tsse_dev_mgr.c:15: >> drivers/crypto/montage/tsse/tsse_dev.h:84:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^ drivers/crypto/montage/tsse/tsse_dev_mgr.c:107:5: warning: no previous prototype for function 'tsse_stop_dev' [-Wmissing-prototypes] 107 | int tsse_stop_dev(struct tsse_dev *tdev, bool busy_exit) | ^ drivers/crypto/montage/tsse/tsse_dev_mgr.c:107:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 107 | int tsse_stop_dev(struct tsse_dev *tdev, bool busy_exit) | ^ | static drivers/crypto/montage/tsse/tsse_dev_mgr.c:220:2: warning: variable 'ptr' is used uninitialized whenever 'for' loop exits because its condition is false [-Wsometimes-uninitialized] 220 | list_for_each(itr, &tsse_dev_table) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/list.h:687:27: note: expanded from macro 'list_for_each' 687 | for (pos = (head)->next; !list_is_head(pos, (head)); pos = pos->next) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_dev_mgr.c:227:9: note: uninitialized use occurs here 227 | return ptr; | ^~~ drivers/crypto/montage/tsse/tsse_dev_mgr.c:220:2: note: remove the condition if it is always true 220 | list_for_each(itr, &tsse_dev_table) { | ^ include/linux/list.h:687:27: note: expanded from macro 'list_for_each' 687 | for (pos = (head)->next; !list_is_head(pos, (head)); pos = pos->next) | ^ drivers/crypto/montage/tsse/tsse_dev_mgr.c:216:22: note: initialize the variable 'ptr' to silence this warning 216 | struct tsse_dev *ptr; | ^ | = NULL drivers/crypto/montage/tsse/tsse_dev_mgr.c:37:20: warning: unused function 'tsse_list_add_tail' [-Wunused-function] 37 | static inline void tsse_list_add_tail(struct list_head *new, | ^~~~~~~~~~~~~~~~~~ 5 warnings generated. -- In file included from drivers/crypto/montage/tsse/tsse_ipc.c:14: In file included from drivers/crypto/montage/tsse/tsse_dev.h:13: In file included from include/linux/pci.h:1629: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from drivers/crypto/montage/tsse/tsse_ipc.c:14: >> drivers/crypto/montage/tsse/tsse_dev.h:84:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^ drivers/crypto/montage/tsse/tsse_ipc.c:17:18: warning: no previous prototype for function 'get_msginf' [-Wmissing-prototypes] 17 | struct tsse_msg *get_msginf(void __iomem *d2h) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:17:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 17 | struct tsse_msg *get_msginf(void __iomem *d2h) | ^ | static drivers/crypto/montage/tsse/tsse_ipc.c:41:6: warning: no previous prototype for function 'ipc_recieve_msg' [-Wmissing-prototypes] 41 | void ipc_recieve_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:41:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 41 | void ipc_recieve_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ | static drivers/crypto/montage/tsse/tsse_ipc.c:53:5: warning: no previous prototype for function 'msg_rout' [-Wmissing-prototypes] 53 | int msg_rout(struct tsse_ipc *tsseipc, struct tsse_msg *tssemsg) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:53:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 53 | int msg_rout(struct tsse_ipc *tsseipc, struct tsse_msg *tssemsg) | ^ | static drivers/crypto/montage/tsse/tsse_ipc.c:103:6: warning: no previous prototype for function 'ipc_send_msg' [-Wmissing-prototypes] 103 | void ipc_send_msg(struct tsse_ipc *tsseipc, struct ipc_data *msg) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:103:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 103 | void ipc_send_msg(struct tsse_ipc *tsseipc, struct ipc_data *msg) | ^ | static drivers/crypto/montage/tsse/tsse_ipc.c:115:6: warning: no previous prototype for function 'ipc_hw_init' [-Wmissing-prototypes] 115 | void ipc_hw_init(struct tsse_ipc *hw_ipc) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:115:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 115 | void ipc_hw_init(struct tsse_ipc *hw_ipc) | ^ | static drivers/crypto/montage/tsse/tsse_ipc.c:122:5: warning: no previous prototype for function 'ipc_init_msg' [-Wmissing-prototypes] 122 | int ipc_init_msg(struct tsse_ipc *tsseipc) | ^ drivers/crypto/montage/tsse/tsse_ipc.c:122:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 122 | int ipc_init_msg(struct tsse_ipc *tsseipc) | ^ | static 8 warnings generated. -- In file included from drivers/crypto/montage/tsse/tsse_fw_service.c:15: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from drivers/crypto/montage/tsse/tsse_fw_service.c:20: >> drivers/crypto/montage/tsse/tsse_dev.h:84:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^ drivers/crypto/montage/tsse/tsse_fw_service.c:26:5: warning: no previous prototype for function 'fw_send_msg' [-Wmissing-prototypes] 26 | int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ drivers/crypto/montage/tsse/tsse_fw_service.c:26:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 26 | int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^ | static drivers/crypto/montage/tsse/tsse_fw_service.c:51:6: warning: no previous prototype for function 'fw_free' [-Wmissing-prototypes] 51 | void fw_free(void *msg_t) | ^ drivers/crypto/montage/tsse/tsse_fw_service.c:51:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 51 | void fw_free(void *msg_t) | ^ | static 4 warnings generated. -- In file included from drivers/crypto/montage/tsse/tsse_irq.c:10: In file included from drivers/crypto/montage/tsse/tsse_dev.h:13: In file included from include/linux/pci.h:1629: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from drivers/crypto/montage/tsse/tsse_irq.c:10: >> drivers/crypto/montage/tsse/tsse_dev.h:84:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^ 2 warnings generated. -- In file included from drivers/crypto/montage/tsse/tsse_vuart.c:15: In file included from include/linux/tty.h:12: In file included from include/linux/tty_port.h:5: In file included from include/linux/kfifo.h:42: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from drivers/crypto/montage/tsse/tsse_vuart.c:25: >> drivers/crypto/montage/tsse/tsse_dev.h:84:6: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^ drivers/crypto/montage/tsse/tsse_vuart.c:77:13: warning: unused function 'vuart_wait_for_xmitr' [-Wunused-function] 77 | static void vuart_wait_for_xmitr(struct uart_port *port) | ^~~~~~~~~~~~~~~~~~~~ 3 warnings generated. vim +/cpu +84 drivers/crypto/montage/tsse/tsse_dev.h > 13 #include <linux/pci.h> 14 #include <linux/pci-ats.h> 15 #include <linux/serial_core.h> 16 #include <linux/firmware.h> 17 #include "tsse_ipc.h" 18 19 #define TSSE_PCI_MAX_BARS 4 20 #define TSSE_FW_VERSION_LEN 32 21 struct tsse_bar { 22 void __iomem *virt_addr; 23 resource_size_t addr; 24 resource_size_t size; 25 }; 26 struct tsse_dev_pci { 27 struct pci_dev *pci_dev; 28 struct tsse_bar bars[TSSE_PCI_MAX_BARS]; 29 u8 revid; 30 }; 31 enum tsse_dev_status_bit { 32 TSSE_DEV_STATUS_STARTING = 0, 33 TSSE_DEV_STATUS_STARTED = 1 34 35 }; 36 struct tsse_qpairs_bank { 37 struct tsse_dev *tsse_dev; 38 void __iomem *reg_base; 39 40 u32 num_qparis; 41 u32 irq_vec; 42 }; 43 struct tsse_dev { 44 struct module *owner; 45 struct dentry *debugfs_dir; 46 unsigned long status; 47 struct list_head list; 48 struct tsse_dev_pci tsse_pci_dev; 49 struct tsse_qpairs_bank qpairs_bank; 50 atomic_t ref_count; 51 bool is_vf; 52 int id; 53 u32 num_irqs; 54 u32 num_vfs; 55 struct uart_port *port; 56 struct tsse_ipc *ipc; 57 void *adi; 58 void *mbx_hw; 59 const struct firmware *fw; 60 char fw_version[TSSE_FW_VERSION_LEN]; 61 }; 62 #define TSSEDEV_TO_DEV(tssedev) (&((tssedev)->tsse_pci_dev.pci_dev->dev)) 63 #define TSSE_DEV_BARS(tssedev) ((tssedev)->tsse_pci_dev.bars) 64 65 #include "tsse_log.h" 66 67 struct list_head *tsse_devmgr_get_head(void); 68 69 int tsse_dev_get(struct tsse_dev *tsse_dev); 70 void tsse_dev_put(struct tsse_dev *tsse_dev); 71 int tsse_devmgr_add_dev(struct tsse_dev *tsse_dev); 72 void tsse_devmgr_rm_dev(struct tsse_dev *tdev); 73 int tsse_prepare_restart_dev(struct tsse_dev *tdev); 74 int tsse_start_dev(struct tsse_dev *tdev); 75 struct tsse_dev *get_tssedev(int id); 76 77 static inline struct tsse_dev *pci_to_tsse_dev(struct pci_dev *pci_dev) 78 { 79 return (struct tsse_dev *)pci_get_drvdata(pci_dev); 80 } 81 82 static inline int tsse_get_cur_node(void) 83 { > 84 int cpu, node; 85 86 cpu = get_cpu(); 87 node = topology_physical_package_id(cpu); 88 put_cpu(); 89 90 return node; 91 } 92 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1834/1834] drivers/scsi/leapioraid/leapioraid_app.c:547:55: sparse: sparse: restricted __le16 degrades to integer
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 7fea595ef48e9ab13bd31df067b19152153e1925 [1834/1834] SCSI: LEAPIORAID: Supports LEAPIO RAID controller config: x86_64-randconfig-122-20250122 (https://download.01.org/0day-ci/archive/20250122/202501220628.ocqpqpGr-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501220628.ocqpqpGr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501220628.ocqpqpGr-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/scsi/leapioraid/leapioraid_app.c:547:55: sparse: sparse: restricted __le16 degrades to integer >> drivers/scsi/leapioraid/leapioraid_app.c:2197:17: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted __poll_t ( *poll )( ... ) @@ got unsigned int ( * )( ... ) @@ drivers/scsi/leapioraid/leapioraid_app.c:2197:17: sparse: expected restricted __poll_t ( *poll )( ... ) drivers/scsi/leapioraid/leapioraid_app.c:2197:17: sparse: got unsigned int ( * )( ... ) drivers/scsi/leapioraid/leapioraid_app.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/umh.h, include/linux/kmod.h, ...): include/linux/page-flags.h:244:46: sparse: sparse: self-comparison always evaluates to false -- >> drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 static [addressable] [assigned] [toplevel] [usertype] s_addr @@ got unsigned int [addressable] [usertype] ip @@ drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: expected restricted __be32 static [addressable] [assigned] [toplevel] [usertype] s_addr drivers/scsi/leapioraid/leapioraid_func.c:304:35: sparse: got unsigned int [addressable] [usertype] ip >> drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long [usertype] iov_len @@ got restricted __le32 [usertype] datasize @@ drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: expected unsigned long [usertype] iov_len drivers/scsi/leapioraid/leapioraid_func.c:325:21: sparse: got restricted __le32 [usertype] datasize >> drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __le32 [usertype] datasize @@ got unsigned int [assigned] [usertype] send_sz @@ drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: expected restricted __le32 [usertype] datasize drivers/scsi/leapioraid/leapioraid_func.c:369:71: sparse: got unsigned int [assigned] [usertype] send_sz drivers/scsi/leapioraid/leapioraid_func.c:671:1: sparse: sparse: symbol 'leapioraid_base_stop_smart_polling' was not declared. Should it be static? >> drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:1395:67: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:1427:51: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c:1300:1: sparse: sparse: symbol 'leapioraid_base_process_reply_queue' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1468:5: sparse: sparse: symbol 'leapioraid_base_irqpoll' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_func.c:1490:1: sparse: sparse: symbol 'leapioraid_base_init_irqpolls' was not declared. Should it be static? >> drivers/scsi/leapioraid/leapioraid_func.c:1924:21: sparse: sparse: symbol 'leapioraid_pcie_link_speed' was not declared. Should it be static? >> drivers/scsi/leapioraid/leapioraid_func.c:2946:31: sparse: sparse: cast removes address space '__iomem' of expression >> drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: expected unsigned int val drivers/scsi/leapioraid/leapioraid_func.c:3291:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: expected unsigned int val drivers/scsi/leapioraid/leapioraid_func.c:3304:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: expected unsigned int val drivers/scsi/leapioraid/leapioraid_func.c:3317:16: sparse: got restricted __le32 [usertype] drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int val @@ got restricted __le32 [usertype] @@ drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: expected unsigned int val drivers/scsi/leapioraid/leapioraid_func.c:3330:16: sparse: got restricted __le32 [usertype] >> drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] ImageSize @@ got unsigned long [assigned] [usertype] data_length @@ drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: expected restricted __le32 [usertype] ImageSize drivers/scsi/leapioraid/leapioraid_func.c:3373:32: sparse: got unsigned long [assigned] [usertype] data_length drivers/scsi/leapioraid/leapioraid_func.c:4414:1: sparse: sparse: symbol 'leapioraid_base_flush_ios_and_panic' was not declared. Should it be static? >> drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: sparse: invalid assignment: |= drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: left side has type restricted __le16 drivers/scsi/leapioraid/leapioraid_func.c:4747:40: sparse: right side has type int >> drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le64 [addressable] [assigned] [usertype] BufAddr @@ got unsigned long long [usertype] log_buffer_dma @@ drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: expected restricted __le64 [addressable] [assigned] [usertype] BufAddr drivers/scsi/leapioraid/leapioraid_func.c:4799:29: sparse: got unsigned long long [usertype] log_buffer_dma >> drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [addressable] [assigned] [usertype] BufSize @@ got int @@ drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: expected restricted __le32 [addressable] [assigned] [usertype] BufSize drivers/scsi/leapioraid/leapioraid_func.c:4800:29: sparse: got int drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: expected void volatile [noderef] __iomem *addr drivers/scsi/leapioraid/leapioraid_func.c:5242:67: sparse: got unsigned long long [usertype] * drivers/scsi/leapioraid/leapioraid_func.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/umh.h, include/linux/kmod.h, ...): include/linux/page-flags.h:244:46: sparse: sparse: self-comparison always evaluates to false drivers/scsi/leapioraid/leapioraid_func.c: note: in included file (through include/linux/module.h): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true -- >> drivers/scsi/leapioraid/leapioraid_os.c:5965:29: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:521:30: sparse: sparse: symbol 'leapioraid_get_sdev_from_target' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_os.c:534:30: sparse: sparse: symbol '__leapioraid_get_sdev_by_addr' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_os.c:866:34: sparse: sparse: symbol 'leapioraid_scsihost_enclosure_find_by_handle' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_os.c:1854:1: sparse: sparse: symbol 'leapioraid_scsihost_tm_cmd_map_status' was not declared. Should it be static? drivers/scsi/leapioraid/leapioraid_os.c:1889:1: sparse: sparse: symbol 'leapioraid_scsihost_tm_post_processing' was not declared. Should it be static? >> drivers/scsi/leapioraid/leapioraid_os.c:3080:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] dev_handle @@ got restricted __le16 [usertype] DevHandle @@ drivers/scsi/leapioraid/leapioraid_os.c:3080:25: sparse: expected unsigned short [usertype] dev_handle drivers/scsi/leapioraid/leapioraid_os.c:3080:25: sparse: got restricted __le16 [usertype] DevHandle drivers/scsi/leapioraid/leapioraid_os.c:3081:17: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3091:35: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3093:42: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3094:45: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3095:25: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3099:42: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3100:61: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3102:25: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3106:42: sparse: sparse: cast to restricted __le16 drivers/scsi/leapioraid/leapioraid_os.c:3107:35: sparse: sparse: cast to restricted __le16 >> drivers/scsi/leapioraid/leapioraid_os.c:6840:37: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le16 [usertype] EnclosureHandle @@ got unsigned short [usertype] @@ drivers/scsi/leapioraid/leapioraid_os.c:6840:37: sparse: expected restricted __le16 [usertype] EnclosureHandle drivers/scsi/leapioraid/leapioraid_os.c:6840:37: sparse: got unsigned short [usertype] >> drivers/scsi/leapioraid/leapioraid_os.c:6844:76: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected unsigned short [usertype] handle @@ got restricted __le16 [usertype] EnclosureHandle @@ drivers/scsi/leapioraid/leapioraid_os.c:6844:76: sparse: expected unsigned short [usertype] handle drivers/scsi/leapioraid/leapioraid_os.c:6844:76: sparse: got restricted __le16 [usertype] EnclosureHandle >> drivers/scsi/leapioraid/leapioraid_os.c:6859:59: sparse: sparse: incorrect type in argument 5 (different base types) @@ expected unsigned int [usertype] handle @@ got restricted __le16 [usertype] EnclosureHandle @@ drivers/scsi/leapioraid/leapioraid_os.c:6859:59: sparse: expected unsigned int [usertype] handle drivers/scsi/leapioraid/leapioraid_os.c:6859:59: sparse: got restricted __le16 [usertype] EnclosureHandle drivers/scsi/leapioraid/leapioraid_os.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/umh.h, include/linux/kmod.h, ...): include/linux/page-flags.h:244:46: sparse: sparse: self-comparison always evaluates to false drivers/scsi/leapioraid/leapioraid_os.c: note: in included file (through include/linux/module.h): include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true include/linux/list.h:83:21: sparse: sparse: self-comparison always evaluates to true vim +547 drivers/scsi/leapioraid/leapioraid_app.c 506 507 static int 508 leapioraid_ctl_set_task_mid(struct LEAPIORAID_ADAPTER *ioc, 509 struct leapio_ioctl_command *karg, 510 struct LeapioraidSCSITmgReq_t *tm_request) 511 { 512 u8 found = 0; 513 u16 smid; 514 u16 handle; 515 struct scsi_cmnd *scmd; 516 struct LEAPIORAID_DEVICE *priv_data; 517 struct LeapioraidSCSITmgRep_t *tm_reply; 518 u32 sz; 519 u32 lun; 520 char *desc = NULL; 521 struct leapioraid_scsiio_tracker *st = NULL; 522 523 if (tm_request->TaskType == LEAPIORAID_SCSITASKMGMT_TASKTYPE_ABORT_TASK) 524 desc = "abort_task"; 525 else if (tm_request->TaskType == 526 LEAPIORAID_SCSITASKMGMT_TASKTYPE_QUERY_TASK) 527 desc = "query_task"; 528 else 529 return 0; 530 lun = scsilun_to_int((struct scsi_lun *)tm_request->LUN); 531 handle = le16_to_cpu(tm_request->DevHandle); 532 for (smid = ioc->shost->can_queue; smid && !found; smid--) { 533 scmd = leapioraid_scsihost_scsi_lookup_get(ioc, smid); 534 if (scmd == NULL || scmd->device == NULL || 535 scmd->device->hostdata == NULL) 536 continue; 537 if (lun != scmd->device->lun) 538 continue; 539 priv_data = scmd->device->hostdata; 540 if (priv_data->sas_target == NULL) 541 continue; 542 if (priv_data->sas_target->handle != handle) 543 continue; 544 st = leapioraid_base_scsi_cmd_priv(scmd); 545 if ((!st) || (st->smid == 0)) 546 continue; > 547 if (!tm_request->TaskMID || tm_request->TaskMID == st->smid) { 548 tm_request->TaskMID = cpu_to_le16(st->smid); 549 found = 1; 550 } 551 } 552 if (!found) { 553 dctlprintk(ioc, pr_info( 554 "%s %s: handle(0x%04x), lun(%d), no active mid!!\n", 555 ioc->name, desc, 556 le16_to_cpu(tm_request->DevHandle), 557 lun)); 558 tm_reply = ioc->ctl_cmds.reply; 559 tm_reply->DevHandle = tm_request->DevHandle; 560 tm_reply->Function = LEAPIORAID_FUNC_SCSI_TASK_MGMT; 561 tm_reply->TaskType = tm_request->TaskType; 562 tm_reply->MsgLength = 563 sizeof(struct LeapioraidSCSITmgRep_t) / 4; 564 tm_reply->VP_ID = tm_request->VP_ID; 565 tm_reply->VF_ID = tm_request->VF_ID; 566 sz = min_t(u32, karg->max_reply_bytes, ioc->reply_sz); 567 if (copy_to_user(karg->reply_frame_buf_ptr, ioc->ctl_cmds.reply, 568 sz)) 569 pr_err("failure at %s:%d/%s()!\n", __FILE__, 570 __LINE__, __func__); 571 return 1; 572 } 573 dctlprintk(ioc, pr_info( 574 "%s %s: handle(0x%04x), lun(%d), task_mid(%d)\n", 575 ioc->name, desc, 576 le16_to_cpu(tm_request->DevHandle), lun, 577 le16_to_cpu(tm_request->TaskMID))); 578 return 0; 579 } 580 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 75c81bcddd82381fbd4cef477a5b56eb2fe56697
by kernel test robot 22 Jan '25

22 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 !14813 drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501211756.LmO1gDKg-lkp@intel.com drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'? Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- loongarch-alldefconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250121 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-buildonly-randconfig-006-20250121 `-- drivers-crypto-ccp-hygon-tdm-kernel-guard.c:error:NR_syscalls-undeclared-(first-use-in-this-function) elapsed time: 726m configs tested: 20 configs skipped: 122 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250121 gcc-14.2.0 arm64 randconfig-002-20250121 gcc-14.2.0 arm64 randconfig-003-20250121 gcc-14.2.0 arm64 randconfig-004-20250121 clang-18 loongarch alldefconfig gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250121 gcc-14.2.0 loongarch randconfig-002-20250121 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250121 gcc-12 x86_64 buildonly-randconfig-002-20250121 clang-19 x86_64 buildonly-randconfig-003-20250121 gcc-12 x86_64 buildonly-randconfig-004-20250121 clang-19 x86_64 buildonly-randconfig-005-20250121 clang-19 x86_64 buildonly-randconfig-006-20250121 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1411/1411] drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5164:6: warning: unused variable 'len'
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: fdf62dff2537450d438667d817333e17ec71148a commit: d4353bc94d9a5d1fb044185ee8162f0cc3e48f90 [1411/1411] net: wangxun: fix resolving ipv6 pakets extension header errors config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250122/202501220126.4njU5YRX-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501220126.4njU5YRX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501220126.4njU5YRX-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/ngbe/ngbe_main.c:38: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:170:6: warning: no previous prototype for function 'ngbe_service_event_schedule' [-Wmissing-prototypes] 170 | void ngbe_service_event_schedule(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:170:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 170 | void ngbe_service_event_schedule(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:433:7: warning: variable 'real_tx_hang' set but not used [-Wunused-but-set-variable] 433 | bool real_tx_hang = false; | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3223:6: warning: no previous prototype for function 'ngbe_configure_isb' [-Wmissing-prototypes] 3223 | void ngbe_configure_isb(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3223:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3223 | void ngbe_configure_isb(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3233:6: warning: no previous prototype for function 'ngbe_configure_port' [-Wmissing-prototypes] 3233 | void ngbe_configure_port(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3233:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3233 | void ngbe_configure_port(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3592:6: warning: no previous prototype for function 'ngbe_disable_device' [-Wmissing-prototypes] 3592 | void ngbe_disable_device(struct ngbe_adapter *adapter) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3592:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3592 | void ngbe_disable_device(struct ngbe_adapter *adapter) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3693:5: warning: no previous prototype for function 'ngbe_init_shared_code' [-Wmissing-prototypes] 3693 | s32 ngbe_init_shared_code(struct ngbe_hw *hw) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3693:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3693 | s32 ngbe_init_shared_code(struct ngbe_hw *hw) | ^ | static >> drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5164:6: warning: unused variable 'len' [-Wunused-variable] 5164 | u32 len = 0; | ^~~ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5833:5: warning: no previous prototype for function 'ngbe_skb_pad_nonzero' [-Wmissing-prototypes] 5833 | int ngbe_skb_pad_nonzero(struct sk_buff *skb, int pad) | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5833:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5833 | int ngbe_skb_pad_nonzero(struct sk_buff *skb, int pad) | ^ | static drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6033:6: warning: variable 'prtad' set but not used [-Wunused-but-set-variable] 6033 | int prtad, devad, ret = 0; | ^ drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6033:13: warning: variable 'devad' set but not used [-Wunused-but-set-variable] 6033 | int prtad, devad, ret = 0; | ^ 11 warnings generated. drivers/net/ethernet/netswift/ngbe/ngbe_main.c:257: warning: Function parameter or member 'quiet' not described in 'ngbe_read_reg' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:1644: warning: Function parameter or member 'queues' not described in 'ngbe_irq_enable' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:1644: warning: Function parameter or member 'flush' not described in 'ngbe_irq_enable' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2035: warning: Function parameter or member 'adapter' not described in 'ngbe_configure_msi_and_legacy' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2449: warning: Function parameter or member 'adapter' not described in 'ngbe_configure_bridge_mode' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:2913: warning: Function parameter or member 'pool' not described in 'ngbe_write_uc_addr_list' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3722: warning: cannot understand function prototype: 'const u32 def_rss_key[10] = ' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4583: warning: Function parameter or member 'adapter' not described in 'ngbe_check_hang_subtask' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4648: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_update_link_status' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4744: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_link_is_up' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4789: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_link_is_down' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4856: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_flush_tx' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4928: warning: Function parameter or member 'adapter' not described in 'ngbe_watchdog_subtask' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4957: warning: Function parameter or member 't' not described in 'ngbe_service_timer' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:4957: warning: Excess function parameter 'data' description in 'ngbe_service_timer' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6066: warning: Function parameter or member 'dev' not described in 'ngbe_setup_tc' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6066: warning: Excess function parameter 'netdev' description in 'ngbe_setup_tc' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6320: warning: Excess function parameter 'device_id' description in 'ngbe_wol_supported' drivers/net/ethernet/netswift/ngbe/ngbe_main.c:6320: warning: Excess function parameter 'subdev_id' description in 'ngbe_wol_supported' vim +/len +5164 drivers/net/ethernet/netswift/ngbe/ngbe_main.c 5154 5155 static ngbe_dptype encode_tx_desc_ptype(const struct ngbe_tx_buffer *first) 5156 { 5157 struct sk_buff *skb = first->skb; 5158 u8 tun_prot = 0; 5159 u8 l4_prot = 0; 5160 u8 ptype = 0; 5161 unsigned char *exthdr; 5162 unsigned char *l4_hdr; 5163 __be16 frag_off; > 5164 u32 len = 0; 5165 5166 if (skb->encapsulation) { 5167 union network_header hdr; 5168 5169 switch (first->protocol) { 5170 case __constant_htons(ETH_P_IP): 5171 tun_prot = ip_hdr(skb)->protocol; 5172 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) 5173 goto encap_frag; 5174 ptype = NGBE_PTYPE_TUN_IPV4; 5175 break; 5176 case htons(ETH_P_IPV6): 5177 l4_hdr = skb_transport_header(skb); 5178 exthdr = skb_network_header(skb) + 5179 sizeof(struct ipv6hdr); 5180 tun_prot = ipv6_hdr(skb)->nexthdr; 5181 if (l4_hdr != exthdr) 5182 ipv6_skip_exthdr(skb, exthdr - skb->data, 5183 &tun_prot, &frag_off); 5184 5185 if (tun_prot == NEXTHDR_FRAGMENT) 5186 goto encap_frag; 5187 ptype = NGBE_PTYPE_TUN_IPV6; 5188 break; 5189 default: 5190 goto exit; 5191 } 5192 5193 if (tun_prot == IPPROTO_IPIP || 5194 tun_prot == IPPROTO_IPV6) { 5195 hdr.raw = (void *)inner_ip_hdr(skb); 5196 ptype |= NGBE_PTYPE_PKT_IPIP; 5197 } else if (tun_prot == IPPROTO_UDP) { 5198 hdr.raw = (void *)inner_ip_hdr(skb); 5199 } else { 5200 goto exit; 5201 } 5202 5203 switch (hdr.ipv4->version) { 5204 case IPVERSION: 5205 l4_prot = hdr.ipv4->protocol; 5206 if (hdr.ipv4->frag_off & htons(IP_MF | IP_OFFSET)) { 5207 ptype |= NGBE_PTYPE_TYP_IPFRAG; 5208 goto exit; 5209 } 5210 break; 5211 case 6: 5212 l4_hdr = skb_inner_transport_header(skb); 5213 exthdr = skb_inner_network_header(skb) + 5214 sizeof(struct ipv6hdr); 5215 l4_prot = inner_ipv6_hdr(skb)->nexthdr; 5216 if (l4_hdr != exthdr) 5217 ipv6_skip_exthdr(skb, exthdr - skb->data, 5218 &l4_prot, &frag_off); 5219 5220 ptype |= NGBE_PTYPE_PKT_IPV6; 5221 if (l4_prot == NEXTHDR_FRAGMENT) { 5222 ptype |= NGBE_PTYPE_TYP_IPFRAG; 5223 goto exit; 5224 } 5225 break; 5226 default: 5227 goto exit; 5228 } 5229 } else { 5230 encap_frag: 5231 switch (first->protocol) { 5232 case __constant_htons(ETH_P_IP): 5233 l4_prot = ip_hdr(skb)->protocol; 5234 ptype = NGBE_PTYPE_PKT_IP; 5235 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) { 5236 ptype |= NGBE_PTYPE_TYP_IPFRAG; 5237 goto exit; 5238 } 5239 break; 5240 #ifdef NETIF_F_IPV6_CSUM 5241 case htons(ETH_P_IPV6): 5242 l4_hdr = skb_transport_header(skb); 5243 exthdr = skb_network_header(skb) + 5244 sizeof(struct ipv6hdr); 5245 l4_prot = ipv6_hdr(skb)->nexthdr; 5246 if (l4_hdr != exthdr) 5247 ipv6_skip_exthdr(skb, exthdr - skb->data, 5248 &l4_prot, &frag_off); 5249 5250 ptype = NGBE_PTYPE_PKT_IP | NGBE_PTYPE_PKT_IPV6; 5251 if (l4_prot == NEXTHDR_FRAGMENT) { 5252 ptype |= NGBE_PTYPE_TYP_IPFRAG; 5253 goto exit; 5254 } 5255 break; 5256 #endif /* NETIF_F_IPV6_CSUM */ 5257 case __constant_htons(ETH_P_1588): 5258 ptype = NGBE_PTYPE_L2_TS; 5259 goto exit; 5260 case __constant_htons(ETH_P_FIP): 5261 ptype = NGBE_PTYPE_L2_FIP; 5262 goto exit; 5263 case __constant_htons(NGBE_ETH_P_LLDP): 5264 ptype = NGBE_PTYPE_L2_LLDP; 5265 goto exit; 5266 case __constant_htons(NGBE_ETH_P_CNM): 5267 ptype = NGBE_PTYPE_L2_CNM; 5268 goto exit; 5269 case __constant_htons(ETH_P_PAE): 5270 ptype = NGBE_PTYPE_L2_EAPOL; 5271 goto exit; 5272 case __constant_htons(ETH_P_ARP): 5273 ptype = NGBE_PTYPE_L2_ARP; 5274 goto exit; 5275 default: 5276 ptype = NGBE_PTYPE_L2_MAC; 5277 goto exit; 5278 } 5279 } 5280 5281 switch (l4_prot) { 5282 case IPPROTO_TCP: 5283 ptype |= NGBE_PTYPE_TYP_TCP; 5284 break; 5285 case IPPROTO_UDP: 5286 ptype |= NGBE_PTYPE_TYP_UDP; 5287 break; 5288 case IPPROTO_SCTP: 5289 ptype |= NGBE_PTYPE_TYP_SCTP; 5290 break; 5291 default: 5292 ptype |= NGBE_PTYPE_TYP_IP; 5293 break; 5294 } 5295 5296 exit: 5297 return ngbe_decode_ptype(ptype); 5298 } 5299 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 2095f425a2f9fc280284b026ca81a957bda446ef
by kernel test robot 21 Jan '25

21 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 2095f425a2f9fc280284b026ca81a957bda446ef !14870 quota: flush quota_release_work upon quota writeback Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501211343.QkEtCRqf-lkp@intel.com include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types] Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- arm64-defconfig | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | `-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- arm64-randconfig-001-20250121 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | |-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | `-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-randconfig-003-20250121 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | `-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250121 | `-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration |-- x86_64-buildonly-randconfig-002-20250121 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-003-20250121 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-004-20250121 | `-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function |-- x86_64-buildonly-randconfig-005-20250121 | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active | `-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function |-- x86_64-buildonly-randconfig-006-20250121 | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- x86_64-defconfig | `-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used `-- x86_64-randconfig-161-20250121 |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- fs-fscache-cookie.c-fscache_alloc_object()-warn:argument-to-lx-specifier-is-cast-from-pointer |-- fs-fscache-cookie.c-fscache_attach_object()-warn:argument-to-lx-specifier-is-cast-from-pointer |-- fs-fscache-cookie.c-fscache_hash_cookie()-error:uninitialized-symbol-cursor-. `-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used elapsed time: 723m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250121 gcc-14.2.0 arm64 randconfig-002-20250121 gcc-14.2.0 arm64 randconfig-003-20250121 gcc-14.2.0 arm64 randconfig-004-20250121 clang-18 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250121 gcc-12 x86_64 buildonly-randconfig-002-20250121 clang-19 x86_64 buildonly-randconfig-003-20250121 gcc-12 x86_64 buildonly-randconfig-004-20250121 clang-19 x86_64 buildonly-randconfig-005-20250121 clang-19 x86_64 buildonly-randconfig-006-20250121 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/4] Mainline patch to olk-5.10
by Chengchang Tang 21 Jan '25

21 Jan '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Mainline patch to olk-5.10: Feng Fang (1): RDMA/hns: Fix different dgids mapping to the same dip_idx Xinghai Cen (2): Revert "RDMA/hns: Fix flush cqe error when racing with destroy qp" Revert "RDMA/hns: Fix different dgids mapping to the same dip_idx" wenglianfa (1): RDMA/hns: Fix flush cqe error when racing with destroy qp drivers/infiniband/hw/hns/hns_roce_device.h | 11 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 117 ++++++++++---------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 - drivers/infiniband/hw/hns/hns_roce_main.c | 2 - drivers/infiniband/hw/hns/hns_roce_qp.c | 17 +-- 5 files changed, 61 insertions(+), 87 deletions(-) -- 2.33.0

1 4

[PATCH OLK-5.10 0/4] Mainline patch to olk-5.10
by Chengchang Tang 21 Jan '25

21 Jan '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Mainline patch to olk-5.10: Feng Fang (1): RDMA/hns: Fix different dgids mapping to the same dip_idx Xinghai Cen (2): Revert "RDMA/hns: Fix flush cqe error when racing with destroy qp" Revert "RDMA/hns: Fix different dgids mapping to the same dip_idx" wenglianfa (1): RDMA/hns: Fix flush cqe error when racing with destroy qp drivers/infiniband/hw/hns/hns_roce_device.h | 11 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 117 ++++++++++---------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 1 - drivers/infiniband/hw/hns/hns_roce_main.c | 2 - drivers/infiniband/hw/hns/hns_roce_qp.c | 17 +-- 5 files changed, 61 insertions(+), 87 deletions(-) -- 2.33.0

1 4

[PATCH OLK-6.6] RDMA/hns: Fix unmatch exception handling when request_irq() fails
by Chengchang Tang 21 Jan '25

21 Jan '25

From: Junxian Huang <huangjunxian6(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIJLS ---------------------------------------------------------------------- Only CEQ set the tasklet. AEQ doesn't need to kill the tasklet in exception handler. Fixes: 8cde9df37098 ("RDMA/hns: Fix soft lockup under heavy CEQE load") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 43c3c247e82f..332edb76ea9c 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -7138,14 +7138,16 @@ static int __hns_roce_request_irq(struct hns_roce_dev *hr_dev, int irq_num, return 0; err_request_failed: - for (j -= 1; j >= 0; j--) + for (j -= 1; j >= 0; j--) { if (j < other_num) { free_irq(hr_dev->irq[j], hr_dev); - } else { - free_irq(eq_table->eq[j - other_num].irq, - &eq_table->eq[j - other_num]); - tasklet_kill(&eq_table->eq[j - other_num].tasklet); + continue; } + free_irq(eq_table->eq[j - other_num].irq, + &eq_table->eq[j - other_num]); + if (j < other_num + comp_num) + tasklet_kill(&eq_table->eq[j - other_num].tasklet); + } err_kzalloc_failed: for (i -= 1; i >= 0; i--) -- 2.33.0

2 1

[openeuler:OLK-6.6 1834/1834] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: error: 'NR_syscalls' undeclared; did you mean 'si_syscall'?
by kernel test robot 21 Jan '25

21 Jan '25

Hi chench00, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [1834/1834] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-buildonly-randconfig-006-20250121 (https://download.01.org/0day-ci/archive/20250121/202501211756.LmO1gDKg-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250121/202501211756.LmO1gDKg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501211756.LmO1gDKg-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: warning: no previous prototype for 'tdm_service_run' [-Wmissing-prototypes] 151 | int tdm_service_run(struct tdm_security_enhance *data) | ^~~~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: warning: no previous prototype for 'tdm_service_exit' [-Wmissing-prototypes] 212 | int tdm_service_exit(struct tdm_security_enhance *data) | ^~~~~~~~~~~~~~~~ drivers/crypto/ccp/hygon/tdm-kernel-guard.c: In function 'kernel_security_enhance_init': >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: error: 'NR_syscalls' undeclared (first use in this function); did you mean 'si_syscall'? 308 | eh_objs[SCT].size = NR_syscalls * sizeof(char *); | ^~~~~~~~~~~ | si_syscall drivers/crypto/ccp/hygon/tdm-kernel-guard.c:308:37: note: each undeclared identifier is reported only once for each function it appears in vim +308 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 286 287 sct_addr = (unsigned long *)kallsyms_lookup_name("sys_call_table"); 288 #endif 289 if (!sct_addr) { 290 ret = -DYN_ERR_API; 291 pr_err("kallsyms_lookup_name for sys_call_table failed!"); 292 goto end; 293 } 294 295 asm("sidt %0":"=m"(idtr)); 296 297 if (!psp_check_tdm_support()) 298 return 0; 299 300 for (i = 0; i < MAX_OBJ; i++) { 301 memset(&eh_objs[i], 0, sizeof(eh_objs[i])); 302 eh_objs[i].context = CONTEXT_CHECK_MODNAME; 303 eh_objs[i].obj_name = obj_names[i]; 304 } 305 306 if ((eh_obj == -1) || (eh_obj & (1 << SCT))) { 307 eh_objs[SCT].vaddr = (uint64_t)sct_addr; > 308 eh_objs[SCT].size = NR_syscalls * sizeof(char *); 309 } 310 if ((eh_obj == -1) || (eh_obj & (1 << IDT))) { 311 eh_objs[IDT].vaddr = idtr.address; 312 eh_objs[IDT].size = idtr.size; 313 } 314 315 for (i = 0; i < MAX_OBJ; i++) { 316 if (eh_objs[i].vaddr) 317 tdm_service_run(&eh_objs[i]); 318 } 319 320 pr_info("Hygon TDM guard load successfully!\n"); 321 322 end: 323 return ret; 324 } 325 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] soc: imx8m: Probe the SoC driver as platform driver
by Tirui Yin 21 Jan '25

21 Jan '25

From: Marek Vasut <marex(a)denx.de> stable inclusion from stable-v6.6.66 commit 2129f6faa5dfe8c6b87aad11720bf75edd77d3e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIHOP CVE: CVE-2024-56787 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9cc832d37799dbea950c4c8a34721b02b8b5a8ff ] With driver_async_probe=* on kernel command line, the following trace is produced because on i.MX8M Plus hardware because the soc-imx8m.c driver calls of_clk_get_by_name() which returns -EPROBE_DEFER because the clock driver is not yet probed. This was not detected during regular testing without driver_async_probe. Convert the SoC code to platform driver and instantiate a platform device in its current device_initcall() to probe the platform driver. Rework .soc_revision callback to always return valid error code and return SoC revision via parameter. This way, if anything in the .soc_revision callback return -EPROBE_DEFER, it gets propagated to .probe and the .probe will get retried later. " ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1 at drivers/soc/imx/soc-imx8m.c:115 imx8mm_soc_revision+0xdc/0x180 CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-next-20240924-00002-g2062bb554dea #603 Hardware name: DH electronics i.MX8M Plus DHCOM Premium Developer Kit (3) (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : imx8mm_soc_revision+0xdc/0x180 lr : imx8mm_soc_revision+0xd0/0x180 sp : ffff8000821fbcc0 x29: ffff8000821fbce0 x28: 0000000000000000 x27: ffff800081810120 x26: ffff8000818a9970 x25: 0000000000000006 x24: 0000000000824311 x23: ffff8000817f42c8 x22: ffff0000df8be210 x21: fffffffffffffdfb x20: ffff800082780000 x19: 0000000000000001 x18: ffffffffffffffff x17: ffff800081fff418 x16: ffff8000823e1000 x15: ffff0000c03b65e8 x14: ffff0000c00051b0 x13: ffff800082790000 x12: 0000000000000801 x11: ffff80008278ffff x10: ffff80008209d3a6 x9 : ffff80008062e95c x8 : ffff8000821fb9a0 x7 : 0000000000000000 x6 : 00000000000080e3 x5 : ffff0000df8c03d8 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : fffffffffffffdfb x0 : fffffffffffffdfb Call trace: imx8mm_soc_revision+0xdc/0x180 imx8_soc_init+0xb0/0x1e0 do_one_initcall+0x94/0x1a8 kernel_init_freeable+0x240/0x2a8 kernel_init+0x28/0x140 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- SoC: i.MX8MP revision 1.1 " Signed-off-by: Marek Vasut <marex(a)denx.de> Signed-off-by: Shawn Guo <shawnguo(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/soc/imx/soc-imx8m.c | 107 ++++++++++++++++++++++++++++-------- 1 file changed, 85 insertions(+), 22 deletions(-) diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c index ec87d9d878f3..1ff8c7d847a9 100644 --- a/drivers/soc/imx/soc-imx8m.c +++ b/drivers/soc/imx/soc-imx8m.c @@ -30,7 +30,7 @@ struct imx8_soc_data { char *name; - u32 (*soc_revision)(void); + int (*soc_revision)(u32 *socrev); }; static u64 soc_uid; @@ -51,24 +51,29 @@ static u32 imx8mq_soc_revision_from_atf(void) static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; }; #endif -static u32 __init imx8mq_soc_revision(void) +static int imx8mq_soc_revision(u32 *socrev) { struct device_node *np; void __iomem *ocotp_base; u32 magic; u32 rev; struct clk *clk; + int ret; np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); if (!np) - return 0; + return -EINVAL; ocotp_base = of_iomap(np, 0); - WARN_ON(!ocotp_base); + if (!ocotp_base) { + ret = -EINVAL; + goto err_iomap; + } + clk = of_clk_get_by_name(np, NULL); if (IS_ERR(clk)) { - WARN_ON(IS_ERR(clk)); - return 0; + ret = PTR_ERR(clk); + goto err_clk; } clk_prepare_enable(clk); @@ -88,32 +93,45 @@ static u32 __init imx8mq_soc_revision(void) soc_uid <<= 32; soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); + *socrev = rev; + clk_disable_unprepare(clk); clk_put(clk); iounmap(ocotp_base); of_node_put(np); - return rev; + return 0; + +err_clk: + iounmap(ocotp_base); +err_iomap: + of_node_put(np); + return ret; } -static void __init imx8mm_soc_uid(void) +static int imx8mm_soc_uid(void) { void __iomem *ocotp_base; struct device_node *np; struct clk *clk; + int ret = 0; u32 offset = of_machine_is_compatible("fsl,imx8mp") ? IMX8MP_OCOTP_UID_OFFSET : 0; np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); if (!np) - return; + return -EINVAL; ocotp_base = of_iomap(np, 0); - WARN_ON(!ocotp_base); + if (!ocotp_base) { + ret = -EINVAL; + goto err_iomap; + } + clk = of_clk_get_by_name(np, NULL); if (IS_ERR(clk)) { - WARN_ON(IS_ERR(clk)); - return; + ret = PTR_ERR(clk); + goto err_clk; } clk_prepare_enable(clk); @@ -124,31 +142,41 @@ static void __init imx8mm_soc_uid(void) clk_disable_unprepare(clk); clk_put(clk); + +err_clk: iounmap(ocotp_base); +err_iomap: of_node_put(np); + + return ret; } -static u32 __init imx8mm_soc_revision(void) +static int imx8mm_soc_revision(u32 *socrev) { struct device_node *np; void __iomem *anatop_base; - u32 rev; + int ret; np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); if (!np) - return 0; + return -EINVAL; anatop_base = of_iomap(np, 0); - WARN_ON(!anatop_base); + if (!anatop_base) { + ret = -EINVAL; + goto err_iomap; + } - rev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM); + *socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM); iounmap(anatop_base); of_node_put(np); - imx8mm_soc_uid(); + return imx8mm_soc_uid(); - return rev; +err_iomap: + of_node_put(np); + return ret; } static const struct imx8_soc_data imx8mq_soc_data = { @@ -184,7 +212,7 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \ "unknown" -static int __init imx8_soc_init(void) +static int imx8m_soc_probe(struct platform_device *pdev) { struct soc_device_attribute *soc_dev_attr; struct soc_device *soc_dev; @@ -212,8 +240,11 @@ static int __init imx8_soc_init(void) data = id->data; if (data) { soc_dev_attr->soc_id = data->name; - if (data->soc_revision) - soc_rev = data->soc_revision(); + if (data->soc_revision) { + ret = data->soc_revision(&soc_rev); + if (ret) + goto free_soc; + } } soc_dev_attr->revision = imx8_revision(soc_rev); @@ -251,5 +282,37 @@ static int __init imx8_soc_init(void) kfree(soc_dev_attr); return ret; } + +static struct platform_driver imx8m_soc_driver = { + .probe = imx8m_soc_probe, + .driver = { + .name = "imx8m-soc", + }, +}; + +static int __init imx8_soc_init(void) +{ + struct platform_device *pdev; + int ret; + + /* No match means this is non-i.MX8M hardware, do nothing. */ + if (!of_match_node(imx8_soc_match, of_root)) + return 0; + + ret = platform_driver_register(&imx8m_soc_driver); + if (ret) { + pr_err("Failed to register imx8m-soc platform driver: %d\n", ret); + return ret; + } + + pdev = platform_device_register_simple("imx8m-soc", -1, NULL, 0); + if (IS_ERR(pdev)) { + pr_err("Failed to register imx8m-soc platform device: %ld\n", PTR_ERR(pdev)); + platform_driver_unregister(&imx8m_soc_driver); + return PTR_ERR(pdev); + } + + return 0; +} device_initcall(imx8_soc_init); MODULE_LICENSE("GPL"); -- 2.22.0

2 1

[PATCH OLK-6.6] arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
by Yuntao Liu 21 Jan '25

21 Jan '25

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.66 commit 96035c0093db258975b8887676afe59a64c34a72 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIO47 CVE: CVE-2024-57874 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and rejects other values, a partial SETREGSET attempt will randomly succeed or fail depending on the value of the uninitialized value, and the exposure is significantly limited. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing value of the tagged address ctrl will be retained. The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the user_aarch64_view used by a native AArch64 task to manipulate another native AArch64 task. As get_tagged_addr_ctrl() only returns an error value when called for a compat task, tagged_addr_ctrl_get() and tagged_addr_ctrl_set() should never observe an error value from get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that such an error would be unexpected, and error handlnig is not missing in either case. Fixes: 2200aa7154cb ("arm64: mte: ptrace: Add NT_ARM_TAGGED_ADDR_CTRL regset") Cc: <stable(a)vger.kernel.org> # 5.10.x Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20241205121655.1824269-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm64/kernel/ptrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 28a5ddcf0a1e..d34b57caad49 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -1384,7 +1384,7 @@ static int tagged_addr_ctrl_get(struct task_struct *target, { long ctrl = get_tagged_addr_ctrl(target); - if (IS_ERR_VALUE(ctrl)) + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) return ctrl; return membuf_write(&to, &ctrl, sizeof(ctrl)); @@ -1398,6 +1398,10 @@ static int tagged_addr_ctrl_set(struct task_struct *target, const struct int ret; long ctrl; + ctrl = get_tagged_addr_ctrl(target); + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) + return ctrl; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1); if (ret) return ret; -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
by Chen Ridong 21 Jan '25

21 Jan '25

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> mainline inclusion from mainline-v6.13-rc2 commit 711201a8b8334a397440ac0b859df0054e174bc9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIDGN CVE: CVE-2024-57804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and enabled in rapid succession, the persistent and current config pages related to SAS IO unit/SAS Expander pages could get corrupted. Use separate memory for each config request. Signed-off-by: Prayas Patel <prayas.patel(a)broadcom.com> Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20241110194405.10108-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/mpi3mr/mpi3mr_fw.c [context is mispatched] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- drivers/scsi/mpi3mr/mpi3mr.h | 9 ---- drivers/scsi/mpi3mr/mpi3mr_fw.c | 81 ++++++--------------------------- 2 files changed, 13 insertions(+), 77 deletions(-) diff --git a/drivers/scsi/mpi3mr/mpi3mr.h b/drivers/scsi/mpi3mr/mpi3mr.h index ae98d15c30b1d..7022435c21e9f 100644 --- a/drivers/scsi/mpi3mr/mpi3mr.h +++ b/drivers/scsi/mpi3mr/mpi3mr.h @@ -131,8 +131,6 @@ extern atomic64_t event_counter; #define MPI3MR_WATCHDOG_INTERVAL 1000 /* in milli seconds */ -#define MPI3MR_DEFAULT_CFG_PAGE_SZ 1024 /* in bytes */ - #define MPI3MR_RESET_TOPOLOGY_SETTLE_TIME 10 #define MPI3MR_SCMD_TIMEOUT (60 * HZ) @@ -1031,9 +1029,6 @@ struct scmd_priv { * @io_throttle_low: I/O size to stop throttle in 512b blocks * @num_io_throttle_group: Maximum number of throttle groups * @throttle_groups: Pointer to throttle group info structures - * @cfg_page: Default memory for configuration pages - * @cfg_page_dma: Configuration page DMA address - * @cfg_page_sz: Default configuration page memory size * @sas_transport_enabled: SAS transport enabled or not * @scsi_device_channel: Channel ID for SCSI devices * @transport_cmds: Command tracker for SAS transport commands @@ -1215,10 +1210,6 @@ struct mpi3mr_ioc { u16 num_io_throttle_group; struct mpi3mr_throttle_group_info *throttle_groups; - void *cfg_page; - dma_addr_t cfg_page_dma; - u16 cfg_page_sz; - u8 sas_transport_enabled; u8 scsi_device_channel; struct mpi3mr_drv_cmd transport_cmds; diff --git a/drivers/scsi/mpi3mr/mpi3mr_fw.c b/drivers/scsi/mpi3mr/mpi3mr_fw.c index 0d148c39ebcc9..0ee9233649e0c 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_fw.c +++ b/drivers/scsi/mpi3mr/mpi3mr_fw.c @@ -3860,17 +3860,6 @@ int mpi3mr_init_ioc(struct mpi3mr_ioc *mrioc) mpi3mr_print_ioc_info(mrioc); - if (!mrioc->cfg_page) { - dprint_init(mrioc, "allocating config page buffers\n"); - mrioc->cfg_page_sz = MPI3MR_DEFAULT_CFG_PAGE_SZ; - mrioc->cfg_page = dma_alloc_coherent(&mrioc->pdev->dev, - mrioc->cfg_page_sz, &mrioc->cfg_page_dma, GFP_KERNEL); - if (!mrioc->cfg_page) { - retval = -1; - goto out_failed_noretry; - } - } - if (!mrioc->init_cmds.reply) { retval = mpi3mr_alloc_reply_sense_bufs(mrioc); if (retval) { @@ -4410,11 +4399,7 @@ void mpi3mr_free_mem(struct mpi3mr_ioc *mrioc) mrioc->admin_req_base, mrioc->admin_req_dma); mrioc->admin_req_base = NULL; } - if (mrioc->cfg_page) { - dma_free_coherent(&mrioc->pdev->dev, mrioc->cfg_page_sz, - mrioc->cfg_page, mrioc->cfg_page_dma); - mrioc->cfg_page = NULL; - } + if (mrioc->pel_seqnum_virt) { dma_free_coherent(&mrioc->pdev->dev, mrioc->pel_seqnum_sz, mrioc->pel_seqnum_virt, mrioc->pel_seqnum_dma); @@ -4999,55 +4984,6 @@ int mpi3mr_soft_reset_handler(struct mpi3mr_ioc *mrioc, return retval; } - -/** - * mpi3mr_free_config_dma_memory - free memory for config page - * @mrioc: Adapter instance reference - * @mem_desc: memory descriptor structure - * - * Check whether the size of the buffer specified by the memory - * descriptor is greater than the default page size if so then - * free the memory pointed by the descriptor. - * - * Return: Nothing. - */ -static void mpi3mr_free_config_dma_memory(struct mpi3mr_ioc *mrioc, - struct dma_memory_desc *mem_desc) -{ - if ((mem_desc->size > mrioc->cfg_page_sz) && mem_desc->addr) { - dma_free_coherent(&mrioc->pdev->dev, mem_desc->size, - mem_desc->addr, mem_desc->dma_addr); - mem_desc->addr = NULL; - } -} - -/** - * mpi3mr_alloc_config_dma_memory - Alloc memory for config page - * @mrioc: Adapter instance reference - * @mem_desc: Memory descriptor to hold dma memory info - * - * This function allocates new dmaable memory or provides the - * default config page dmaable memory based on the memory size - * described by the descriptor. - * - * Return: 0 on success, non-zero on failure. - */ -static int mpi3mr_alloc_config_dma_memory(struct mpi3mr_ioc *mrioc, - struct dma_memory_desc *mem_desc) -{ - if (mem_desc->size > mrioc->cfg_page_sz) { - mem_desc->addr = dma_alloc_coherent(&mrioc->pdev->dev, - mem_desc->size, &mem_desc->dma_addr, GFP_KERNEL); - if (!mem_desc->addr) - return -ENOMEM; - } else { - mem_desc->addr = mrioc->cfg_page; - mem_desc->dma_addr = mrioc->cfg_page_dma; - memset(mem_desc->addr, 0, mrioc->cfg_page_sz); - } - return 0; -} - /** * mpi3mr_post_cfg_req - Issue config requests and wait * @mrioc: Adapter instance reference @@ -5203,8 +5139,12 @@ static int mpi3mr_process_cfg_req(struct mpi3mr_ioc *mrioc, cfg_req->page_length = cfg_hdr->page_length; cfg_req->page_version = cfg_hdr->page_version; } - if (mpi3mr_alloc_config_dma_memory(mrioc, &mem_desc)) - goto out; + + mem_desc.addr = dma_alloc_coherent(&mrioc->pdev->dev, + mem_desc.size, &mem_desc.dma_addr, GFP_KERNEL); + + if (!mem_desc.addr) + return retval; mpi3mr_add_sg_single(&cfg_req->sgl, sgl_flags, mem_desc.size, mem_desc.dma_addr); @@ -5233,7 +5173,12 @@ static int mpi3mr_process_cfg_req(struct mpi3mr_ioc *mrioc, } out: - mpi3mr_free_config_dma_memory(mrioc, &mem_desc); + if (mem_desc.addr) { + dma_free_coherent(&mrioc->pdev->dev, mem_desc.size, + mem_desc.addr, mem_desc.dma_addr); + mem_desc.addr = NULL; + } + return retval; } -- 2.34.1

2 1

[PATCH OLK-6.6] iio: light: vcnl4035: fix information leak in triggered buffer
by Huang Xiaojia 21 Jan '25

21 Jan '25

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v6.6.72 commit a15ea87d4337479c9446b5d71616f4668337afed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQVN CVE: CVE-2024-57910 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 47b43e53c0a0edf5578d5d12f5fc71c019649279 upstream. The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. That leaves at least 4 bytes uninitialized even after writing an integer value with regmap_read(). Initialize the array to zero before using it to avoid pushing uninitialized information to userspace. Cc: stable(a)vger.kernel.org Fixes: ec90b52c07c0 ("iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp()") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-6-0cb6e98d895c@g… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/iio/light/vcnl4035.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/light/vcnl4035.c b/drivers/iio/light/vcnl4035.c index 56bbefbc0ae6..fe3c4c5db620 100644 --- a/drivers/iio/light/vcnl4035.c +++ b/drivers/iio/light/vcnl4035.c @@ -105,7 +105,7 @@ static irqreturn_t vcnl4035_trigger_consumer_handler(int irq, void *p) struct iio_dev *indio_dev = pf->indio_dev; struct vcnl4035_data *data = iio_priv(indio_dev); /* Ensure naturally aligned timestamp */ - u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8); + u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { }; int ret; ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: fix OOB devmap writes when deleting elements
by Tengda Wu 21 Jan '25

21 Jan '25

From: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> mainline inclusion from mainline-v6.13-rc2 commit ab244dd7cf4c291f82faacdc50b45cc0f55b674d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIOCY CVE: CVE-2024-56615 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed. When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32. Example splat below: [ 160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [ 160.731662] #PF: supervisor read access in kernel mode [ 160.736876] #PF: error_code(0x0000) - not-present page [ 160.742095] PGD 0 P4D 0 [ 160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [ 160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [ 160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 160.767642] Workqueue: events_unbound bpf_map_free_deferred [ 160.773308] RIP: 0010:dev_map_free+0x77/0x170 [ 160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 <48> 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [ 160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [ 160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [ 160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [ 160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [ 160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [ 160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [ 160.838310] FS: 0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [ 160.846528] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [ 160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 160.874092] PKRU: 55555554 [ 160.876847] Call Trace: [ 160.879338] <TASK> [ 160.881477] ? __die+0x20/0x60 [ 160.884586] ? page_fault_oops+0x15a/0x450 [ 160.888746] ? search_extable+0x22/0x30 [ 160.892647] ? search_bpf_extables+0x5f/0x80 [ 160.896988] ? exc_page_fault+0xa9/0x140 [ 160.900973] ? asm_exc_page_fault+0x22/0x30 [ 160.905232] ? dev_map_free+0x77/0x170 [ 160.909043] ? dev_map_free+0x58/0x170 [ 160.912857] bpf_map_free_deferred+0x51/0x90 [ 160.917196] process_one_work+0x142/0x370 [ 160.921272] worker_thread+0x29e/0x3b0 [ 160.925082] ? rescuer_thread+0x4b0/0x4b0 [ 160.929157] kthread+0xd4/0x110 [ 160.932355] ? kthread_park+0x80/0x80 [ 160.936079] ret_from_fork+0x2d/0x50 [ 160.943396] ? kthread_park+0x80/0x80 [ 160.950803] ret_from_fork_asm+0x11/0x20 [ 160.958482] </TASK> Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references") CC: stable(a)vger.kernel.org Reported-by: Jordy Zomer <jordyzomer(a)google.com> Suggested-by: Jordy Zomer <jordyzomer(a)google.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-3-maciej.fijalkowski@intel.… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/devmap.c [The conflicts are due to we did not backport 0536b85239b8 ("xdp: Simplify devmap cleanup") yet.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/devmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c index 1defea4b2755..f736a9ba4567 100644 --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -147,7 +147,8 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr) static void dev_map_free(struct bpf_map *map) { struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map); - int i, cpu; + int cpu; + u32 i; /* At this point bpf_prog->aux->refcnt == 0 and this map->refcnt == 0, * so the programs (can be more than one that used this map) were @@ -418,7 +419,7 @@ static int dev_map_delete_elem(struct bpf_map *map, void *key) { struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map); struct bpf_dtab_netdev *old_dev; - int k = *(u32 *)key; + u32 k = *(u32 *)key; if (k >= map->max_entries) return -EINVAL; -- 2.34.1

2 1

[openeuler:OLK-5.10 2710/2710] include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast
by kernel test robot 21 Jan '25

21 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2095f425a2f9fc280284b026ca81a957bda446ef commit: 83b931be40b2829e20f38356509d8706ea6b6238 [2710/2710] mm/damon/core-test: test damon_set_regions config: arm64-randconfig-001-20250121 (https://download.01.org/0day-ci/archive/20250121/202501211343.QkEtCRqf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250121/202501211343.QkEtCRqf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501211343.QkEtCRqf-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/kernel.h:14, from include/linux/list.h:9, from include/linux/mutex.h:15, from include/linux/damon.h:11, from mm/damon/core.c:10: mm/damon/core-test.h: In function 'damon_test_set_regions': >> include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types] 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ include/kunit/test.h:748:16: note: in expansion of macro '__typecheck' 748 | ((void)__typecheck(__left, __right)); \ | ^~~~~~~~~~~ include/kunit/test.h:772:9: note: in expansion of macro 'KUNIT_BASE_BINARY_ASSERTION' 772 | KUNIT_BASE_BINARY_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:861:9: note: in expansion of macro 'KUNIT_BASE_EQ_MSG_ASSERTION' 861 | KUNIT_BASE_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:871:9: note: in expansion of macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' 871 | KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:1234:9: note: in expansion of macro 'KUNIT_BINARY_EQ_ASSERTION' 1234 | KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) | ^~~~~~~~~~~~~~~~~~~~~~~~~ mm/damon/core-test.h:284:9: note: in expansion of macro 'KUNIT_EXPECT_EQ' 284 | KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); | ^~~~~~~~~~~~~~~ vim +20 include/linux/minmax.h cffb222bc2e032 Rikard Falkeborn 2021-06-07 6 b296a6d53339a7 Andy Shevchenko 2020-10-15 7 /* b296a6d53339a7 Andy Shevchenko 2020-10-15 8 * min()/max()/clamp() macros must accomplish three things: b296a6d53339a7 Andy Shevchenko 2020-10-15 9 * b296a6d53339a7 Andy Shevchenko 2020-10-15 10 * - avoid multiple evaluations of the arguments (so side-effects like b296a6d53339a7 Andy Shevchenko 2020-10-15 11 * "x++" happen only once) when non-constant. b296a6d53339a7 Andy Shevchenko 2020-10-15 12 * - perform strict type-checking (to generate warnings instead of b296a6d53339a7 Andy Shevchenko 2020-10-15 13 * nasty runtime surprises). See the "unnecessary" pointer comparison b296a6d53339a7 Andy Shevchenko 2020-10-15 14 * in __typecheck(). b296a6d53339a7 Andy Shevchenko 2020-10-15 15 * - retain result as a constant expressions when called with only b296a6d53339a7 Andy Shevchenko 2020-10-15 16 * constant expressions (to avoid tripping VLA warnings in stack b296a6d53339a7 Andy Shevchenko 2020-10-15 17 * allocation usage). b296a6d53339a7 Andy Shevchenko 2020-10-15 18 */ b296a6d53339a7 Andy Shevchenko 2020-10-15 19 #define __typecheck(x, y) \ b296a6d53339a7 Andy Shevchenko 2020-10-15 @20 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) b296a6d53339a7 Andy Shevchenko 2020-10-15 21 :::::: The code at line 20 was first introduced by commit :::::: b296a6d53339a79082c1d2c1761e948e8b3def69 kernel.h: split out min()/max() et al. helpers :::::: TO: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1833/1833] kernel/sched/bpf_sched.c:211:32: error: 'struct cfs_rq' has no member named 'tg'
by kernel test robot 21 Jan '25

21 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 88ee450e4bfbe03d27189e9a1a794f610ad57ae5 commit: 6f06e093b3708dcee5b7e4f0478e0206bc601da1 [1833/1833] sched/ebpf: Support task selection programmable config: arm64-randconfig-r061-20250121 (https://download.01.org/0day-ci/archive/20250121/202501211149.c38cljuA-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250121/202501211149.c38cljuA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501211149.c38cljuA-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:113: kernel/sched/bpf_sched.c:187:17: warning: no previous prototype for 'bpf_sched_entity_is_task' [-Wmissing-prototypes] 187 | __bpf_kfunc int bpf_sched_entity_is_task(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/bpf_sched.c:195:33: warning: no previous prototype for 'bpf_sched_entity_to_task' [-Wmissing-prototypes] 195 | __bpf_kfunc struct task_struct *bpf_sched_entity_to_task(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/bpf_sched.c:203:18: warning: no previous prototype for 'bpf_sched_tag_of_entity' [-Wmissing-prototypes] 203 | __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/bpf_sched.c: In function 'bpf_sched_tag_of_entity': >> kernel/sched/bpf_sched.c:211:32: error: 'struct cfs_rq' has no member named 'tg' 211 | return group_cfs_rq(se)->tg->tag; | ^~ vim +211 kernel/sched/bpf_sched.c 202 203 __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) 204 { 205 if (!se) 206 return -EINVAL; 207 208 if (entity_is_task(se)) 209 return task_of(se)->tag; 210 > 211 return group_cfs_rq(se)->tg->tag; 212 } 213 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 00/15] merge CVE patches into OLK-5.10
by Kaixiong Yu 21 Jan '25

21 Jan '25

CVE-2024-56715 CVE-2024-56746 CVE-2024-56704 CVE-2024-53198 CVE-2024-53183 CVE-2024-56539 CVE-2024-56571 CVE-2024-56610 CVE-2024-56611 CVE-2024-50280 CVE-2024-50194 CVE-2023-52913 Alex Zenla (1): 9p/xen: fix release of IRQ Alper Nebi Yasak (1): wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Brett Creeley (1): ionic: Fix netdev notifier unregister on failure David Hildenbrand (1): mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM Marco Elver (1): kcsan: Turn report_filterlist_lock into a raw_spinlock Mark Rutland (1): arm64: probes: Fix uprobes for big-endian kernels Ming-Hung Tsai (1): dm cache: fix flushing uninitialized delayed_work on cache_ctr error Qiu-ji Chen (1): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() Rob Clark (1): drm/i915: Fix potential context UAFs Thadeu Lima de Souza Cascardo (1): media: uvcvideo: Require entities to have a non-zero unique ID Thomas Zimmermann (1): fbdev/sh7760fb: Alloc DMA memory from hardware device Tiwei Bie (1): um: net: Do not use drvdata in release Zhen Lei (1): fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() junhua huang (2): arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning arch/arm64/include/asm/uprobes.h | 12 ++- arch/arm64/kernel/probes/uprobes.c | 4 +- arch/um/drivers/net_kern.c | 2 +- drivers/gpu/drm/i915/gem/i915_gem_context.c | 8 +- drivers/md/dm-cache-target.c | 24 +++--- drivers/media/usb/uvc/uvc_driver.c | 63 ++++++++++------ .../net/ethernet/pensando/ionic/ionic_lif.c | 3 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/video/fbdev/sh7760fb.c | 11 ++- drivers/xen/xenbus/xenbus_probe.c | 8 +- kernel/kcsan/debugfs.c | 74 +++++++++---------- mm/mempolicy.c | 4 + net/9p/trans_xen.c | 2 +- 13 files changed, 122 insertions(+), 95 deletions(-) -- 2.34.1

2 16

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5089b89573d94320f21ed85996fa1a578d46d543
by kernel test robot 21 Jan '25

21 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5089b89573d94320f21ed85996fa1a578d46d543 !14871 quota: flush quota_release_work upon quota writeback Error/Warning (recently discovered and may have been fixed): drivers/staging/gasket/.tmp_gasket_interrupt.o: warning: objtool: missing symbol for section .text drivers/staging/gasket/.tmp_gasket_ioctl.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/scsi/ufs/.tmp_ufs-hisi.o: warning: objtool: missing symbol for section .init.text include/linux/list.h:65:19: warning: storing the address of local variable 'tmp' in '((struct list_head *)lip)[4].prev' [-Wdangling-pointer=] sound/isa/ad1816a/ad1816a.o: warning: objtool: missing symbol for section .init.text sound/isa/als100.o: warning: objtool: missing symbol for section .init.text sound/isa/azt2320.o: warning: objtool: missing symbol for section .init.text sound/isa/es1688/es1688.o: warning: objtool: missing symbol for section .init.text sound/isa/gus/interwave-stb.o: warning: objtool: missing symbol for section .init.text sound/isa/sb/emu8000_synth.o: warning: objtool: missing symbol for section .init.text sound/isa/sb/sbawe.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-allnoconfig | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- arm64-defconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-randconfig-001-20250120 | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- arm64-randconfig-002-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-tmp-in-((struct-list_head-)lip)-.prev | |-- include-linux-uaccess.h:warning:cap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:entries-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ifreq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ioc_data-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:mr-may-be-used-uninitialized |-- arm64-randconfig-003-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- arm64-randconfig-004-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-list.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | `-- include-linux-plist.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node |-- x86_64-alldefconfig | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250120 | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-003-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-004-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-005-20250116 | |-- drivers-scsi-ufs-.tmp_ufs-hisi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-gasket-.tmp_gasket_interrupt.o:warning:objtool:missing-symbol-for-section-.text | `-- drivers-staging-gasket-.tmp_gasket_ioctl.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20250120 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-hotplug-pciehp_ctrl.o:warning:objtool:missing-symbol-for-section-.text | `-- fs-xfs-xfs_rtalloc.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20250120 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-iio-resolver-ad2s1200.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-platform-qcom-camss-camss.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-xfs-xfs_bmap_util.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-xfs-xfs_symlink.o:warning:objtool:missing-symbol-for-section-.text | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- sound-isa-ad1816a-ad1816a.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-ad1848-ad1848.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-als100.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-azt2320.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-es1688-es1688.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-gus-interwave-stb.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-emu8000_patch.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-isa-sb-emu8000_synth.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-jazz16.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-sb8.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sb-sbawe.o:warning:objtool:missing-symbol-for-section-.init.text | |-- sound-isa-sc6000.o:warning:objtool:missing-symbol-for-section-.init.text | `-- sound-isa-wavefront-wavefront_fx.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-defconfig | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast |-- x86_64-randconfig-161-20250121 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-kernel.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used `-- x86_64-randconfig-r051-20250121 |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration elapsed time: 724m configs tested: 17 configs skipped: 127 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250120 gcc-14.2.0 arm64 randconfig-002-20250120 gcc-14.2.0 arm64 randconfig-003-20250120 gcc-14.2.0 arm64 randconfig-004-20250120 gcc-14.2.0 x86_64 alldefconfig gcc-12 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250120 clang-19 x86_64 buildonly-randconfig-002-20250120 clang-19 x86_64 buildonly-randconfig-003-20250120 gcc-12 x86_64 buildonly-randconfig-004-20250120 clang-19 x86_64 buildonly-randconfig-005-20250120 clang-19 x86_64 buildonly-randconfig-006-20250120 gcc-11 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 88ee450e4bfbe03d27189e9a1a794f610ad57ae5
by kernel test robot 21 Jan '25

21 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 88ee450e4bfbe03d27189e9a1a794f610ad57ae5 !14904 net: renesas: rswitch: avoid use-after-put for a device tree node Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501210717.sGx6dRjf-lkp@intel.com mm/mem_reliable.c:345:9: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable'; did you mean 'mem_reliable_ctrl_bit_disabled'? [-Wimplicit-function-declaration] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-r061-20250121 | `-- mm-mem_reliable.c:error:implicit-declaration-of-function-mem_reliable_ctrl_bit_disable |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250120 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. `-- x86_64-allyesconfig |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put elapsed time: 721m configs tested: 19 configs skipped: 114 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250120 gcc-14.2.0 arm64 randconfig-002-20250120 clang-20 arm64 randconfig-003-20250120 clang-19 arm64 randconfig-004-20250120 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250120 gcc-14.2.0 loongarch randconfig-002-20250120 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250120 clang-19 x86_64 buildonly-randconfig-002-20250120 clang-19 x86_64 buildonly-randconfig-003-20250120 gcc-12 x86_64 buildonly-randconfig-004-20250120 clang-19 x86_64 buildonly-randconfig-005-20250120 clang-19 x86_64 buildonly-randconfig-006-20250120 gcc-11 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1833/1833] mm/mem_reliable.c:345:9: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable'; did you mean 'mem_reliable_ctrl_bit_disabled'?
by kernel test robot 21 Jan '25

21 Jan '25

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 88ee450e4bfbe03d27189e9a1a794f610ad57ae5 commit: 425771499c0742a996ab28df143d7a5123102686 [1833/1833] mm: mem_reliable: Introduce proc interface to disable memory reliable features config: arm64-randconfig-r061-20250121 (https://download.01.org/0day-ci/archive/20250121/202501210717.sGx6dRjf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250121/202501210717.sGx6dRjf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501210717.sGx6dRjf-lkp@intel.com/ All errors (new ones prefixed by >>): mm/mem_reliable.c: In function 'mem_reliable_feature_disable': >> mm/mem_reliable.c:345:9: error: implicit declaration of function 'mem_reliable_ctrl_bit_disable'; did you mean 'mem_reliable_ctrl_bit_disabled'? [-Wimplicit-function-declaration] 345 | mem_reliable_ctrl_bit_disable(idx); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | mem_reliable_ctrl_bit_disabled mm/mem_reliable.c: At top level: mm/mem_reliable.c:320:13: warning: 'mem_reliable_ctrl_bit_disabled' defined but not used [-Wunused-function] 320 | static void mem_reliable_ctrl_bit_disabled(int idx) {} | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +345 mm/mem_reliable.c 322 323 static void mem_reliable_feature_disable(int idx) 324 { 325 char *str = NULL; 326 327 switch (idx) { 328 case MEM_RELIABLE_FALLBACK: 329 reliable_allow_fallback = false; 330 str = "fallback"; 331 break; 332 case MEM_RELIABLE_SHMEM: 333 shmem_reliable = false; 334 str = "shmem"; 335 break; 336 case MEM_RELIABLE_PAGECACHE: 337 pagecache_reliable = false; 338 str = "pagecache"; 339 break; 340 default: 341 pr_err("unknown index: %d", idx); 342 return; 343 } 344 > 345 mem_reliable_ctrl_bit_disable(idx); 346 pr_info("%s is disabled\n", str); 347 } 348 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-56641
by Wang Liang 20 Jan '25

20 Jan '25

D. Wythe (1): net/smc: refactoring initialization of smc sock Wen Gu (1): net/smc: initialize close_work early to avoid warning net/smc/af_smc.c | 90 ++++++++++++++++++++++++++---------------------- net/smc/smc.h | 5 +++ 2 files changed, 54 insertions(+), 41 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] net/smc: protect link down work from execute after lgr freed
by Wang Liang 20 Jan '25

20 Jan '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 2627c3e8646932dfc7b9722c88c2e1ffcf7a9fb2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG41 CVE: CVE-2024-56718 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2b33eb8f1b3e8c2f87cfdbc8cc117f6bdfabc6ec ] link down work may be scheduled before lgr freed but execute after lgr freed, which may result in crash. So it is need to hold a reference before shedule link down work, and put the reference after work executed or canceled. The relevant crash call stack as follows: list_del corruption. prev->next should be ffffb638c9c0fe20, but was 0000000000000000 ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:51! invalid opcode: 0000 [#1] SMP NOPTI CPU: 6 PID: 978112 Comm: kworker/6:119 Kdump: loaded Tainted: G #1 Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 2221b89 04/01/2014 Workqueue: events smc_link_down_work [smc] RIP: 0010:__list_del_entry_valid.cold+0x31/0x47 RSP: 0018:ffffb638c9c0fdd8 EFLAGS: 00010086 RAX: 0000000000000054 RBX: ffff942fb75e5128 RCX: 0000000000000000 RDX: ffff943520930aa0 RSI: ffff94352091fc80 RDI: ffff94352091fc80 RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb638c9c0fc38 R10: ffffb638c9c0fc30 R11: ffffffffa015eb28 R12: 0000000000000002 R13: ffffb638c9c0fe20 R14: 0000000000000001 R15: ffff942f9cd051c0 FS: 0000000000000000(0000) GS:ffff943520900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f25214000 CR3: 000000025fbae004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: rwsem_down_write_slowpath+0x17e/0x470 smc_link_down_work+0x3c/0x60 [smc] process_one_work+0x1ac/0x350 worker_thread+0x49/0x2f0 ? rescuer_thread+0x360/0x360 kthread+0x118/0x140 ? __kthread_bind_mask+0x60/0x60 ret_from_fork+0x1f/0x30 Fixes: 541afa10c126 ("net/smc: add smcr_port_err() and smcr_link_down() processing") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Tony Lu <tonylu(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/smc_core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c index acca3b1a068f..e38e29668a98 100644 --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -1773,7 +1773,9 @@ void smcr_link_down_cond_sched(struct smc_link *lnk) { if (smc_link_downing(&lnk->state)) { trace_smcr_link_down(lnk, __builtin_return_address(0)); - schedule_work(&lnk->link_down_wrk); + smcr_link_hold(lnk); /* smcr_link_put in link_down_wrk */ + if (!schedule_work(&lnk->link_down_wrk)) + smcr_link_put(lnk); } } @@ -1805,11 +1807,14 @@ static void smc_link_down_work(struct work_struct *work) struct smc_link_group *lgr = link->lgr; if (list_empty(&lgr->list)) - return; + goto out; wake_up_all(&lgr->llc_msg_waiter); down_write(&lgr->llc_conf_mutex); smcr_link_down(link); up_write(&lgr->llc_conf_mutex); + +out: + smcr_link_put(link); /* smcr_link_hold by schedulers of link_down_work */ } static int smc_vlan_by_tcpsk_walk(struct net_device *lower_dev, -- 2.34.1

2 1

[PATCH OLK-6.6] bnxt_en: Fix receive ring space parameters when XDP is active
by Wang Liang 20 Jan '25

20 Jan '25

From: Shravya KN <shravya.k-n(a)broadcom.com> mainline inclusion from mainline-v6.13-rc1 commit 3051a77a09dfe3022aa012071346937fdf059033 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF9 CVE: CVE-2024-53209 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The MTU setting at the time an XDP multi-buffer is attached determines whether the aggregation ring will be used and the rx_skb_func handler. This is done in bnxt_set_rx_skb_mode(). If the MTU is later changed, the aggregation ring setting may need to be changed and it may become out-of-sync with the settings initially done in bnxt_set_rx_skb_mode(). This may result in random memory corruption and crashes as the HW may DMA data larger than the allocated buffer size, such as: BUG: kernel NULL pointer dereference, address: 00000000000003c0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 17 PID: 0 Comm: swapper/17 Kdump: loaded Tainted: G S OE 6.1.0-226bf9805506 #1 Hardware name: Wiwynn Delta Lake PVT BZA.02601.0150/Delta Lake-Class1, BIOS F0E_3A12 08/26/2021 RIP: 0010:bnxt_rx_pkt+0xe97/0x1ae0 [bnxt_en] Code: 8b 95 70 ff ff ff 4c 8b 9d 48 ff ff ff 66 41 89 87 b4 00 00 00 e9 0b f7 ff ff 0f b7 43 0a 49 8b 95 a8 04 00 00 25 ff 0f 00 00 <0f> b7 14 42 48 c1 e2 06 49 03 95 a0 04 00 00 0f b6 42 33f RSP: 0018:ffffa19f40cc0d18 EFLAGS: 00010202 RAX: 00000000000001e0 RBX: ffff8e2c805c6100 RCX: 00000000000007ff RDX: 0000000000000000 RSI: ffff8e2c271ab990 RDI: ffff8e2c84f12380 RBP: ffffa19f40cc0e48 R08: 000000000001000d R09: 974ea2fcddfa4cbf R10: 0000000000000000 R11: ffffa19f40cc0ff8 R12: ffff8e2c94b58980 R13: ffff8e2c952d6600 R14: 0000000000000016 R15: ffff8e2c271ab990 FS: 0000000000000000(0000) GS:ffff8e3b3f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000003c0 CR3: 0000000e8580a004 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> __bnxt_poll_work+0x1c2/0x3e0 [bnxt_en] To address the issue, we now call bnxt_set_rx_skb_mode() within bnxt_change_mtu() to properly set the AGG rings configuration and update rx_skb_func based on the new MTU value. Additionally, BNXT_FLAG_NO_AGG_RINGS is cleared at the beginning of bnxt_set_rx_skb_mode() to make sure it gets set or cleared based on the current MTU. Fixes: 08450ea98ae9 ("bnxt_en: Fix max_mtu setting for multi-buf XDP") Co-developed-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Somnath Kotur <somnath.kotur(a)broadcom.com> Signed-off-by: Shravya KN <shravya.k-n(a)broadcom.com> Signed-off-by: Michael Chan <michael.chan(a)broadcom.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/ethernet/broadcom/bnxt/bnxt.c [conflicts due to not mergered 1eb2cded45b3 ("net: annotate writes on dev->mtu from ndo_change_mtu()")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 58a7bb75506a..282a29b2cc36 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -3986,7 +3986,7 @@ int bnxt_set_rx_skb_mode(struct bnxt *bp, bool page_mode) struct net_device *dev = bp->dev; if (page_mode) { - bp->flags &= ~BNXT_FLAG_AGG_RINGS; + bp->flags &= ~(BNXT_FLAG_AGG_RINGS | BNXT_FLAG_NO_AGG_RINGS); bp->flags |= BNXT_FLAG_RX_PAGE_MODE; if (bp->xdp_prog->aux->xdp_has_frags) @@ -12795,6 +12795,14 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu) bnxt_close_nic(bp, true, false); dev->mtu = new_mtu; + + /* MTU change may change the AGG ring settings if an XDP multi-buffer + * program is attached. We need to set the AGG rings settings and + * rx_skb_func accordingly. + */ + if (READ_ONCE(bp->xdp_prog)) + bnxt_set_rx_skb_mode(bp, true); + bnxt_set_ring_params(bp); if (netif_running(dev)) -- 2.34.1

2 1

[PATCH OLK-6.6] xsk: fix OOB map writes when deleting elements
by Wang Liang 20 Jan '25

20 Jan '25

From: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> stable inclusion from stable-v6.6.66 commit f8abd03f83d5fe81e76eb93e2c4373eb9f75fd8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPK CVE: CVE-2024-56614 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 32cd3db7de97c0c7a018756ce66244342fd583f0 upstream. Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). Due to implicit type conversion, a large unsigned value for map->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL; This allows k to hold a negative value (between -2147483648 and -2), which is then used as an array index in m->xsk_map[k], which results in an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock); The xchg operation can then be used to cause an out-of-bounds write. Moreover, the invalid map_entry passed to xsk_map_sock_delete can lead to further memory corruption. " It indeed results in following splat: [76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108 [76612.904330] #PF: supervisor write access in kernel mode [76612.909639] #PF: error_code(0x0002) - not-present page [76612.914855] PGD 0 P4D 0 [76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP [76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470 [76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60 [76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31 [76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246 [76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000 [76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000 [76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007 [76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8 [76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0 [76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000 [76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0 [76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [76613.041086] PKRU: 55555554 [76613.043842] Call Trace: [76613.046331] <TASK> [76613.048468] ? __die+0x20/0x60 [76613.051581] ? page_fault_oops+0x15a/0x450 [76613.055747] ? search_extable+0x22/0x30 [76613.059649] ? search_bpf_extables+0x5f/0x80 [76613.063988] ? exc_page_fault+0xa9/0x140 [76613.067975] ? asm_exc_page_fault+0x22/0x30 [76613.072229] ? xsk_map_delete_elem+0x2d/0x60 [76613.076573] ? xsk_map_delete_elem+0x23/0x60 [76613.080914] __sys_bpf+0x19b7/0x23c0 [76613.084555] __x64_sys_bpf+0x1a/0x20 [76613.088194] do_syscall_64+0x37/0xb0 [76613.091832] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [76613.096962] RIP: 0033:0x7f80b6d1e88d [76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d [76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003 [76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000 [76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8 [76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00007f80b6fab040 [76613.188129] </TASK> Fix this by simply changing key type from int to u32. Fixes: fbfc504a24f5 ("bpf: introduce new bpf AF_XDP map type BPF_MAP_TYPE_XSKMAP") CC: stable(a)vger.kernel.org Reported-by: Jordy Zomer <jordyzomer(a)google.com> Suggested-by: Jordy Zomer <jordyzomer(a)google.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Link: https://lore.kernel.org/r/20241122121030.716788-2-maciej.fijalkowski@intel.… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/xdp/xskmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/xdp/xskmap.c b/net/xdp/xskmap.c index e1c526f97ce3..afa457506274 100644 --- a/net/xdp/xskmap.c +++ b/net/xdp/xskmap.c @@ -224,7 +224,7 @@ static long xsk_map_delete_elem(struct bpf_map *map, void *key) struct xsk_map *m = container_of(map, struct xsk_map, map); struct xdp_sock __rcu **map_entry; struct xdp_sock *old_xs; - int k = *(u32 *)key; + u32 k = *(u32 *)key; if (k >= map->max_entries) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] net: fix data-races around sk->sk_forward_alloc
by Wang Liang 20 Jan '25

20 Jan '25

mainline inclusion from mainline-v6.12 commit 073d89808c065ac4c672c0a613a71b27a80691cb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB8IUP CVE: CVE-2024-53124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x1c5/0x1e0 Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 <0f> 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00 RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206 RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007 RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00 RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007 R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00 R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78 FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x88/0x130 ? inet_sock_destruct+0x1c5/0x1e0 ? report_bug+0x18e/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x1c5/0x1e0 __sk_destruct+0x2a/0x200 rcu_do_batch+0x1aa/0x530 ? rcu_do_batch+0x13b/0x530 rcu_core+0x159/0x2f0 handle_softirqs+0xd3/0x2b0 ? __pfx_smpboot_thread_fn+0x10/0x10 run_ksoftirqd+0x25/0x30 smpboot_thread_fn+0xdd/0x1d0 kthread+0xd3/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- Its possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add() concurrently when sk->sk_state == TCP_LISTEN with sk->sk_lock unlocked, which triggers a data-race around sk->sk_forward_alloc: tcp_v6_rcv tcp_v6_do_rcv skb_clone_and_charge_r sk_rmem_schedule __sk_mem_schedule sk_forward_alloc_add() skb_set_owner_r sk_mem_charge sk_forward_alloc_add() __kfree_skb skb_release_all skb_release_head_state sock_rfree sk_mem_uncharge sk_forward_alloc_add() sk_mem_reclaim // set local var reclaimable __sk_mem_reclaim sk_forward_alloc_add() In this syzkaller testcase, two threads call tcp_v6_do_rcv() with skb->truesize=768, the sk_forward_alloc changes like this: (cpu 1) | (cpu 2) | sk_forward_alloc ... | ... | 0 __sk_mem_schedule() | | +4096 = 4096 | __sk_mem_schedule() | +4096 = 8192 sk_mem_charge() | | -768 = 7424 | sk_mem_charge() | -768 = 6656 ... | ... | sk_mem_uncharge() | | +768 = 7424 reclaimable=7424 | | | sk_mem_uncharge() | +768 = 8192 | reclaimable=8192 | __sk_mem_reclaim() | | -4096 = 4096 | __sk_mem_reclaim() | -8192 = -4096 != 0 The skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when sk->sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock(). Fix the same issue in dccp_v6_do_rcv(). Suggested-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Link: https://patch.msgid.link/20241107023405.889239-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/tcp_ipv6.c [conflicts due to not mergered ee01defe25ba ("tcp: make dropreason in tcp_child_process() work")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/dccp/ipv6.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c index d25e962b18a5..2839ca8053ba 100644 --- a/net/dccp/ipv6.c +++ b/net/dccp/ipv6.c @@ -616,7 +616,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) by tcp. Feel free to propose better solution. --ANK (980728) */ - if (np->rxopt.all) + if (np->rxopt.all && sk->sk_state != DCCP_LISTEN) opt_skb = skb_clone_and_charge_r(skb, sk); if (sk->sk_state == DCCP_OPEN) { /* Fast path */ diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 83b48dc2b3ee..29749d51d54b 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1458,7 +1458,7 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) by tcp. Feel free to propose better solution. --ANK (980728) */ - if (np->rxopt.all) + if (np->rxopt.all && sk->sk_state != TCP_LISTEN) opt_skb = skb_clone_and_charge_r(skb, sk); reason = SKB_DROP_REASON_NOT_SPECIFIED; @@ -1497,8 +1497,6 @@ int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) if (nsk != sk) { if (tcp_child_process(sk, nsk, skb)) goto reset; - if (opt_skb) - __kfree_skb(opt_skb); return 0; } } else -- 2.34.1

2 1

[PATCH OLK-6.6] net/smc: fix LGR and link use-after-free issue
by Wang Liang 20 Jan '25

20 Jan '25

From: Wen Gu <guwen(a)linux.alibaba.com> stable inclusion from stable-v6.6.66 commit 673d606683ac70bc074ca6676b938bff18635226 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP5 CVE: CVE-2024-56640 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2c7f14ed9c19ec0f149479d1c2842ec1f9bf76d7 ] We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. refcount_t: addition on 0; use-after-free. WARNING: CPU: 14 PID: 107447 at lib/refcount.c:25 refcount_warn_saturate+0x9c/0x140 Workqueue: events smc_lgr_terminate_work [smc] Call trace: refcount_warn_saturate+0x9c/0x140 __smc_lgr_terminate.part.45+0x2a8/0x370 [smc] smc_lgr_terminate_work+0x28/0x30 [smc] process_one_work+0x1b8/0x420 worker_thread+0x158/0x510 kthread+0x114/0x118 or refcount_t: underflow; use-after-free. WARNING: CPU: 6 PID: 93140 at lib/refcount.c:28 refcount_warn_saturate+0xf0/0x140 Workqueue: smc_hs_wq smc_listen_work [smc] Call trace: refcount_warn_saturate+0xf0/0x140 smcr_link_put+0x1cc/0x1d8 [smc] smc_conn_free+0x110/0x1b0 [smc] smc_conn_abort+0x50/0x60 [smc] smc_listen_find_device+0x75c/0x790 [smc] smc_listen_work+0x368/0x8a0 [smc] process_one_work+0x1b8/0x420 worker_thread+0x158/0x510 kthread+0x114/0x118 It is caused by repeated release of LGR/link refcnt. One suspect is that smc_conn_free() is called repeatedly because some smc_conn_free() from server listening path are not protected by sock lock. e.g. Calls under socklock | smc_listen_work ------------------------------------------------------- lock_sock(sk) | smc_conn_abort smc_conn_free | \- smc_conn_free \- smcr_link_put | \- smcr_link_put (duplicated) release_sock(sk) So here add sock lock protection in smc_listen_work() path, making it exclusive with other connection operations. Fixes: 3b2dec2603d5 ("net/smc: restructure client and server code in af_smc") Co-developed-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Co-developed-by: Kai <KaiShen(a)linux.alibaba.com> Signed-off-by: Kai <KaiShen(a)linux.alibaba.com> Signed-off-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 2d8ba8847c0f..968396a11d17 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1901,6 +1901,7 @@ static void smc_listen_out(struct smc_sock *new_smc) if (tcp_sk(new_smc->clcsock->sk)->syn_smc) atomic_dec(&lsmc->queued_smc_hs); + release_sock(newsmcsk); /* lock in smc_listen_work() */ if (lsmc->sk.sk_state == SMC_LISTEN) { lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING); smc_accept_enqueue(&lsmc->sk, newsmcsk); @@ -2422,6 +2423,7 @@ static void smc_listen_work(struct work_struct *work) u8 accept_version; int rc = 0; + lock_sock(&new_smc->sk); /* release in smc_listen_out() */ if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN) return smc_listen_out_err(new_smc); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] merge CVE-patch into OLK-6.6
by Kaixiong Yu 20 Jan '25

20 Jan '25

CVE-2024-53198 CVE-2024-47732 Dan Carpenter (1): crypto: iaa - Fix potential use after free bug Qiu-ji Chen (1): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- drivers/xen/xenbus/xenbus_probe.c | 8 +++++++- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] net: dsa: improve shutdown sequence
by Wang Liang 20 Jan '25

20 Jan '25

From: Vladimir Oltean <vladimir.oltean(a)nxp.com> mainline inclusion from mainline-v6.12-rc2 commit 6c24a03a61a245fe34d47582898331fa034b6ccd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAR CVE: CVE-2024-49998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there. The first problem is that lan9303 is unique among DSA drivers in that it calls dev_get_drvdata() at "arbitrary runtime" (not probe, not shutdown, not remove): phy_state_machine() -> ... -> dsa_user_phy_read() -> ds->ops->phy_read() -> lan9303_phy_read() -> chip->ops->phy_read() -> lan9303_mdio_phy_read() -> dev_get_drvdata() But we never stop the phy_state_machine(), so it may continue to run after dsa_switch_shutdown(). Our common pattern in all DSA drivers is to set drvdata to NULL to suppress the remove() method that may come afterwards. But in this case it will result in an NPD. The second problem is that the way in which we set dp->conduit->dsa_ptr = NULL; is concurrent with receive packet processing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL, but afterwards, rather than continuing to use that non-NULL value, dev->dsa_ptr is dereferenced again and again without NULL checks: dsa_conduit_find_user() and many other places. In between dereferences, there is no locking to ensure that what was valid once continues to be valid. Both problems have the common aspect that closing the conduit interface solves them. In the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN event in dsa_user_netdevice_event() which closes user ports as well. dsa_port_disable_rt() calls phylink_stop(), which synchronously stops the phylink state machine, and ds->ops->phy_read() will thus no longer call into the driver after this point. In the second case, dev_close(conduit) should do this, as per Documentation/networking/driver.rst: | Quiescence | ---------- | | After the ndo_stop routine has been called, the hardware must | not receive or transmit any data. All in flight packets must | be aborted. If necessary, poll or wait for completion of | any reset commands. So it should be sufficient to ensure that later, when we zeroize conduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call on this conduit. The addition of the netif_device_detach() function is to ensure that ioctls, rtnetlinks and ethtool requests on the user ports no longer propagate down to the driver - we're no longer prepared to handle them. The race condition actually did not exist when commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown") first introduced dsa_switch_shutdown(). It was created later, when we stopped unregistering the user interfaces from a bad spot, and we just replaced that sequence with a racy zeroization of conduit->dsa_ptr (one which doesn't ensure that the interfaces aren't up). Reported-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Closes: https://lore.kernel.org/netdev/2d2e3bba17203c14a5ffdabc174e3b6bbb9ad438.cam… Closes: https://lore.kernel.org/netdev/c1bf4de54e829111e0e4a70e7bd1cf523c9550ff.cam… Fixes: ee534378f005 ("net: dsa: fix panic when DSA master device unbinds on shutdown") Reviewed-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Tested-by: Alexander Sverdlin <alexander.sverdlin(a)siemens.com> Signed-off-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Link: https://patch.msgid.link/20240913203549.3081071-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/dsa/dsa.c [conflicts due to not mergered 6ca80638b90c ("net: dsa: Use conduit and user terms")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/dsa/dsa.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c index ccbdb98109f8..21f8a4ff939a 100644 --- a/net/dsa/dsa.c +++ b/net/dsa/dsa.c @@ -1574,6 +1574,7 @@ EXPORT_SYMBOL_GPL(dsa_unregister_switch); void dsa_switch_shutdown(struct dsa_switch *ds) { struct net_device *master, *slave_dev; + LIST_HEAD(close_list); struct dsa_port *dp; mutex_lock(&dsa2_mutex); @@ -1583,10 +1584,16 @@ void dsa_switch_shutdown(struct dsa_switch *ds) rtnl_lock(); + dsa_switch_for_each_cpu_port(dp, ds) + list_add(&dp->master->close_list, &close_list); + + dev_close_many(&close_list, true); + dsa_switch_for_each_user_port(dp, ds) { master = dsa_port_to_master(dp); slave_dev = dp->slave; + netif_device_detach(slave_dev); netdev_upper_dev_unlink(master, slave_dev); } -- 2.34.1

2 1

[PATCH OLK-6.6] ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
by Wang Liang 20 Jan '25

20 Jan '25

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.12-rc6 commit 90e0569dd3d32f4f4d2ca691d3fa5a8a14a13c12 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQ5 CVE: CVE-2024-50304 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The per-netns IP tunnel hash table is protected by the RTNL mutex and ip_tunnel_find() is only called from the control path where the mutex is taken. Add a lockdep expression to hlist_for_each_entry_rcu() in ip_tunnel_find() in order to validate that the mutex is held and to silence the suspicious RCU usage warning [1]. [1] WARNING: suspicious RCU usage 6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted ----------------------------- net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/362: #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60 stack backtrace: CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0xba/0x110 lockdep_rcu_suspicious.cold+0x4f/0xd6 ip_tunnel_find+0x435/0x4d0 ip_tunnel_newlink+0x517/0x7a0 ipgre_newlink+0x14c/0x170 __rtnl_newlink+0x1173/0x19c0 rtnl_newlink+0x6c/0xa0 rtnetlink_rcv_msg+0x3cc/0xf60 netlink_rcv_skb+0x171/0x450 netlink_unicast+0x539/0x7f0 netlink_sendmsg+0x8c1/0xd80 ____sys_sendmsg+0x8f9/0xc20 ___sys_sendmsg+0x197/0x1e0 __sys_sendmsg+0x122/0x1f0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241023123009.749764-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/ip_tunnel.c [conflicts due to not mergered 5832c4a77d69 ("ip_tunnel: convert __be16 tunnel flags to bitmaps")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/ip_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index acf93f34a821..2081b073bcd7 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -218,7 +218,7 @@ static struct ip_tunnel *ip_tunnel_find(struct ip_tunnel_net *itn, struct ip_tunnel *t = NULL; struct hlist_head *head = ip_bucket(itn, parms); - hlist_for_each_entry_rcu(t, head, hash_node) { + hlist_for_each_entry_rcu(t, head, hash_node, lockdep_rtnl_is_held()) { if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr && link == t->parms.link && -- 2.34.1

2 1

[PATCH OLK-6.6] net: renesas: rswitch: avoid use-after-put for a device tree node
by Bowen You 20 Jan '25

20 Jan '25

From: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> stable inclusion from stable-v6.6.67 commit bf8c6755f02029d1eddc3ff19b870240f054afc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIO14 CVE: CVE-2024-55639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 66b7e9f85b8459c823b11e9af69dbf4be5eb6be8 ] The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://patch.msgid.link/20241208095004.69468-5-nikita.yoush@cogentembedded… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index ae9d8722b76f..5e3c0e24a1bc 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1741,7 +1741,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1771,6 +1770,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1784,6 +1784,7 @@ static void rswitch_device_free(struct rswitch_private *priv, int index) rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); } -- 2.34.1

2 1

[PATCH OLK-6.6] wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
by Wang Wensheng 20 Jan '25

20 Jan '25

From: Ping-Ke Shih <pkshih(a)realtek.com> stable inclusion from stable-v6.6.66 commit 1a0f54cb3fea5d087440b2bae03202c445156a8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI835 CVE: CVE-2024-48873 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c ] The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access. Addresses-Coverity-ID: 1529805 ("Dereference null return value") Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240919081216.28505-2-pkshih@realtek.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 468cfa43ec04..a8e2efae6e52 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -3662,6 +3662,9 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev, skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr, NULL, 0, req->ie_len); + if (!skb) + return -ENOMEM; + skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]); skb_put_data(skb, ies->common_ies, ies->common_ie_len); hdr = (struct ieee80211_hdr *)skb->data; -- 2.22.0

2 1

[PATCH OLK-6.6 0/2] merge CVE-patch into OLK-6.6
by Kaixiong Yu 20 Jan '25

20 Jan '25

CVE-2024-53198 CVE-2024-47732 Dan Carpenter (1): crypto: iaa - Fix potential use after free bug Qiu-ji Chen (1): xen: Fix the issue of resource not being properly released in xenbus_dev_probe() drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 ++-- drivers/xen/xenbus/xenbus_probe.c | 8 +++++++- 2 files changed, 9 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/4] Fix CVE-2024-47794
by Tengda Wu 20 Jan '25

20 Jan '25

Fix CVE-2024-47794. Leon Hwang (3): bpf: Prevent tailcall infinite loop caused by freplace selftests/bpf: Add testcase for updating attached freplace prog to prog_array map selftests/bpf: Add test to verify tailcall and freplace restrictions Tengda Wu (1): bpf: Fix kabi breakage in struct bpf_prog_aux include/linux/bpf.h | 21 ++- kernel/bpf/arraymap.c | 26 ++- kernel/bpf/core.c | 1 + kernel/bpf/syscall.c | 7 +- kernel/bpf/trampoline.c | 47 +++++- .../selftests/bpf/prog_tests/tailcalls.c | 156 ++++++++++++++++++ .../selftests/bpf/progs/tailcall_freplace.c | 23 +++ .../testing/selftests/bpf/progs/tc_bpf2bpf.c | 23 +++ 8 files changed, 286 insertions(+), 18 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/tailcall_freplace.c create mode 100644 tools/testing/selftests/bpf/progs/tc_bpf2bpf.c -- 2.34.1

2 5

[PATCH OLK-6.6] LeapIOraid: update leapioraid driver version
by haodongdong 20 Jan '25

20 Jan '25

LeapIO inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBITP1 ------------------------------------------ update leapioraid driver version Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapioraid/leapioraid_func.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/leapioraid/leapioraid_func.h b/drivers/scsi/leapioraid/leapioraid_func.h index 8ca8fc0a6f262..76babcb40766c 100644 --- a/drivers/scsi/leapioraid/leapioraid_func.h +++ b/drivers/scsi/leapioraid/leapioraid_func.h @@ -67,10 +67,10 @@ #define LEAPIORAID_DRIVER_NAME "LeapIoRaid" #define LEAPIORAID_AUTHOR "LeapIO Inc." #define LEAPIORAID_DESCRIPTION "LEAPIO RAID Driver" -#define LEAPIORAID_DRIVER_VERSION "1.00.00.00" +#define LEAPIORAID_DRIVER_VERSION "1.02.02.00" #define LEAPIORAID_MAJOR_VERSION (1) -#define LEAPIORAID_MINOR_VERSION (00) -#define LEAPIORAID_BUILD_VERSION (00) +#define LEAPIORAID_MINOR_VERSION (02) +#define LEAPIORAID_BUILD_VERSION (02) #define LEAPIORAID_RELEASE_VERSION (00) #define LEAPIORAID_VENDOR_ID (0xD405) -- 2.25.1

2 1

[PATCH OLK-6.6] LeapIOraid: update leapioraid driver version
by haodongdong 20 Jan '25

20 Jan '25

LeapIO inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBITP1 ------------------------------------------ update leapioraid driver version Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapioraid/leapioraid_func.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/leapioraid/leapioraid_func.h b/drivers/scsi/leapioraid/leapioraid_func.h index 8ca8fc0a6f262..39230bb11732b 100644 --- a/drivers/scsi/leapioraid/leapioraid_func.h +++ b/drivers/scsi/leapioraid/leapioraid_func.h @@ -68,9 +68,10 @@ #define LEAPIORAID_AUTHOR "LeapIO Inc." #define LEAPIORAID_DESCRIPTION "LEAPIO RAID Driver" #define LEAPIORAID_DRIVER_VERSION "1.00.00.00" +#define LEAPIORAID_DRIVER_VERSION "1.02.02.00" #define LEAPIORAID_MAJOR_VERSION (1) -#define LEAPIORAID_MINOR_VERSION (00) -#define LEAPIORAID_BUILD_VERSION (00) +#define LEAPIORAID_MINOR_VERSION (02) +#define LEAPIORAID_BUILD_VERSION (02) #define LEAPIORAID_RELEASE_VERSION (00) #define LEAPIORAID_VENDOR_ID (0xD405) -- 2.25.1

2 1

[PATCH OLK-6.6] Revert "Revert "driver core: Fix uevent_show() vs driver detach race""
by Zhang Zekun 20 Jan '25

20 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBH7EF -------------------------------------- This reverts commit 5e125aaa84dc006a227fb39f838b3a2e0a27c72f. This patch will reintroduce device_lock in uevent_show(), which has already cause deadlock in practice. Fixes: 5e125aaa84dc ("Revert "driver core: Fix uevent_show() vs driver detach race"") Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/base/core.c | 13 ++++++++----- drivers/base/module.c | 4 ++++ 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/base/core.c b/drivers/base/core.c index 560a124eeb8d..0b2cf93d8e01 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -25,6 +25,7 @@ #include <linux/mutex.h> #include <linux/pm_runtime.h> #include <linux/netdevice.h> +#include <linux/rcupdate.h> #include <linux/sched/signal.h> #include <linux/sched/mm.h> #include <linux/string_helpers.h> @@ -2566,6 +2567,7 @@ static const char *dev_uevent_name(const struct kobject *kobj) static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) { const struct device *dev = kobj_to_dev(kobj); + struct device_driver *driver; int retval = 0; /* add device node properties if present */ @@ -2594,8 +2596,12 @@ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) if (dev->type && dev->type->name) add_uevent_var(env, "DEVTYPE=%s", dev->type->name); - if (dev->driver) - add_uevent_var(env, "DRIVER=%s", dev->driver->name); + /* Synchronize with module_remove_driver() */ + rcu_read_lock(); + driver = READ_ONCE(dev->driver); + if (driver) + add_uevent_var(env, "DRIVER=%s", driver->name); + rcu_read_unlock(); /* Add common DT information about the device */ of_device_uevent(dev, env); @@ -2665,11 +2671,8 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr, if (!env) return -ENOMEM; - /* Synchronize with really_probe() */ - device_lock(dev); /* let the kset specific function add its keys */ retval = kset->uevent_ops->uevent(&dev->kobj, env); - device_unlock(dev); if (retval) goto out; diff --git a/drivers/base/module.c b/drivers/base/module.c index a33663d92256..0d5c5da367f7 100644 --- a/drivers/base/module.c +++ b/drivers/base/module.c @@ -7,6 +7,7 @@ #include <linux/errno.h> #include <linux/slab.h> #include <linux/string.h> +#include <linux/rcupdate.h> #include "base.h" static char *make_driver_name(struct device_driver *drv) @@ -101,6 +102,9 @@ void module_remove_driver(struct device_driver *drv) if (!drv) return; + /* Synchronize with dev_uevent() */ + synchronize_rcu(); + sysfs_remove_link(&drv->p->kobj, "module"); if (drv->owner) -- 2.22.0

2 1

[PATCH OLK-6.6] perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
by Luo Gengkun 20 Jan '25

20 Jan '25

From: Kan Liang <kan.liang(a)linux.intel.com> stable inclusion from stable-v6.6.67 commit 0252305d296431f4c328acb008429fb6d595fc16 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBIHJJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9f3de72a0c37005f897d69e4bdd59c25b8898447 upstream. The PEBS kernel warnings can still be observed with the below case. when the below commands are running in parallel for a while. while true; do perf record --no-buildid -a --intr-regs=AX \ -e cpu/event=0xd0,umask=0x81/pp \ -c 10003 -o /dev/null ./triad; done & while true; do perf record -e 'cpu/mem-loads,ldlat=3/uP' -W -d -- ./dtlb done The commit b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG") intends to flush the entire PEBS buffer before the hardware is reprogrammed. However, it fails in the above case. The first perf command utilizes the large PEBS, while the second perf command only utilizes a single PEBS. When the second perf event is added, only the n_pebs++. The intel_pmu_pebs_enable() is invoked after intel_pmu_pebs_add(). So the cpuc->n_pebs == cpuc->n_large_pebs check in the intel_pmu_drain_large_pebs() fails. The PEBS DS is not flushed. The new PEBS event should not be taken into account when flushing the existing PEBS DS. The check is unnecessary here. Before the hardware is reprogrammed, all the stale records must be drained unconditionally. For single PEBS or PEBS-vi-pt, the DS must be empty. The drain_pebs() can handle the empty case. There is no harm to unconditionally drain the PEBS DS. Fixes: b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG") Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20241119135504.1463839-2-kan.liang@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/ds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c index 14b11d607f47..c165c8202ad0 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -1354,7 +1354,7 @@ void intel_pmu_pebs_enable(struct perf_event *event) * hence we need to drain when changing said * size. */ - intel_pmu_drain_large_pebs(cpuc); + intel_pmu_drain_pebs_buffer(); adaptive_pebs_record_size_update(); wrmsrl(MSR_PEBS_DATA_CFG, pebs_data_cfg); cpuc->active_pebs_data_cfg = pebs_data_cfg; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1407/1407] drivers/mux/adgs1408.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 20 Jan '25

20 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 8b9ce6954c05e3e4115f54444c7eaf2aa2dd5e65 [1407/1407] mux: adgs1408: new driver for Analog Devices ADGS1408/1409 mux config: x86_64-buildonly-randconfig-001-20250116 (https://download.01.org/0day-ci/archive/20250120/202501200708.2Pf7Ia63-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250120/202501200708.2Pf7Ia63-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501200708.2Pf7Ia63-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/mux/adgs1408.c:9: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'adgs1408_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1562:1: note: in expansion of macro 'module_exit' 1562 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/spi/spi.h:293:9: note: in expansion of macro 'module_driver' 293 | module_driver(__spi_driver, spi_register_driver, \ | ^~~~~~~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/mux/driver.h:14, from drivers/mux/adgs1408.c:10: drivers/mux/adgs1408.c:127:19: note: 'cleanup_module' target declared here 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1558:20: note: in definition of macro 'module_driver' 1558 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'adgs1408_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1557:1: note: in expansion of macro 'module_init' 1557 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/spi/spi.h:293:9: note: in expansion of macro 'module_driver' 293 | module_driver(__spi_driver, spi_register_driver, \ | ^~~~~~~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ drivers/mux/adgs1408.c:127:19: note: 'init_module' target declared here 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1553:19: note: in definition of macro 'module_driver' 1553 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/mux/adgs1408.c:127:1: note: in expansion of macro 'module_spi_driver' 127 | module_spi_driver(adgs1408_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/mux/adgs1408.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 19 Jan '25

19 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250119/202501192215.87TCB3P8-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501192215.87TCB3P8-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 19 Jan '25

19 Jan '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250119/202501191953.ABToUtr4-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250119/202501191953.ABToUtr4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501191953.ABToUtr4-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 19 Jan '25

19 Jan '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250119/202501191820.CX3a1XfY-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250119/202501191820.CX3a1XfY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501191820.CX3a1XfY-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/vmscan.c:23: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/vmscan.c:33: include/linux/mm_inline.h:32:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:350:64: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 350 | lru_size = node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:240:60: note: expanded from macro 'node_page_state' 240 | #define node_page_state(node, item) global_node_page_state(item) | ^~~~ mm/vmscan.c:363:29: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 363 | NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:1776:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 1776 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ mm/vmscan.c:3066:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3066 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 8 warnings and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] hifc_lld.c:undefined reference to `rtc_time64_to_tm'
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [1407/1407] scsi/hifc: add hifc driver FC service module config: arm64-randconfig-003-20250116 (https://download.01.org/0day-ci/archive/20250118/202501182334.LzPZxncS-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501182334.LzPZxncS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501182334.LzPZxncS-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: warning: -z norelro ignored aarch64-linux-ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions aarch64-linux-ld: drivers/scsi/huawei/hifc/hifc_lld.o: in function `hifc_sync_time_to_fmw': >> hifc_lld.c:(.text+0x4d4): undefined reference to `rtc_time64_to_tm' aarch64-linux-ld: drivers/scsi/huawei/hifc/hifc_dbgtool_knl.o: in function `ffm_intr_msg_record': >> hifc_dbgtool_knl.c:(.text+0x268): undefined reference to `rtc_time64_to_tm' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] include/linux/sched/signal.h: linux/kabi.h is included more than once.
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: b53643e68c841ccb6f05f90601ea30b1afeb0a2b [1826/1826] !3695 x86: Add x86 related kabi reservations compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501181428.cSbIc8DR-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/sched/signal.h: linux/kabi.h is included more than once. vim +15 include/linux/sched/signal.h 4 5 #include <linux/rculist.h> 6 #include <linux/signal.h> 7 #include <linux/sched.h> 8 #include <linux/sched/jobctl.h> 9 #include <linux/sched/task.h> 10 #include <linux/cred.h> 11 #include <linux/refcount.h> 12 #include <linux/posix-timers.h> 13 #include <linux/mm_types.h> 14 #include <asm/ptrace.h> > 15 #include <linux/kabi.h> 16 > 17 #include <linux/kabi.h> 18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] mm/slub: Reduce memory consumption in extreme scenarios
by Kaixiong Yu 18 Jan '25

18 Jan '25

From: Chen Jun <chenjun102(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 9198ffbd2b494daae3a67cac1d59c3a2754e64cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBH72Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When kmalloc_node() is called without __GFP_THISNODE and the target node lacks sufficient memory, SLUB allocates a folio from a different node other than the requested node, instead of taking a partial slab from it. However, since the allocated folio does not belong to the requested node, on the following allocation it is deactivated and added to the partial slab list of the node it belongs to. This behavior can result in excessive memory usage when the requested node has insufficient memory, as SLUB will repeatedly allocate folios from other nodes without reusing the previously allocated ones. To prevent memory wastage, when a preferred node is indicated (not NUMA_NO_NODE) but without a prior __GFP_THISNODE constraint: 1) try to get a partial slab from target node only by having __GFP_THISNODE in pc.flags for get_partial() 2) if 1) failed, try to allocate a new slab from target node with GFP_NOWAIT | __GFP_THISNODE opportunistically. 3) if 2) failed, retry with original gfpflags which will allow get_partial() try partial lists of other nodes before potentially allocating new page from other nodes Without a preferred node, or with __GFP_THISNODE constraint, the behavior remains unchanged. On qemu with 4 numa nodes and each numa has 1G memory. Write a test ko to call kmalloc_node(196, GFP_KERNEL, 3) for (4 * 1024 + 4) * 1024 times. cat /proc/slabinfo shows: kmalloc-256 4200530 13519712 256 32 2 : tunables.. after this patch, cat /proc/slabinfo shows: kmalloc-256 4200558 4200768 256 32 2 : tunables.. Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Conflicts: mm/slub.c [The conflict is large. Because OLK-5.10 does not merge mainline patch 53a0de06e50acb372c75d87fcc72ddfdf4a060ee ("mm, slub: dissolve new_slab_objects() into ___slab_alloc()")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/slub.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 9dd4cc478ec3..de7edd49dcd9 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2105,7 +2105,7 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node, searchnode = numa_mem_id(); object = get_partial_node(s, get_node(s, searchnode), c, flags); - if (object || node != NUMA_NO_NODE) + if (object || (node != NUMA_NO_NODE && (flags & __GFP_THISNODE))) return object; return get_any_partial(s, flags, c); @@ -2687,6 +2687,8 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, { void *freelist; struct page *page; + bool try_thisnode = true; + gfp_t thisnode_gfpflags; stat(s, ALLOC_SLOWPATH); @@ -2764,9 +2766,33 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, goto redo; } - freelist = new_slab_objects(s, gfpflags, node, &c); +new_objects: + + thisnode_gfpflags = gfpflags; + /* + * When a preferred node is indicated but no __GFP_THISNODE + * + * 1) try to get a partial slab from target node only by having + * __GFP_THISNODE in thisnode_gfpflags for new_slab_objects() + * 2) if 1) failed, try to allocate a new slab from target node with + * GPF_NOWAIT | __GFP_THISNODE opportunistically + * 3) if 2) failed, retry with original gfpflags which will allow + * new_slab_objects() try partial lists of other nodes before potentially + * allocating new page from other nodes + */ + if (unlikely(node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) + && try_thisnode)) + thisnode_gfpflags = GFP_NOWAIT | __GFP_THISNODE; + + freelist = new_slab_objects(s, thisnode_gfpflags, node, &c); if (unlikely(!freelist)) { + if (node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) + && try_thisnode) { + try_thisnode = false; + goto new_objects; + } + slab_out_of_memory(s, gfpflags, node); return NULL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: prevent use-after-free in encode_cap_msg()
by Long Li 18 Jan '25

18 Jan '25

From: Rishabh Dave <ridave(a)redhat.com> stable inclusion from stable-v5.15.148 commit 70e329b440762390258a6fe8c0de93c9fdd56c77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GN CVE: CVE-2024-26689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef upstream. In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap_grant()" refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it. encode_cap_msg() is called by __send_cap() and __send_cap() is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where the refcount must be increased to prevent "use after free" error. Cc: stable(a)vger.kernel.org Link: https://tracker.ceph.com/issues/59259 Signed-off-by: Rishabh Dave <ridave(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Xiubo Li <xiubli(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/ceph/caps.c [__send_cap() has been refacaored] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ceph/caps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 1cc433de4200..b631719941c2 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1347,7 +1347,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, if (flushing & CEPH_CAP_XATTR_EXCL) { old_blob = __ceph_build_xattrs_blob(ci); arg.xattr_version = ci->i_xattrs.version; - arg.xattr_buf = ci->i_xattrs.blob; + arg.xattr_buf = ceph_buffer_get(ci->i_xattrs.blob); } else { arg.xattr_buf = NULL; } @@ -1387,6 +1387,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, dout("error sending cap msg, must requeue %p\n", inode); delayed = 1; } + ceph_buffer_put(arg.xattr_buf); if (wake) wake_up_all(&ci->i_cap_wq); -- 2.39.2

2 1

[PATCH OLK-5.10] [Backport] btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
by Yongjian Sun 18 Jan '25

18 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.12-rc3 commit f10bef73fb355e3fc85e63a50386798be68ff486 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIAEJ CVE: CVE-2024-57896 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct. Syzbot reported this with the following stack traces: BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [inline] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 2: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork.c:2869 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kmem_cache_free+0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 __call_rcu_common kernel/rcu/tree.c:3086 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190 context_switch kernel/sched/core.c:5372 [inline] __schedule+0x1803/0x4be0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 kthread_stop+0x19e/0x640 kernel/kthread.c:712 close_ctree+0x524/0xd60 fs/btrfs/disk-io.c:4328 generic_shutdown_super+0x139/0x2d0 fs/super.c:642 kill_anon_super+0x3b/0x70 fs/super.c:1237 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2112 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373 task_work_run+0x24f/0x310 kernel/task_work.c:239 ptrace_notify+0x2d2/0x380 kernel/signal.c:2503 ptrace_report_syscall include/linux/ptrace.h:415 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline] syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline] syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880259d1e00 which belongs to the cache task_struct of size 7424 The buggy address is located 2584 bytes inside of freed 7424-byte region [ffff8880259d1e00, ffff8880259d3b00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x259d0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88802f4b56c1 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000003 ffffea0000967401 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u8:1), ts 7328037942, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2408 allocate_slab+0x5a/0x2f0 mm/slub.c:2574 new_slab mm/slub.c:2627 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3815 __slab_alloc+0x58/0xa0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_node_noprof+0x269/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 user_mode_thread+0x132/0x1a0 kernel/fork.c:2885 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 page_owner free stack trace missing Memory state around the buggy address: ffff8880259d2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880259d2800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880259d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix this by flushing the delalloc workers queue before stopping the cleaner kthread. Reported-by: syzbot+b7cf50a0c173770dcb14(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/674ed7e8.050a0220.48a03.0031.GAE@google… Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/disk-io.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 5e42f339fa83..b364fa3806ec 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -4151,6 +4151,15 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) * already the cleaner, but below we run all pending delayed iputs. */ btrfs_flush_workqueue(fs_info->fixup_workers); + /* + * Similar case here, we have to wait for delalloc workers before we + * proceed below and stop the cleaner kthread, otherwise we trigger a + * use-after-tree on the cleaner kthread task_struct when a delalloc + * worker running submit_compressed_extents() adds a delayed iput, which + * does a wake up on the cleaner kthread, which was already freed below + * when we call kthread_stop(). + */ + btrfs_flush_workqueue(fs_info->delalloc_workers); /* * After we parked the cleaner kthread, ordered extents may have -- 2.39.2

2 1

[openeuler:OLK-6.6 1826/1826] drivers/irqchip/irq-gic-v3.c:1036:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: 3053668e6b211924bb67c19d791a5a532eca2ad8 [1826/1826] arm64: Introduce Xint software solution config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180931.eG4TBbkV-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180931.eG4TBbkV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180931.eG4TBbkV-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/irqchip/irq-gic-v3.c:1036:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] int irq = (int)(long)pde_data(file_inode(file)); ^ drivers/irqchip/irq-gic-v3.c:1074:2: error: call to undeclared function 'seq_printf'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); ^ drivers/irqchip/irq-gic-v3.c:1074:46: error: incomplete definition of type 'struct seq_file' seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); ~^ arch/arm64/include/asm/smp.h:56:8: note: forward declaration of 'struct seq_file' struct seq_file; ^ drivers/irqchip/irq-gic-v3.c:1080:9: error: call to undeclared function 'single_open'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return single_open(file, xint_proc_show, pde_data(inode)); ^ drivers/irqchip/irq-gic-v3.c:1080:9: note: did you mean 'simple_open'? include/linux/fs.h:3226:12: note: 'simple_open' declared here extern int simple_open(struct inode *inode, struct file *file); ^ drivers/irqchip/irq-gic-v3.c:1080:43: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return single_open(file, xint_proc_show, pde_data(inode)); ^ drivers/irqchip/irq-gic-v3.c:1085:15: error: use of undeclared identifier 'seq_read' .proc_read = seq_read, ^ drivers/irqchip/irq-gic-v3.c:1086:16: error: use of undeclared identifier 'seq_lseek' .proc_lseek = seq_lseek, ^ drivers/irqchip/irq-gic-v3.c:1087:18: error: use of undeclared identifier 'single_release' .proc_release = single_release, ^ drivers/irqchip/irq-gic-v3.c:1083:30: error: variable has incomplete type 'const struct proc_ops' static const struct proc_ops xint_proc_ops = { ^ drivers/irqchip/irq-gic-v3.c:1083:21: note: forward declaration of 'struct proc_ops' static const struct proc_ops xint_proc_ops = { ^ >> drivers/irqchip/irq-gic-v3.c:1097:2: error: call to undeclared function 'proc_create_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); ^ >> drivers/irqchip/irq-gic-v3.c:1105:2: error: call to undeclared function 'remove_proc_entry'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] remove_proc_entry("xint", desc->dir); ^ 11 errors generated. vim +/pde_data +1036 drivers/irqchip/irq-gic-v3.c 1032 1033 static ssize_t xint_proc_write(struct file *file, 1034 const char __user *buffer, size_t count, loff_t *pos) 1035 { > 1036 int irq = (int)(long)pde_data(file_inode(file)); 1037 bool xint_state = false; 1038 unsigned long val; 1039 char *buf = NULL; 1040 1041 if (!xint_transform(irq, XINT_RANGE_CHECK)) 1042 return -EPERM; 1043 1044 buf = memdup_user_nul(buffer, count); 1045 if (IS_ERR(buf)) 1046 return PTR_ERR(buf); 1047 1048 if (kstrtoul(buf, 0, &val) || (val != 0 && val != 1)) { 1049 kfree(buf); 1050 return -EINVAL; 1051 } 1052 1053 xint_state = xint_transform(irq, XINT_SET_CHECK); 1054 if (xint_state == val) { 1055 kfree(buf); 1056 return -EBUSY; 1057 } 1058 1059 local_irq_disable(); 1060 disable_irq(irq); 1061 1062 xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); 1063 1064 enable_irq(irq); 1065 local_irq_enable(); 1066 1067 kfree(buf); 1068 1069 return count; 1070 } 1071 1072 static int xint_proc_show(struct seq_file *m, void *v) 1073 { 1074 seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); 1075 return 0; 1076 } 1077 1078 static int xint_proc_open(struct inode *inode, struct file *file) 1079 { 1080 return single_open(file, xint_proc_show, pde_data(inode)); 1081 } 1082 > 1083 static const struct proc_ops xint_proc_ops = { 1084 .proc_open = xint_proc_open, 1085 .proc_read = seq_read, 1086 .proc_lseek = seq_lseek, > 1087 .proc_release = single_release, 1088 .proc_write = xint_proc_write, 1089 }; 1090 1091 void register_irqchip_proc(struct irq_desc *desc, void *irqp) 1092 { 1093 if (!is_xint_support) 1094 return; 1095 1096 /* create /proc/irq/<irq>/xint */ > 1097 proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); 1098 } 1099 1100 void unregister_irqchip_proc(struct irq_desc *desc) 1101 { 1102 if (!is_xint_support) 1103 return; 1104 > 1105 remove_proc_entry("xint", desc->dir); 1106 } 1107 #endif /* CONFIG_FAST_IRQ */ 1108 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [1826/1826] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180715.zDIl6KOU-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180715.zDIl6KOU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180715.zDIl6KOU-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); ^ 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] include/linux/kernel.h:851:43: warning: comparison of distinct pointer types lacks a cast
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 7ad207616673722d5cf52c18d9464e0d3184ffc9 [1407/1407] arp: Prevent overflow in arp_req_get(). config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250118/202501180701.f6sYgGum-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501180701.f6sYgGum-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180701.f6sYgGum-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/list.h:9, from include/linux/module.h:10, from net/ipv4/arp.c:78: net/ipv4/arp.c: In function 'arp_req_get': >> include/linux/kernel.h:851:43: warning: comparison of distinct pointer types lacks a cast 851 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ include/linux/kernel.h:865:18: note: in expansion of macro '__typecheck' 865 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ include/linux/kernel.h:875:31: note: in expansion of macro '__safe_cmp' 875 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ include/linux/kernel.h:884:25: note: in expansion of macro '__careful_cmp' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ net/ipv4/arp.c:1106:33: note: in expansion of macro 'min' 1106 | min(dev->addr_len, sizeof(r->arp_ha.sa_data))); | ^~~ net/ipv4/arp.o: warning: objtool: missing symbol for section .init.text vim +851 include/linux/kernel.h 526211bc58c4b3 Ingo Molnar 2009-03-05 837 ^1da177e4c3f41 Linus Torvalds 2005-04-16 838 /* 3c8ba0d61d04ce Kees Cook 2018-03-30 839 * min()/max()/clamp() macros must accomplish three things: 3c8ba0d61d04ce Kees Cook 2018-03-30 840 * 3c8ba0d61d04ce Kees Cook 2018-03-30 841 * - avoid multiple evaluations of the arguments (so side-effects like 3c8ba0d61d04ce Kees Cook 2018-03-30 842 * "x++" happen only once) when non-constant. 3c8ba0d61d04ce Kees Cook 2018-03-30 843 * - perform strict type-checking (to generate warnings instead of 3c8ba0d61d04ce Kees Cook 2018-03-30 844 * nasty runtime surprises). See the "unnecessary" pointer comparison 3c8ba0d61d04ce Kees Cook 2018-03-30 845 * in __typecheck(). 3c8ba0d61d04ce Kees Cook 2018-03-30 846 * - retain result as a constant expressions when called with only 3c8ba0d61d04ce Kees Cook 2018-03-30 847 * constant expressions (to avoid tripping VLA warnings in stack 3c8ba0d61d04ce Kees Cook 2018-03-30 848 * allocation usage). 3c8ba0d61d04ce Kees Cook 2018-03-30 849 */ 3c8ba0d61d04ce Kees Cook 2018-03-30 850 #define __typecheck(x, y) \ 3c8ba0d61d04ce Kees Cook 2018-03-30 @851 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) 3c8ba0d61d04ce Kees Cook 2018-03-30 852 :::::: The code at line 851 was first introduced by commit :::::: 3c8ba0d61d04ced9f8d9ff93977995a9e4e96e91 kernel.h: Retain constant expression output for max()/min() :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] mm/mem_reliable.c:131:52: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: 200321e8a69ef82350d070de35ac4a666ab79ba6 [1826/1826] mm: mem_reliable: Add limiting the usage of reliable memory config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180645.GOqTUifa-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180645.GOqTUifa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180645.GOqTUifa-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_reliable.c:131:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:131:52: sparse: expected void * mm/mem_reliable.c:131:52: sparse: got void [noderef] __user *buffer mm/mem_reliable.c:150:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:150:52: sparse: expected void * mm/mem_reliable.c:150:52: sparse: got void [noderef] __user *buffer mm/mem_reliable.c:172:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:172:52: sparse: expected void * mm/mem_reliable.c:172:52: sparse: got void [noderef] __user *buffer >> mm/mem_reliable.c:190:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:190:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:190:33: sparse: got int ( * )( ... ) mm/mem_reliable.c:197:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:197:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:197:33: sparse: got int ( * )( ... ) mm/mem_reliable.c:205:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:205:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:205:33: sparse: got int ( * )( ... ) vim +131 mm/mem_reliable.c 123 124 static int reliable_pagecache_max_bytes_write(struct ctl_table *table, 125 int write, void __user *buffer, 126 size_t *length, loff_t *ppos) 127 { 128 unsigned long old_value = pagecache_reliable_limit; 129 int ret; 130 > 131 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 132 if (!ret && write) { 133 if (pagecache_reliable_limit > 134 PAGES_TO_B(total_reliable_pages())) { 135 pagecache_reliable_limit = old_value; 136 return -EINVAL; 137 } 138 } 139 140 return ret; 141 } 142 143 static int reliable_limit_handler(struct ctl_table *table, int write, 144 void __user *buffer, size_t *length, 145 loff_t *ppos) 146 { 147 unsigned long old = task_reliable_limit; 148 int ret; 149 150 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 151 if (!ret && write) { 152 if (task_reliable_limit > PAGES_TO_B(total_reliable_pages()) || 153 task_reliable_limit < 154 (task_reliable_used_pages() << PAGE_SHIFT)) { 155 task_reliable_limit = old; 156 return -EINVAL; 157 } 158 } 159 160 return ret; 161 } 162 163 #ifdef CONFIG_SHMEM 164 static int reliable_shmem_bytes_limit_handler(struct ctl_table *table, 165 int write, void __user *buffer, 166 size_t *length, loff_t *ppos) 167 { 168 unsigned long *data_ptr = (unsigned long *)(table->data); 169 unsigned long old = *data_ptr; 170 int ret; 171 172 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 173 if (!ret && write) { 174 if (*data_ptr > PAGES_TO_B(total_reliable_pages())) { 175 *data_ptr = old; 176 return -EINVAL; 177 } 178 } 179 180 return ret; 181 } 182 #endif 183 184 static struct ctl_table reliable_ctl_table[] = { 185 { 186 .procname = "reliable_pagecache_max_bytes", 187 .data = &pagecache_reliable_limit, 188 .maxlen = sizeof(pagecache_reliable_limit), 189 .mode = 0644, > 190 .proc_handler = reliable_pagecache_max_bytes_write, 191 }, 192 { 193 .procname = "task_reliable_limit", 194 .data = &task_reliable_limit, 195 .maxlen = sizeof(task_reliable_limit), 196 .mode = 0644, 197 .proc_handler = reliable_limit_handler, 198 }, 199 #ifdef CONFIG_SHMEM 200 { 201 .procname = "shmem_reliable_bytes_limit", 202 .data = &shmem_reliable_limit, 203 .maxlen = sizeof(shmem_reliable_limit), 204 .mode = 0644, 205 .proc_handler = reliable_shmem_bytes_limit_handler, 206 }, 207 #endif 208 {} 209 }; 210 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] kernel/sched/fair.c:146:12: warning: 'hundred_thousand' defined but not used
by kernel test robot 18 Jan '25

18 Jan '25

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: a3c9f2da0a35df4e41751556be4308f57bdaf3d6 [1826/1826] sched: Introduce handle priority reversion mechanism config: loongarch-randconfig-r063-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180452.dWoRzgYk-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501180452.dWoRzgYk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180452.dWoRzgYk-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/sched/fair.c:146:12: warning: 'hundred_thousand' defined but not used [-Wunused-variable] 146 | static int hundred_thousand = 100000; | ^~~~~~~~~~~~~~~~ >> kernel/sched/fair.c:145:12: warning: 'one_thousand' defined but not used [-Wunused-variable] 145 | static int one_thousand = 1000; | ^~~~~~~~~~~~ vim +/hundred_thousand +146 kernel/sched/fair.c 139 140 static DEFINE_PER_CPU_SHARED_ALIGNED(struct list_head, qos_throttled_cfs_rq); 141 static DEFINE_PER_CPU_SHARED_ALIGNED(struct hrtimer, qos_overload_timer); 142 static DEFINE_PER_CPU(int, qos_cpu_overload); 143 unsigned int sysctl_overload_detect_period = 5000; /* in ms */ 144 unsigned int sysctl_offline_wait_interval = 100; /* in ms */ > 145 static int one_thousand = 1000; > 146 static int hundred_thousand = 100000; 147 static int unthrottle_qos_cfs_rqs(int cpu); 148 #endif 149 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] arch/arm64/kernel/ipi_nmi.c:39:2: error: call to undeclared function '__printk_safe_enter'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: 5e3e94b1477ca3f6cb47ae8137a4a99fe0ef6147 [1826/1826] arm64: Add non nmi ipi backtrace support config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180414.2c8NAnVD-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180414.2c8NAnVD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180414.2c8NAnVD-lkp@intel.com/ All errors (new ones prefixed by >>): >> arch/arm64/kernel/ipi_nmi.c:39:2: error: call to undeclared function '__printk_safe_enter'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] __printk_safe_enter(); ^ >> arch/arm64/kernel/ipi_nmi.c:41:2: error: call to undeclared function '__printk_safe_exit'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] __printk_safe_exit(); ^ 2 errors generated. vim +/__printk_safe_enter +39 arch/arm64/kernel/ipi_nmi.c 35 36 #ifdef CONFIG_NON_NMI_IPI_BACKTRACE 37 static void ipi_cpu_backtrace(void *info) 38 { > 39 __printk_safe_enter(); 40 nmi_cpu_backtrace(get_irq_regs()); > 41 __printk_safe_exit(); 42 } 43 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION a5cbe5b715d9cac271b2c6175e728f0c4167f675
by kernel test robot 18 Jan '25

18 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: a5cbe5b715d9cac271b2c6175e728f0c4167f675 !14873 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-r061-20250118 | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250117 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250117 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-r063-20250118 | |-- arch-loongarch-kernel-smp.c:WARNING:Unsigned-expression-compared-with-zero:cpu | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-randconfig-r062-20250118 |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-get_nt_block_copy_mini_len |-- arch-x86-kernel-cpu-hygon.c:warning:no-previous-prototype-for-set_c86_features_para_invalid `-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-get_fpustate_free_space elapsed time: 918m configs tested: 19 configs skipped: 121 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250117 gcc-14.2.0 arm64 randconfig-002-20250117 clang-18 arm64 randconfig-003-20250117 clang-20 arm64 randconfig-004-20250117 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250117 gcc-14.2.0 loongarch randconfig-002-20250117 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250117 gcc-12 x86_64 buildonly-randconfig-002-20250117 gcc-12 x86_64 buildonly-randconfig-003-20250117 gcc-12 x86_64 buildonly-randconfig-004-20250117 gcc-12 x86_64 buildonly-randconfig-005-20250117 gcc-12 x86_64 buildonly-randconfig-006-20250117 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2709/2709] include/linux/blk_types.h: linux/kabi.h is included more than once.
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: dde4fe567523327d09054824030fb2d22e5009c7 [2709/2709] kabi: Add kabi reservation for storage module compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180245.jJrp2ix8-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/blk_types.h: linux/kabi.h is included more than once. -- >> include/linux/cred.h: linux/kabi.h is included more than once. -- >> include/linux/mm.h: linux/kabi.h is included more than once. -- >> include/linux/device/class.h: linux/kabi.h is included more than once. -- >> include/linux/ioport.h: linux/kabi.h is included more than once. -- >> include/linux/swap.h: linux/kabi.h is included more than once. -- >> include/linux/device.h: linux/kabi.h is included more than once. vim +9 include/linux/blk_types.h 8 > 9 #include <linux/kabi.h> 10 #include <linux/types.h> 11 #include <linux/bvec.h> 12 #include <linux/ktime.h> > 13 #include <linux/kabi.h> 14 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8
by kernel test robot 18 Jan '25

18 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 !9360 Add support for Hygon model 10h processors Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501171519.TpEUKk9L-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501172158.pLxZDrP8-lkp@intel.com drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:844:41: warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=] drivers/staging/rtl8723bs/os_dep/ioctl_linux.c:3787:41: warning: writing 8 bytes into a region of size 0 [-Wstringop-overflow=] include/linux/list.h:583:14: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] include/linux/plist.h:137:9: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] include/linux/uaccess.h:115:17: warning: 'bytes' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'data_arg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'rep' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'rq' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'rsv' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'version' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:115:17: warning: 'zrange' may be used uninitialized [-Wmaybe-uninitialized] Unverified Error/Warning (likely false positive, kindly check if interested): crypto/sm4_generic.o: warning: objtool: missing symbol for section .text drivers/staging/media/zoran/videocodec.o: warning: objtool: missing symbol for section .text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-allnoconfig | `-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used |-- arm64-randconfig-001-20250117 | |-- drivers-staging-rtl8723bs-os_dep-ioctl_cfg80211.c:warning:writing-bytes-into-a-region-of-size | `-- drivers-staging-rtl8723bs-os_dep-ioctl_linux.c:warning:writing-bytes-into-a-region-of-size |-- arm64-randconfig-002-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-003-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-004-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- include-linux-list.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-plist.h:warning:array-subscript-is-outside-array-bounds-of-struct-plist_node | |-- include-linux-uaccess.h:warning:acc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:bytes-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rep-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rsv-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:version-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:zrange-may-be-used-uninitialized |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250117 | |-- arch-x86-kernel-hpet.o:warning:objtool:missing-symbol-for-section-.text.unlikely | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-002-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-003-20250117 | |-- crypto-sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | `-- net-ipv4-bpfilter-sockopt.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-004-20250117 | |-- drivers-pci-pcie-dpc.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-staging-media-zoran-videocodec.o:warning:objtool:missing-symbol-for-section-.text | |-- sound-drivers-vx-vx_core.o:warning:objtool:missing-symbol-for-section-.text | `-- sound-isa-wavefront-wavefront_fx.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-006-20250117 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 875m configs tested: 15 configs skipped: 115 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250117 gcc-14.2.0 arm64 randconfig-002-20250117 gcc-14.2.0 arm64 randconfig-003-20250117 gcc-14.2.0 arm64 randconfig-004-20250117 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250117 gcc-12 x86_64 buildonly-randconfig-002-20250117 gcc-12 x86_64 buildonly-randconfig-003-20250117 gcc-12 x86_64 buildonly-randconfig-004-20250117 gcc-12 x86_64 buildonly-randconfig-005-20250117 gcc-12 x86_64 buildonly-randconfig-006-20250117 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2709/2709] kernel/rcu/tree.o: warning: objtool: __call_rcu_nocb_wake()+0x75f: unreachable instruction
by kernel test robot 17 Jan '25

17 Jan '25

Hi Steven, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [2709/2709] tracing: Make tracepoint lockdep check actually test something config: x86_64-randconfig-161-20250117 (https://download.01.org/0day-ci/archive/20250117/202501172116.SQgEKk8j-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501172116.SQgEKk8j-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501172116.SQgEKk8j-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/tree.o: warning: objtool: __call_rcu_nocb_wake()+0x75f: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used
by kernel test robot 17 Jan '25

17 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 1811840c2cdebd0820818392a8217ffbd1be5c67 [1407/1407] mm/sharepool: Fix sharepool node id invalid when using sp_alloc config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20250117/202501172158.pLxZDrP8-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501172158.pLxZDrP8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501172158.pLxZDrP8-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/fork.c:741:20: warning: no previous prototype for 'arch_task_cache_init' [-Wmissing-prototypes] 741 | void __init __weak arch_task_cache_init(void) { } | ^~~~~~~~~~~~~~~~~~~~ kernel/fork.c:826:12: warning: no previous prototype for 'arch_dup_task_struct' [-Wmissing-prototypes] 826 | int __weak arch_dup_task_struct(struct task_struct *dst, | ^~~~~~~~~~~~~~~~~~~~ kernel/fork.c: In function 'dup_task_struct': kernel/fork.c:845:27: warning: variable 'stack_vm_area' set but not used [-Wunused-but-set-variable] 845 | struct vm_struct *stack_vm_area; | ^~~~~~~~~~~~~ In file included from include/linux/sched/signal.h:7, from include/linux/sched/cputime.h:5, from kernel/fork.c:23: include/linux/signal.h: In function 'sigemptyset': include/linux/signal.h:180:29: warning: this statement may fall through [-Wimplicit-fallthrough=] 180 | case 2: set->sig[1] = 0; | ~~~~~~~~~~~~^~~ include/linux/signal.h:181:9: note: here 181 | case 1: set->sig[0] = 0; | ^~~~ In file included from kernel/fork.c:31: include/linux/mempolicy.h: At top level: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/asm-generic/bug.h:18, from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/gfp.h:5, from include/linux/slab.h:15, from kernel/fork.c:14: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput_async_fn' at kernel/fork.c:1104:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/spinlock.h:82, from include/linux/mmzone.h:9, from include/linux/gfp.h:6: kernel/fork.c: In function 'mmput_async_fn': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); | ^~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput_async_fn' at kernel/fork.c:1104:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/fork.c: In function 'mmput_async_fn': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); | ^~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput' at kernel/fork.c:1094:3, inlined from 'mmput' at kernel/fork.c:1086:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/fork.c: In function 'mmput': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); | ^~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from '__mmput' at kernel/fork.c:1074:3, inlined from 'mmput' at kernel/fork.c:1094:3, inlined from 'mmput' at kernel/fork.c:1086:6: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/fork.c: In function 'mmput': kernel/fork.c:939:44: note: object 'mmlist_lock' of size 4 939 | __cacheline_aligned_in_smp DEFINE_SPINLOCK(mmlist_lock); -- kernel/exit.c:1677:13: warning: no previous prototype for 'abort' [-Wmissing-prototypes] 1677 | __weak void abort(void) | ^~~~~ In file included from kernel/exit.c:37: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ -- In file included from include/linux/shmem_fs.h:7, from kernel/umh.c:29: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/linux/list.h:9, from include/linux/module.h:10, from kernel/umh.c:4: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:668:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/spinlock.h:82, from include/linux/seqlock.h:36, from include/linux/time.h:6, from include/linux/stat.h:19, from include/linux/module.h:11: kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:668:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:701:3: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'proc_cap_handler' at kernel/umh.c:701:3: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/umh.c: In function 'proc_cap_handler': kernel/umh.c:41:24: note: object 'umh_sysctl_lock' of size 4 41 | static DEFINE_SPINLOCK(umh_sysctl_lock); | ^~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, -- In file included from kernel/workqueue.c:39: >> include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ In file included from arch/arm64/include/asm/atomic.h:36, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from kernel/workqueue.c:28: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'pool_mayday_timeout' at kernel/workqueue.c:2003:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/spinlock.h:82, from include/linux/ipc.h:5, from include/uapi/linux/sem.h:5, from include/linux/sem.h:5, from include/linux/sched.h:15, from kernel/workqueue.c:29: kernel/workqueue.c: In function 'pool_mayday_timeout': kernel/workqueue.c:302:24: note: object 'wq_mayday_lock' of size 4 302 | static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */ | ^~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'pool_mayday_timeout' at kernel/workqueue.c:2003:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/workqueue.c: In function 'pool_mayday_timeout': kernel/workqueue.c:302:24: note: object 'wq_mayday_lock' of size 4 302 | static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */ | ^~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ kernel/workqueue.c: In function 'create_worker': kernel/workqueue.c:1887:54: warning: '%d' directive output may be truncated writing between 1 and 10 bytes into a region of size between 5 and 14 [-Wformat-truncation=] 1887 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~ kernel/workqueue.c:1887:50: note: directive argument in the range [0, 2147483647] 1887 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~~~~~~~~ kernel/workqueue.c:1887:17: note: 'snprintf' output between 4 and 23 bytes into a destination of size 16 1887 | snprintf(id_buf, sizeof(id_buf), "%d:%d%s", pool->cpu, id, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1888 | pool->attrs->nice < 0 ? "H" : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock_irq' at include/linux/spinlock_api_smp.h:129:2, inlined from 'spin_lock_irq' at include/linux/spinlock.h:354:2, inlined from 'rescuer_thread' at kernel/workqueue.c:2461:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ kernel/workqueue.c: In function 'rescuer_thread': kernel/workqueue.c:302:24: note: object 'wq_mayday_lock' of size 4 302 | static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */ | ^~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock_irq' at include/linux/spinlock_api_smp.h:129:2, inlined from 'spin_lock_irq' at include/linux/spinlock.h:354:2, inlined from 'rescuer_thread' at kernel/workqueue.c:2461:2: arch/arm64/include/asm/atomic_ll_sc.h:259:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 259 | asm volatile( \ | ^~~ arch/arm64/include/asm/atomic_ll_sc.h:283:1: note: in expansion of macro '__CMPXCHG_CASE' 283 | __CMPXCHG_CASE(w, , acq_4, , a, , "memory") | ^~~~~~~~~~~~~~ .. vim +/__do_mbind +329 include/linux/mempolicy.h 328 > 329 static long __do_mbind(unsigned long start, unsigned long len, -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] [Backport] btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
by Yongjian Sun 17 Jan '25

17 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.12-rc3 commit f10bef73fb355e3fc85e63a50386798be68ff486 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIAEJ CVE: CVE-2024-57896 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct. Syzbot reported this with the following stack traces: BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [inline] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 2: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork.c:2869 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kmem_cache_free+0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 __call_rcu_common kernel/rcu/tree.c:3086 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190 context_switch kernel/sched/core.c:5372 [inline] __schedule+0x1803/0x4be0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 kthread_stop+0x19e/0x640 kernel/kthread.c:712 close_ctree+0x524/0xd60 fs/btrfs/disk-io.c:4328 generic_shutdown_super+0x139/0x2d0 fs/super.c:642 kill_anon_super+0x3b/0x70 fs/super.c:1237 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2112 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373 task_work_run+0x24f/0x310 kernel/task_work.c:239 ptrace_notify+0x2d2/0x380 kernel/signal.c:2503 ptrace_report_syscall include/linux/ptrace.h:415 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline] syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline] syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880259d1e00 which belongs to the cache task_struct of size 7424 The buggy address is located 2584 bytes inside of freed 7424-byte region [ffff8880259d1e00, ffff8880259d3b00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x259d0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88802f4b56c1 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000003 ffffea0000967401 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u8:1), ts 7328037942, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2408 allocate_slab+0x5a/0x2f0 mm/slub.c:2574 new_slab mm/slub.c:2627 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3815 __slab_alloc+0x58/0xa0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_node_noprof+0x269/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 user_mode_thread+0x132/0x1a0 kernel/fork.c:2885 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 page_owner free stack trace missing Memory state around the buggy address: ffff8880259d2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880259d2800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880259d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix this by flushing the delalloc workers queue before stopping the cleaner kthread. Reported-by: syzbot+b7cf50a0c173770dcb14(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/674ed7e8.050a0220.48a03.0031.GAE@google… Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/disk-io.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 8ec411eb9c9b..967c6b5dd0a4 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -4323,6 +4323,15 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) * already the cleaner, but below we run all pending delayed iputs. */ btrfs_flush_workqueue(fs_info->fixup_workers); + /* + * Similar case here, we have to wait for delalloc workers before we + * proceed below and stop the cleaner kthread, otherwise we trigger a + * use-after-tree on the cleaner kthread task_struct when a delalloc + * worker running submit_compressed_extents() adds a delayed iput, which + * does a wake up on the cleaner kthread, which was already freed below + * when we call kthread_stop(). + */ + btrfs_flush_workqueue(fs_info->delalloc_workers); /* * After we parked the cleaner kthread, ordered extents may have -- 2.39.2

2 1

[openeuler:OLK-5.10 2707/2707] include/linux/lsm_hook_defs.h:162:18: warning: 'file_ioctl_compat_default' defined but not used
by kernel test robot 17 Jan '25

17 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: 294c837d37ed484f656397130bb059ee741a4ca4 [2707/2707] lsm: new security_file_ioctl_compat() hook config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250117/202501172051.HxlkrA5w-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501172051.HxlkrA5w-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501172051.HxlkrA5w-lkp@intel.com/ All warnings (new ones prefixed by >>): | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:177:1: note: in expansion of macro 'LSM_HOOK' 177 | LSM_HOOK(int, 0, task_alloc, struct task_struct *task, | ^~~~~~~~ include/linux/lsm_hook_defs.h:176:18: warning: 'file_open_default' defined but not used [-Wunused-const-variable=] 176 | LSM_HOOK(int, 0, file_open, struct file *file) | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:176:1: note: in expansion of macro 'LSM_HOOK' 176 | LSM_HOOK(int, 0, file_open, struct file *file) | ^~~~~~~~ include/linux/lsm_hook_defs.h:175:18: warning: 'file_receive_default' defined but not used [-Wunused-const-variable=] 175 | LSM_HOOK(int, 0, file_receive, struct file *file) | ^~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:175:1: note: in expansion of macro 'LSM_HOOK' 175 | LSM_HOOK(int, 0, file_receive, struct file *file) | ^~~~~~~~ include/linux/lsm_hook_defs.h:173:18: warning: 'file_send_sigiotask_default' defined but not used [-Wunused-const-variable=] 173 | LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk, | ^~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:173:1: note: in expansion of macro 'LSM_HOOK' 173 | LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk, | ^~~~~~~~ include/linux/lsm_hook_defs.h:170:18: warning: 'file_fcntl_default' defined but not used [-Wunused-const-variable=] 170 | LSM_HOOK(int, 0, file_fcntl, struct file *file, unsigned int cmd, | ^~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:170:1: note: in expansion of macro 'LSM_HOOK' 170 | LSM_HOOK(int, 0, file_fcntl, struct file *file, unsigned int cmd, | ^~~~~~~~ include/linux/lsm_hook_defs.h:169:18: warning: 'file_lock_default' defined but not used [-Wunused-const-variable=] 169 | LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:169:1: note: in expansion of macro 'LSM_HOOK' 169 | LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) | ^~~~~~~~ include/linux/lsm_hook_defs.h:167:18: warning: 'file_mprotect_default' defined but not used [-Wunused-const-variable=] 167 | LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, | ^~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:167:1: note: in expansion of macro 'LSM_HOOK' 167 | LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, | ^~~~~~~~ include/linux/lsm_hook_defs.h:165:18: warning: 'mmap_file_default' defined but not used [-Wunused-const-variable=] 165 | LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:165:1: note: in expansion of macro 'LSM_HOOK' 165 | LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, | ^~~~~~~~ include/linux/lsm_hook_defs.h:164:18: warning: 'mmap_addr_default' defined but not used [-Wunused-const-variable=] 164 | LSM_HOOK(int, 0, mmap_addr, unsigned long addr) | ^~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:164:1: note: in expansion of macro 'LSM_HOOK' 164 | LSM_HOOK(int, 0, mmap_addr, unsigned long addr) | ^~~~~~~~ >> include/linux/lsm_hook_defs.h:162:18: warning: 'file_ioctl_compat_default' defined but not used [-Wunused-const-variable=] 162 | LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, | ^~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:162:1: note: in expansion of macro 'LSM_HOOK' 162 | LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, | ^~~~~~~~ include/linux/lsm_hook_defs.h:160:18: warning: 'file_ioctl_default' defined but not used [-Wunused-const-variable=] 160 | LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, | ^~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:160:1: note: in expansion of macro 'LSM_HOOK' 160 | LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, | ^~~~~~~~ include/linux/lsm_hook_defs.h:158:18: warning: 'file_alloc_security_default' defined but not used [-Wunused-const-variable=] 158 | LSM_HOOK(int, 0, file_alloc_security, struct file *file) | ^~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:158:1: note: in expansion of macro 'LSM_HOOK' 158 | LSM_HOOK(int, 0, file_alloc_security, struct file *file) | ^~~~~~~~ include/linux/lsm_hook_defs.h:157:18: warning: 'file_permission_default' defined but not used [-Wunused-const-variable=] 157 | LSM_HOOK(int, 0, file_permission, struct file *file, int mask) | ^~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:157:1: note: in expansion of macro 'LSM_HOOK' 157 | LSM_HOOK(int, 0, file_permission, struct file *file, int mask) | ^~~~~~~~ include/linux/lsm_hook_defs.h:155:18: warning: 'kernfs_init_security_default' defined but not used [-Wunused-const-variable=] 155 | LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, | ^~~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:155:1: note: in expansion of macro 'LSM_HOOK' 155 | LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, | ^~~~~~~~ include/linux/lsm_hook_defs.h:153:18: warning: 'inode_copy_up_default' defined but not used [-Wunused-const-variable=] 153 | LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) | ^~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:153:1: note: in expansion of macro 'LSM_HOOK' 153 | LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) | ^~~~~~~~ include/linux/lsm_hook_defs.h:150:18: warning: 'inode_listsecurity_default' defined but not used [-Wunused-const-variable=] 150 | LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, | ^~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:150:1: note: in expansion of macro 'LSM_HOOK' 150 | LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, | ^~~~~~~~ include/linux/lsm_hook_defs.h:145:18: warning: 'inode_killpriv_default' defined but not used [-Wunused-const-variable=] 145 | LSM_HOOK(int, 0, inode_killpriv, struct dentry *dentry) | ^~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) | ^~~~ security/security.c:712:9: note: in expansion of macro 'DECLARE_LSM_RET_DEFAULT_int' 712 | DECLARE_LSM_RET_DEFAULT_##RET(DEFAULT, NAME) | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/lsm_hook_defs.h:145:1: note: in expansion of macro 'LSM_HOOK' 145 | LSM_HOOK(int, 0, inode_killpriv, struct dentry *dentry) | ^~~~~~~~ include/linux/lsm_hook_defs.h:144:18: warning: 'inode_need_killpriv_default' defined but not used [-Wunused-const-variable=] 144 | LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry) | ^~~~~~~~~~~~~~~~~~~ security/security.c:707:32: note: in definition of macro 'LSM_RET_DEFAULT' 707 | #define LSM_RET_DEFAULT(NAME) (NAME##_default) vim +/file_ioctl_compat_default +162 include/linux/lsm_hook_defs.h 108 109 /* Needed for inode based security check */ 110 LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask, 111 unsigned int obj_type) 112 LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode) 113 LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode) 114 LSM_HOOK(int, 0, inode_init_security, struct inode *inode, 115 struct inode *dir, const struct qstr *qstr, const char **name, 116 void **value, size_t *len) 117 LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry, 118 umode_t mode) 119 LSM_HOOK(int, 0, inode_link, struct dentry *old_dentry, struct inode *dir, 120 struct dentry *new_dentry) 121 LSM_HOOK(int, 0, inode_unlink, struct inode *dir, struct dentry *dentry) 122 LSM_HOOK(int, 0, inode_symlink, struct inode *dir, struct dentry *dentry, 123 const char *old_name) 124 LSM_HOOK(int, 0, inode_mkdir, struct inode *dir, struct dentry *dentry, 125 umode_t mode) 126 LSM_HOOK(int, 0, inode_rmdir, struct inode *dir, struct dentry *dentry) 127 LSM_HOOK(int, 0, inode_mknod, struct inode *dir, struct dentry *dentry, 128 umode_t mode, dev_t dev) 129 LSM_HOOK(int, 0, inode_rename, struct inode *old_dir, struct dentry *old_dentry, 130 struct inode *new_dir, struct dentry *new_dentry) 131 LSM_HOOK(int, 0, inode_readlink, struct dentry *dentry) 132 LSM_HOOK(int, 0, inode_follow_link, struct dentry *dentry, struct inode *inode, 133 bool rcu) 134 LSM_HOOK(int, 0, inode_permission, struct inode *inode, int mask) 135 LSM_HOOK(int, 0, inode_setattr, struct dentry *dentry, struct iattr *attr) 136 LSM_HOOK(int, 0, inode_getattr, const struct path *path) 137 LSM_HOOK(int, 0, inode_setxattr, struct dentry *dentry, const char *name, 138 const void *value, size_t size, int flags) 139 LSM_HOOK(void, LSM_RET_VOID, inode_post_setxattr, struct dentry *dentry, 140 const char *name, const void *value, size_t size, int flags) 141 LSM_HOOK(int, 0, inode_getxattr, struct dentry *dentry, const char *name) 142 LSM_HOOK(int, 0, inode_listxattr, struct dentry *dentry) 143 LSM_HOOK(int, 0, inode_removexattr, struct dentry *dentry, const char *name) 144 LSM_HOOK(int, 0, inode_need_killpriv, struct dentry *dentry) 145 LSM_HOOK(int, 0, inode_killpriv, struct dentry *dentry) 146 LSM_HOOK(int, -EOPNOTSUPP, inode_getsecurity, struct inode *inode, 147 const char *name, void **buffer, bool alloc) 148 LSM_HOOK(int, -EOPNOTSUPP, inode_setsecurity, struct inode *inode, 149 const char *name, const void *value, size_t size, int flags) 150 LSM_HOOK(int, 0, inode_listsecurity, struct inode *inode, char *buffer, 151 size_t buffer_size) 152 LSM_HOOK(void, LSM_RET_VOID, inode_getsecid, struct inode *inode, u32 *secid) 153 LSM_HOOK(int, 0, inode_copy_up, struct dentry *src, struct cred **new) 154 LSM_HOOK(int, -EOPNOTSUPP, inode_copy_up_xattr, const char *name) 155 LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, 156 struct kernfs_node *kn) 157 LSM_HOOK(int, 0, file_permission, struct file *file, int mask) 158 LSM_HOOK(int, 0, file_alloc_security, struct file *file) 159 LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file) 160 LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, 161 unsigned long arg) > 162 LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, 163 unsigned long arg) 164 LSM_HOOK(int, 0, mmap_addr, unsigned long addr) 165 LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, 166 unsigned long prot, unsigned long flags) 167 LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, 168 unsigned long reqprot, unsigned long prot) 169 LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) 170 LSM_HOOK(int, 0, file_fcntl, struct file *file, unsigned int cmd, 171 unsigned long arg) 172 LSM_HOOK(void, LSM_RET_VOID, file_set_fowner, struct file *file) 173 LSM_HOOK(int, 0, file_send_sigiotask, struct task_struct *tsk, 174 struct fown_struct *fown, int sig) 175 LSM_HOOK(int, 0, file_receive, struct file *file) 176 LSM_HOOK(int, 0, file_open, struct file *file) 177 LSM_HOOK(int, 0, task_alloc, struct task_struct *task, 178 unsigned long clone_flags) 179 LSM_HOOK(void, LSM_RET_VOID, task_free, struct task_struct *task) 180 LSM_HOOK(int, 0, cred_alloc_blank, struct cred *cred, gfp_t gfp) 181 LSM_HOOK(void, LSM_RET_VOID, cred_free, struct cred *cred) 182 LSM_HOOK(int, 0, cred_prepare, struct cred *new, const struct cred *old, 183 gfp_t gfp) 184 LSM_HOOK(void, LSM_RET_VOID, cred_transfer, struct cred *new, 185 const struct cred *old) 186 LSM_HOOK(void, LSM_RET_VOID, cred_getsecid, const struct cred *c, u32 *secid) 187 LSM_HOOK(int, 0, kernel_act_as, struct cred *new, u32 secid) 188 LSM_HOOK(int, 0, kernel_create_files_as, struct cred *new, struct inode *inode) 189 LSM_HOOK(int, 0, kernel_module_request, char *kmod_name) 190 LSM_HOOK(int, 0, kernel_load_data, enum kernel_load_data_id id, bool contents) 191 LSM_HOOK(int, 0, kernel_post_load_data, char *buf, loff_t size, 192 enum kernel_load_data_id id, char *description) 193 LSM_HOOK(int, 0, kernel_read_file, struct file *file, 194 enum kernel_read_file_id id, bool contents) 195 LSM_HOOK(int, 0, kernel_post_read_file, struct file *file, char *buf, 196 loff_t size, enum kernel_read_file_id id) 197 LSM_HOOK(int, 0, task_fix_setuid, struct cred *new, const struct cred *old, 198 int flags) 199 LSM_HOOK(int, 0, task_fix_setgid, struct cred *new, const struct cred * old, 200 int flags) 201 LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid) 202 LSM_HOOK(int, 0, task_getpgid, struct task_struct *p) 203 LSM_HOOK(int, 0, task_getsid, struct task_struct *p) 204 LSM_HOOK(void, LSM_RET_VOID, task_getsecid, struct task_struct *p, u32 *secid) 205 LSM_HOOK(int, 0, task_setnice, struct task_struct *p, int nice) 206 LSM_HOOK(int, 0, task_setioprio, struct task_struct *p, int ioprio) 207 LSM_HOOK(int, 0, task_getioprio, struct task_struct *p) 208 LSM_HOOK(int, 0, task_prlimit, const struct cred *cred, 209 const struct cred *tcred, unsigned int flags) 210 LSM_HOOK(int, 0, task_setrlimit, struct task_struct *p, unsigned int resource, 211 struct rlimit *new_rlim) 212 LSM_HOOK(int, 0, task_setscheduler, struct task_struct *p) 213 LSM_HOOK(int, 0, task_getscheduler, struct task_struct *p) 214 LSM_HOOK(int, 0, task_movememory, struct task_struct *p) 215 LSM_HOOK(int, 0, task_kill, struct task_struct *p, struct kernel_siginfo *info, 216 int sig, const struct cred *cred) 217 LSM_HOOK(int, -ENOSYS, task_prctl, int option, unsigned long arg2, 218 unsigned long arg3, unsigned long arg4, unsigned long arg5) 219 LSM_HOOK(void, LSM_RET_VOID, task_to_inode, struct task_struct *p, 220 struct inode *inode) 221 LSM_HOOK(int, 0, ipc_permission, struct kern_ipc_perm *ipcp, short flag) 222 LSM_HOOK(void, LSM_RET_VOID, ipc_getsecid, struct kern_ipc_perm *ipcp, 223 u32 *secid) 224 LSM_HOOK(int, 0, msg_msg_alloc_security, struct msg_msg *msg) 225 LSM_HOOK(void, LSM_RET_VOID, msg_msg_free_security, struct msg_msg *msg) 226 LSM_HOOK(int, 0, msg_queue_alloc_security, struct kern_ipc_perm *perm) 227 LSM_HOOK(void, LSM_RET_VOID, msg_queue_free_security, 228 struct kern_ipc_perm *perm) 229 LSM_HOOK(int, 0, msg_queue_associate, struct kern_ipc_perm *perm, int msqflg) 230 LSM_HOOK(int, 0, msg_queue_msgctl, struct kern_ipc_perm *perm, int cmd) 231 LSM_HOOK(int, 0, msg_queue_msgsnd, struct kern_ipc_perm *perm, 232 struct msg_msg *msg, int msqflg) 233 LSM_HOOK(int, 0, msg_queue_msgrcv, struct kern_ipc_perm *perm, 234 struct msg_msg *msg, struct task_struct *target, long type, int mode) 235 LSM_HOOK(int, 0, shm_alloc_security, struct kern_ipc_perm *perm) 236 LSM_HOOK(void, LSM_RET_VOID, shm_free_security, struct kern_ipc_perm *perm) 237 LSM_HOOK(int, 0, shm_associate, struct kern_ipc_perm *perm, int shmflg) 238 LSM_HOOK(int, 0, shm_shmctl, struct kern_ipc_perm *perm, int cmd) 239 LSM_HOOK(int, 0, shm_shmat, struct kern_ipc_perm *perm, char __user *shmaddr, 240 int shmflg) 241 LSM_HOOK(int, 0, sem_alloc_security, struct kern_ipc_perm *perm) 242 LSM_HOOK(void, LSM_RET_VOID, sem_free_security, struct kern_ipc_perm *perm) 243 LSM_HOOK(int, 0, sem_associate, struct kern_ipc_perm *perm, int semflg) 244 LSM_HOOK(int, 0, sem_semctl, struct kern_ipc_perm *perm, int cmd) 245 LSM_HOOK(int, 0, sem_semop, struct kern_ipc_perm *perm, struct sembuf *sops, 246 unsigned nsops, int alter) 247 LSM_HOOK(int, 0, netlink_send, struct sock *sk, struct sk_buff *skb) 248 LSM_HOOK(void, LSM_RET_VOID, d_instantiate, struct dentry *dentry, 249 struct inode *inode) 250 LSM_HOOK(int, -EINVAL, getprocattr, struct task_struct *p, char *name, 251 char **value) 252 LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size) 253 LSM_HOOK(int, 0, ismaclabel, const char *name) 254 LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, char **secdata, 255 u32 *seclen) 256 LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid) 257 LSM_HOOK(void, LSM_RET_VOID, release_secctx, char *secdata, u32 seclen) 258 LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode) 259 LSM_HOOK(int, 0, inode_notifysecctx, struct inode *inode, void *ctx, u32 ctxlen) 260 LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen) 261 LSM_HOOK(int, -EOPNOTSUPP, inode_getsecctx, struct inode *inode, void **ctx, 262 u32 *ctxlen) 263 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] s390/cpum_sf: Handle CPU hotplug remove during sampling
by Heyuan Wang 17 Jan '25

17 Jan '25

From: Thomas Richter <tmricht(a)linux.ibm.com> stable inclusion from stable-v6.6.66 commit a69752f1e5de817941a2ea0609254f6f25acd274 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI7GX CVE: CVE-2024-57849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0bd7dacbd51c632b8e2c0500b479af564afadf3 ] CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ... CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug handler invokes: s390_pmu_sf_offline_cpu() +--> cpusf_pmu_setup() +--> setup_pmc_cpu() +--> deallocate_buffers() This function de-allocates all sampling data buffers (SDBs) allocated for that CPU at event initialization. It also clears the PMU_F_RESERVED bit. The CPU is gone and can not be sampled. With the event still being active on the removed CPU, the CPU event hotplug support in kernel performance subsystem triggers the following function calls on the removed CPU: perf_event_exit_cpu() +--> perf_event_exit_cpu_context() +--> __perf_event_exit_context() +--> __perf_remove_from_context() +--> event_sched_out() +--> cpumsf_pmu_del() +--> cpumsf_pmu_stop() +--> hw_perf_event_update() to stop and remove the event. During removal of the event, the sampling device driver tries to read out the remaining samples from the sample data buffers (SDBs). But they have already been freed (and may have been re-assigned). This may lead to a use after free situation in which case the samples are most likely invalid. In the best case the memory has not been reassigned and still contains valid data. Remedy this situation and check if the CPU is still in reserved state (bit PMU_F_RESERVED set). In this case the SDBs have not been released an contain valid data. This is always the case when the event is removed (and no CPU hotplug off occured). If the PMU_F_RESERVED bit is not set, the SDB buffers are gone. Signed-off-by: Thomas Richter <tmricht(a)linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- arch/s390/kernel/perf_cpum_sf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c index a3169193775f..e52c89739bc9 100644 --- a/arch/s390/kernel/perf_cpum_sf.c +++ b/arch/s390/kernel/perf_cpum_sf.c @@ -1922,7 +1922,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags) event->hw.state |= PERF_HES_STOPPED; if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) { - hw_perf_event_update(event, 1); + /* CPU hotplug off removes SDBs. No samples to extract. */ + if (cpuhw->flags & PMU_F_RESERVED) + hw_perf_event_update(event, 1); event->hw.state |= PERF_HES_UPTODATE; } perf_pmu_enable(event->pmu); -- 2.25.1

2 1

[PATCH OLK-5.10] s390/cpum_sf: Handle CPU hotplug remove during sampling
by Heyuan Wang 17 Jan '25

17 Jan '25

From: Thomas Richter <tmricht(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 99192c735ed4bfdff0d215ec85c8a87a677cb898 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI7GX CVE: CVE-2024-57849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a0bd7dacbd51c632b8e2c0500b479af564afadf3 ] CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ... CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug handler invokes: s390_pmu_sf_offline_cpu() +--> cpusf_pmu_setup() +--> setup_pmc_cpu() +--> deallocate_buffers() This function de-allocates all sampling data buffers (SDBs) allocated for that CPU at event initialization. It also clears the PMU_F_RESERVED bit. The CPU is gone and can not be sampled. With the event still being active on the removed CPU, the CPU event hotplug support in kernel performance subsystem triggers the following function calls on the removed CPU: perf_event_exit_cpu() +--> perf_event_exit_cpu_context() +--> __perf_event_exit_context() +--> __perf_remove_from_context() +--> event_sched_out() +--> cpumsf_pmu_del() +--> cpumsf_pmu_stop() +--> hw_perf_event_update() to stop and remove the event. During removal of the event, the sampling device driver tries to read out the remaining samples from the sample data buffers (SDBs). But they have already been freed (and may have been re-assigned). This may lead to a use after free situation in which case the samples are most likely invalid. In the best case the memory has not been reassigned and still contains valid data. Remedy this situation and check if the CPU is still in reserved state (bit PMU_F_RESERVED set). In this case the SDBs have not been released an contain valid data. This is always the case when the event is removed (and no CPU hotplug off occured). If the PMU_F_RESERVED bit is not set, the SDB buffers are gone. Signed-off-by: Thomas Richter <tmricht(a)linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- arch/s390/kernel/perf_cpum_sf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c index bcd31e0b4edb..af41550d34b9 100644 --- a/arch/s390/kernel/perf_cpum_sf.c +++ b/arch/s390/kernel/perf_cpum_sf.c @@ -1900,7 +1900,9 @@ static void cpumsf_pmu_stop(struct perf_event *event, int flags) event->hw.state |= PERF_HES_STOPPED; if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) { - hw_perf_event_update(event, 1); + /* CPU hotplug off removes SDBs. No samples to extract. */ + if (cpuhw->flags & PMU_F_RESERVED) + hw_perf_event_update(event, 1); event->hw.state |= PERF_HES_UPTODATE; } perf_pmu_enable(event->pmu); -- 2.25.1

2 1

[openeuler:OLK-5.10 2709/2709] fs/buffer.o: warning: objtool: __breadahead_gfp()+0x9b: unreachable instruction
by kernel test robot 17 Jan '25

17 Jan '25

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: 1ee722823d036ae6478e6bdb1afb12abff10a907 [2709/2709] fs/buffer: replace ll_rw_block() config: x86_64-randconfig-161-20250117 (https://download.01.org/0day-ci/archive/20250117/202501171739.hW4TwhmP-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501171739.hW4TwhmP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501171739.hW4TwhmP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/buffer.o: warning: objtool: __breadahead_gfp()+0x9b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
by Liu Jian 17 Jan '25

17 Jan '25

From: Jinghao Jia <jinghao7(a)illinois.edu> stable inclusion from stable-v6.6.66 commit 124834133b32f9386bb2d8581d9ab92f65e951e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBICKD CVE: CVE-2024-53680 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 146b6f1112eb30a19776d6c323c994e9d67790db ] Under certain kernel configurations when building with Clang/LLVM, the compiler does not generate a return or jump as the terminator instruction for ip_vs_protocol_init(), triggering the following objtool warning during build time: vmlinux.o: warning: objtool: ip_vs_protocol_init() falls through to next function __initstub__kmod_ip_vs_rr__935_123_ip_vs_rr_init6() At runtime, this either causes an oops when trying to load the ipvs module or a boot-time panic if ipvs is built-in. This same issue has been reported by the Intel kernel test robot previously. Digging deeper into both LLVM and the kernel code reveals this to be a undefined behavior problem. ip_vs_protocol_init() uses a on-stack buffer of 64 chars to store the registered protocol names and leaves it uninitialized after definition. The function calls strnlen() when concatenating protocol names into the buffer. With CONFIG_FORTIFY_SOURCE strnlen() performs an extra step to check whether the last byte of the input char buffer is a null character (commit 3009f891bb9f ("fortify: Allow strlen() and strnlen() to pass compile-time known lengths")). This, together with possibly other configurations, cause the following IR to be generated: define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #5 section ".init.text" align 16 !kcfi_type !29 { %1 = alloca [64 x i8], align 16 ... 14: ; preds = %11 %15 = getelementptr inbounds i8, ptr %1, i64 63 %16 = load i8, ptr %15, align 1 %17 = tail call i1 @llvm.is.constant.i8(i8 %16) %18 = icmp eq i8 %16, 0 %19 = select i1 %17, i1 %18, i1 false br i1 %19, label %20, label %23 20: ; preds = %14 %21 = call i64 @strlen(ptr noundef nonnull dereferenceable(1) %1) #23 ... 23: ; preds = %14, %11, %20 %24 = call i64 @strnlen(ptr noundef nonnull dereferenceable(1) %1, i64 noundef 64) #24 ... } The above code calculates the address of the last char in the buffer (value %15) and then loads from it (value %16). Because the buffer is never initialized, the LLVM GVN pass marks value %16 as undefined: %13 = getelementptr inbounds i8, ptr %1, i64 63 br i1 undef, label %14, label %17 This gives later passes (SCCP, in particular) more DCE opportunities by propagating the undef value further, and eventually removes everything after the load on the uninitialized stack location: define hidden i32 @ip_vs_protocol_init() local_unnamed_addr #0 section ".init.text" align 16 !kcfi_type !11 { %1 = alloca [64 x i8], align 16 ... 12: ; preds = %11 %13 = getelementptr inbounds i8, ptr %1, i64 63 unreachable } In this way, the generated native code will just fall through to the next function, as LLVM does not generate any code for the unreachable IR instruction and leaves the function without a terminator. Zero the on-stack buffer to avoid this possible UB. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202402100205.PWXIz1ZK-lkp@intel.com/ Co-developed-by: Ruowen Qin <ruqin(a)redhat.com> Signed-off-by: Ruowen Qin <ruqin(a)redhat.com> Signed-off-by: Jinghao Jia <jinghao7(a)illinois.edu> Acked-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/ipvs/ip_vs_proto.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c index f100da4ba3bc..a9fd1d3fc2cb 100644 --- a/net/netfilter/ipvs/ip_vs_proto.c +++ b/net/netfilter/ipvs/ip_vs_proto.c @@ -340,7 +340,7 @@ void __net_exit ip_vs_protocol_net_cleanup(struct netns_ipvs *ipvs) int __init ip_vs_protocol_init(void) { - char protocols[64]; + char protocols[64] = { 0 }; #define REGISTER_PROTOCOL(p) \ do { \ register_ip_vs_protocol(p); \ @@ -348,8 +348,6 @@ int __init ip_vs_protocol_init(void) strcat(protocols, (p)->name); \ } while (0) - protocols[0] = '\0'; - protocols[2] = '\0'; #ifdef CONFIG_IP_VS_PROTO_TCP REGISTER_PROTOCOL(&ip_vs_protocol_tcp); #endif -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] clk: ralink: mtmips: clock fixes for Ralink SoCs
by Tirui Yin 17 Jan '25

17 Jan '25

The following series contains two patches that address clock-related issues in the Ralink SoC family: - The first patch introduces a missing 'periph' clock to the RT3883 SoC's clock plan. This corrects issues with peripherals such as UART, I2C, I2S, and UARTlite, which previously relied on an undefined 'periph' clock. - The second patch ensures proper probe order of base clocks for older Ralink SoCs (RT2880, RT305x, and RT3883) by defining the 'xtal' clock first. This eliminates boot warnings and ensures that dependent clocks are set up correctly from the start. Sergio Paracuellos (2): clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883 clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs drivers/clk/ralink/clk-mtmips.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6 1/2] clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
by Tirui Yin 17 Jan '25

17 Jan '25

From: Sergio Paracuellos <sergio.paracuellos(a)gmail.com> stable inclusion from stable-v6.6.64 commit f85a1d06afbcc57ac44176db8f9d7a934979952c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAEQ CVE: CVE-2024-53223 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 33239152305567b3e9bf052f71fd4baecd626341 ] Clock plan for Ralink SoC RT3883 needs an extra 'periph' clock to properly set some peripherals that has this clock as their parent. When this driver was mainlined we could not find any active users of this SoC so we cannot perform any real tests for it. Now, one user of a Belkin f9k1109 version 1 device which uses this SoC appear and reported some issues in openWRT: - https://github.com/openwrt/openwrt/issues/16054 The peripherals that are wrong are 'uart', 'i2c', 'i2s' and 'uartlite' which has a not defined 'periph' clock as parent. Hence, introduce it to have a properly working clock plan for this SoC. Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs") Signed-off-by: Sergio Paracuellos <sergio.paracuellos(a)gmail.com> Link: https://lore.kernel.org/r/20240910044024.120009-2-sergio.paracuellos@gmail.… Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/clk/ralink/clk-mtmips.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/clk/ralink/clk-mtmips.c b/drivers/clk/ralink/clk-mtmips.c index 50a443bf79ec..62f9801ecd3a 100644 --- a/drivers/clk/ralink/clk-mtmips.c +++ b/drivers/clk/ralink/clk-mtmips.c @@ -267,6 +267,11 @@ static struct mtmips_clk_fixed rt305x_fixed_clocks[] = { CLK_FIXED("xtal", NULL, 40000000) }; +static struct mtmips_clk_fixed rt3883_fixed_clocks[] = { + CLK_FIXED("xtal", NULL, 40000000), + CLK_FIXED("periph", "xtal", 40000000) +}; + static struct mtmips_clk_fixed rt3352_fixed_clocks[] = { CLK_FIXED("periph", "xtal", 40000000) }; @@ -779,8 +784,8 @@ static const struct mtmips_clk_data rt3352_clk_data = { static const struct mtmips_clk_data rt3883_clk_data = { .clk_base = rt3883_clks_base, .num_clk_base = ARRAY_SIZE(rt3883_clks_base), - .clk_fixed = rt305x_fixed_clocks, - .num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks), + .clk_fixed = rt3883_fixed_clocks, + .num_clk_fixed = ARRAY_SIZE(rt3883_fixed_clocks), .clk_factor = NULL, .num_clk_factor = 0, .clk_periph = rt5350_pherip_clks, -- 2.22.0

2 3

[openeuler:openEuler-1.0-LTS 1408/1408] include/linux/list.h:583:14: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]'
by kernel test robot 17 Jan '25

17 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 08c9196f65d268e1f8dccde138d4644c427bde76 [1408/1408] mm/swap: use nr_node_ids for avail_lists in swap_info_struct config: arm64-randconfig-004-20250117 (https://download.01.org/0day-ci/archive/20250117/202501171519.TpEUKk9L-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501171519.TpEUKk9L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501171519.TpEUKk9L-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/include/asm/bug.h:37, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:9, from mm/swapfile.c:8: In function 'add_to_avail_list', inlined from 'swap_range_free.constprop' at mm/swapfile.c:667:4: mm/swapfile.c:648:43: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 648 | WARN_ON(!plist_node_empty(&p->avail_lists[nid])); | ^~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:191:32: note: in definition of macro 'WARN_ON' 191 | int __ret_warn_on = !!(condition); \ | ^~~~~~~~~ In file included from mm/swapfile.c:15: include/linux/swap.h: In function 'swap_range_free.constprop': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c: In function '_enable_swap_info': mm/swapfile.c:2458:47: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2458 | p->avail_lists[i].prio = 1; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2460:47: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2460 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:2455:39: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2455 | p->avail_lists[i].prio = -p->prio; | ~~~~~~~~~~~~~~^~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'add_to_avail_list', inlined from '_enable_swap_info' at mm/swapfile.c:2481:2: mm/swapfile.c:648:43: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 648 | WARN_ON(!plist_node_empty(&p->avail_lists[nid])); | ^~~~~~~~~~~~~~~~~~~~ include/asm-generic/bug.h:191:32: note: in definition of macro 'WARN_ON' 191 | int __ret_warn_on = !!(condition); \ | ^~~~~~~~~ include/linux/swap.h: In function '_enable_swap_info': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__del_from_avail_list', inlined from 'del_from_avail_list' at mm/swapfile.c:621:2, inlined from 'swap_range_alloc' at mm/swapfile.c:638:3, inlined from 'scan_swap_map_slots' at mm/swapfile.c:802:2: mm/swapfile.c:615:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 615 | plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function 'scan_swap_map_slots': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/asm-generic/bug.h:18: mm/swapfile.c: In function 'get_swap_pages': mm/swapfile.c:970:81: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:582:21: note: in expansion of macro 'list_next_entry' 582 | n = list_next_entry(pos, member); \ | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/preempt.h:11, from include/linux/spinlock.h:51, from include/linux/mmzone.h:8, from include/linux/gfp.h:6, from include/linux/mm.h:10: >> include/linux/list.h:583:14: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 583 | &pos->member != (head); \ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:972:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 972 | plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ mm/swapfile.c:970:81: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { include/linux/kernel.h:996:33: note: in definition of macro 'container_of' 996 | void *__mptr = (void *)(ptr); \ | ^~~ include/linux/list.h:440:9: note: in expansion of macro 'list_entry' 440 | list_entry((pos)->member.next, typeof(*(pos)), member) | ^~~~~~~~~~ include/linux/list.h:584:27: note: in expansion of macro 'list_next_entry' 584 | pos = n, n = list_next_entry(n, member)) | ^~~~~~~~~~~~~~~ include/linux/plist.h:206:9: note: in expansion of macro 'list_for_each_entry_safe' 206 | list_for_each_entry_safe(pos, n, &(head)->node_list, m.node_list) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/swapfile.c:970:9: note: in expansion of macro 'plist_for_each_entry_safe' 970 | plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__del_from_avail_list', inlined from 'del_from_avail_list' at mm/swapfile.c:621:2, inlined from '__do_sys_swapoff' at mm/swapfile.c:2566:2, inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:615:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 615 | plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2576:52: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2576 | if (si->avail_lists[nid].prio != 1) | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function '__do_sys_swapoff', inlined from '__se_sys_swapoff' at mm/swapfile.c:2517:1: mm/swapfile.c:2577:56: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2577 | si->avail_lists[nid].prio--; | ~~~~~~~~~~~~~~~^~~~~ include/linux/swap.h: In function '__se_sys_swapoff': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'alloc_swap_info', inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: mm/swapfile.c:2860:17: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'alloc_swap_info', inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: mm/swapfile.c:2860:48: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 2860 | plist_node_init(&p->avail_lists[i], 0); | ~~~~~~~~~~~~~~^~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In file included from include/linux/sched.h:19, from arch/arm64/include/asm/pgtable.h:46, from include/linux/memremap.h:7, from include/linux/mm.h:27: In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3, inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: >> include/linux/plist.h:137:9: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 137 | INIT_LIST_HEAD(&node->prio_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ In function 'plist_node_init', inlined from 'alloc_swap_info' at mm/swapfile.c:2860:3, inlined from '__do_sys_swapon' at mm/swapfile.c:3125:6, inlined from '__se_sys_swapon' at mm/swapfile.c:3097:1: include/linux/plist.h:138:9: warning: array subscript 0 is outside array bounds of 'struct plist_node[0]' [-Warray-bounds=] 138 | INIT_LIST_HEAD(&node->node_list); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/swap.h: In function '__se_sys_swapon': include/linux/swap.h:275:27: note: while referencing 'avail_lists' 275 | struct plist_node avail_lists[0]; /* | ^~~~~~~~~~~ vim +583 include/linux/list.h 6d7581e62f8be4 Jiri Pirko 2013-05-29 433 008208c6b26f21 Oleg Nesterov 2013-11-12 434 /** 008208c6b26f21 Oleg Nesterov 2013-11-12 435 * list_next_entry - get the next element in list 008208c6b26f21 Oleg Nesterov 2013-11-12 436 * @pos: the type * to cursor 3943f42c11896c Andrey Utkin 2014-11-14 437 * @member: the name of the list_head within the struct. 008208c6b26f21 Oleg Nesterov 2013-11-12 438 */ 008208c6b26f21 Oleg Nesterov 2013-11-12 439 #define list_next_entry(pos, member) \ 008208c6b26f21 Oleg Nesterov 2013-11-12 440 list_entry((pos)->member.next, typeof(*(pos)), member) 008208c6b26f21 Oleg Nesterov 2013-11-12 441 008208c6b26f21 Oleg Nesterov 2013-11-12 442 /** 008208c6b26f21 Oleg Nesterov 2013-11-12 443 * list_prev_entry - get the prev element in list 008208c6b26f21 Oleg Nesterov 2013-11-12 444 * @pos: the type * to cursor 3943f42c11896c Andrey Utkin 2014-11-14 445 * @member: the name of the list_head within the struct. 008208c6b26f21 Oleg Nesterov 2013-11-12 446 */ 008208c6b26f21 Oleg Nesterov 2013-11-12 447 #define list_prev_entry(pos, member) \ 008208c6b26f21 Oleg Nesterov 2013-11-12 448 list_entry((pos)->member.prev, typeof(*(pos)), member) 008208c6b26f21 Oleg Nesterov 2013-11-12 449 ^1da177e4c3f41 Linus Torvalds 2005-04-16 450 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 451 * list_for_each - iterate over a list 8e3a67a99231f9 Randy Dunlap 2006-06-25 452 * @pos: the &struct list_head to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 453 * @head: the head for your list. ^1da177e4c3f41 Linus Torvalds 2005-04-16 454 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 455 #define list_for_each(pos, head) \ e66eed651fd18a Linus Torvalds 2011-05-19 456 for (pos = (head)->next; pos != (head); pos = pos->next) ^1da177e4c3f41 Linus Torvalds 2005-04-16 457 ^1da177e4c3f41 Linus Torvalds 2005-04-16 458 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 459 * list_for_each_prev - iterate over a list backwards 8e3a67a99231f9 Randy Dunlap 2006-06-25 460 * @pos: the &struct list_head to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 461 * @head: the head for your list. ^1da177e4c3f41 Linus Torvalds 2005-04-16 462 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 463 #define list_for_each_prev(pos, head) \ e66eed651fd18a Linus Torvalds 2011-05-19 464 for (pos = (head)->prev; pos != (head); pos = pos->prev) ^1da177e4c3f41 Linus Torvalds 2005-04-16 465 ^1da177e4c3f41 Linus Torvalds 2005-04-16 466 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 467 * list_for_each_safe - iterate over a list safe against removal of list entry 8e3a67a99231f9 Randy Dunlap 2006-06-25 468 * @pos: the &struct list_head to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 469 * @n: another &struct list_head to use as temporary storage ^1da177e4c3f41 Linus Torvalds 2005-04-16 470 * @head: the head for your list. ^1da177e4c3f41 Linus Torvalds 2005-04-16 471 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 472 #define list_for_each_safe(pos, n, head) \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 473 for (pos = (head)->next, n = pos->next; pos != (head); \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 474 pos = n, n = pos->next) ^1da177e4c3f41 Linus Torvalds 2005-04-16 475 37c42524d60906 Denis V. Lunev 2007-10-16 476 /** 8f731f7d83d6c6 Randy Dunlap 2007-10-18 477 * list_for_each_prev_safe - iterate over a list backwards safe against removal of list entry 37c42524d60906 Denis V. Lunev 2007-10-16 478 * @pos: the &struct list_head to use as a loop cursor. 37c42524d60906 Denis V. Lunev 2007-10-16 479 * @n: another &struct list_head to use as temporary storage 37c42524d60906 Denis V. Lunev 2007-10-16 480 * @head: the head for your list. 37c42524d60906 Denis V. Lunev 2007-10-16 481 */ 37c42524d60906 Denis V. Lunev 2007-10-16 482 #define list_for_each_prev_safe(pos, n, head) \ 37c42524d60906 Denis V. Lunev 2007-10-16 483 for (pos = (head)->prev, n = pos->prev; \ e66eed651fd18a Linus Torvalds 2011-05-19 484 pos != (head); \ 37c42524d60906 Denis V. Lunev 2007-10-16 485 pos = n, n = pos->prev) 37c42524d60906 Denis V. Lunev 2007-10-16 486 ^1da177e4c3f41 Linus Torvalds 2005-04-16 487 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 488 * list_for_each_entry - iterate over list of given type 8e3a67a99231f9 Randy Dunlap 2006-06-25 489 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 490 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 491 * @member: the name of the list_head within the struct. ^1da177e4c3f41 Linus Torvalds 2005-04-16 492 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 493 #define list_for_each_entry(pos, head, member) \ 93be3c2eb3371f Oleg Nesterov 2013-11-12 494 for (pos = list_first_entry(head, typeof(*pos), member); \ e66eed651fd18a Linus Torvalds 2011-05-19 495 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 496 pos = list_next_entry(pos, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 497 ^1da177e4c3f41 Linus Torvalds 2005-04-16 498 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 499 * list_for_each_entry_reverse - iterate backwards over list of given type. 8e3a67a99231f9 Randy Dunlap 2006-06-25 500 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 501 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 502 * @member: the name of the list_head within the struct. ^1da177e4c3f41 Linus Torvalds 2005-04-16 503 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 504 #define list_for_each_entry_reverse(pos, head, member) \ 93be3c2eb3371f Oleg Nesterov 2013-11-12 505 for (pos = list_last_entry(head, typeof(*pos), member); \ e66eed651fd18a Linus Torvalds 2011-05-19 506 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 507 pos = list_prev_entry(pos, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 508 ^1da177e4c3f41 Linus Torvalds 2005-04-16 509 /** 72fd4a35a82433 Robert P. J. Day 2007-02-10 510 * list_prepare_entry - prepare a pos entry for use in list_for_each_entry_continue() ^1da177e4c3f41 Linus Torvalds 2005-04-16 511 * @pos: the type * to use as a start point ^1da177e4c3f41 Linus Torvalds 2005-04-16 512 * @head: the head of the list 3943f42c11896c Andrey Utkin 2014-11-14 513 * @member: the name of the list_head within the struct. fe96e57d77481c Randy Dunlap 2006-06-25 514 * 72fd4a35a82433 Robert P. J. Day 2007-02-10 515 * Prepares a pos entry for use as a start point in list_for_each_entry_continue(). ^1da177e4c3f41 Linus Torvalds 2005-04-16 516 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 517 #define list_prepare_entry(pos, head, member) \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 518 ((pos) ? : list_entry(head, typeof(*pos), member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 519 ^1da177e4c3f41 Linus Torvalds 2005-04-16 520 /** fe96e57d77481c Randy Dunlap 2006-06-25 521 * list_for_each_entry_continue - continue iteration over list of given type 8e3a67a99231f9 Randy Dunlap 2006-06-25 522 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 523 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 524 * @member: the name of the list_head within the struct. fe96e57d77481c Randy Dunlap 2006-06-25 525 * fe96e57d77481c Randy Dunlap 2006-06-25 526 * Continue to iterate over list of given type, continuing after fe96e57d77481c Randy Dunlap 2006-06-25 527 * the current position. ^1da177e4c3f41 Linus Torvalds 2005-04-16 528 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 529 #define list_for_each_entry_continue(pos, head, member) \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 530 for (pos = list_next_entry(pos, member); \ e66eed651fd18a Linus Torvalds 2011-05-19 531 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 532 pos = list_next_entry(pos, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 533 768f3591e2b1cc Pavel Emelyanov 2007-09-18 534 /** 768f3591e2b1cc Pavel Emelyanov 2007-09-18 535 * list_for_each_entry_continue_reverse - iterate backwards from the given point 768f3591e2b1cc Pavel Emelyanov 2007-09-18 536 * @pos: the type * to use as a loop cursor. 768f3591e2b1cc Pavel Emelyanov 2007-09-18 537 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 538 * @member: the name of the list_head within the struct. 768f3591e2b1cc Pavel Emelyanov 2007-09-18 539 * 768f3591e2b1cc Pavel Emelyanov 2007-09-18 540 * Start to iterate over list of given type backwards, continuing after 768f3591e2b1cc Pavel Emelyanov 2007-09-18 541 * the current position. 768f3591e2b1cc Pavel Emelyanov 2007-09-18 542 */ 768f3591e2b1cc Pavel Emelyanov 2007-09-18 543 #define list_for_each_entry_continue_reverse(pos, head, member) \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 544 for (pos = list_prev_entry(pos, member); \ e66eed651fd18a Linus Torvalds 2011-05-19 545 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 546 pos = list_prev_entry(pos, member)) 768f3591e2b1cc Pavel Emelyanov 2007-09-18 547 e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 548 /** fe96e57d77481c Randy Dunlap 2006-06-25 549 * list_for_each_entry_from - iterate over list of given type from the current point 8e3a67a99231f9 Randy Dunlap 2006-06-25 550 * @pos: the type * to use as a loop cursor. e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 551 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 552 * @member: the name of the list_head within the struct. fe96e57d77481c Randy Dunlap 2006-06-25 553 * fe96e57d77481c Randy Dunlap 2006-06-25 554 * Iterate over list of given type, continuing from current position. e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 555 */ e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 556 #define list_for_each_entry_from(pos, head, member) \ e66eed651fd18a Linus Torvalds 2011-05-19 557 for (; &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 558 pos = list_next_entry(pos, member)) e229c2fb3370a0 Arnaldo Carvalho de Melo 2006-03-20 559 b862815c3ee7b4 Jiri Pirko 2017-02-03 560 /** b862815c3ee7b4 Jiri Pirko 2017-02-03 561 * list_for_each_entry_from_reverse - iterate backwards over list of given type b862815c3ee7b4 Jiri Pirko 2017-02-03 562 * from the current point b862815c3ee7b4 Jiri Pirko 2017-02-03 563 * @pos: the type * to use as a loop cursor. b862815c3ee7b4 Jiri Pirko 2017-02-03 564 * @head: the head for your list. b862815c3ee7b4 Jiri Pirko 2017-02-03 565 * @member: the name of the list_head within the struct. b862815c3ee7b4 Jiri Pirko 2017-02-03 566 * b862815c3ee7b4 Jiri Pirko 2017-02-03 567 * Iterate backwards over list of given type, continuing from current position. b862815c3ee7b4 Jiri Pirko 2017-02-03 568 */ b862815c3ee7b4 Jiri Pirko 2017-02-03 569 #define list_for_each_entry_from_reverse(pos, head, member) \ b862815c3ee7b4 Jiri Pirko 2017-02-03 570 for (; &pos->member != (head); \ b862815c3ee7b4 Jiri Pirko 2017-02-03 571 pos = list_prev_entry(pos, member)) b862815c3ee7b4 Jiri Pirko 2017-02-03 572 ^1da177e4c3f41 Linus Torvalds 2005-04-16 573 /** ^1da177e4c3f41 Linus Torvalds 2005-04-16 574 * list_for_each_entry_safe - iterate over list of given type safe against removal of list entry 8e3a67a99231f9 Randy Dunlap 2006-06-25 575 * @pos: the type * to use as a loop cursor. ^1da177e4c3f41 Linus Torvalds 2005-04-16 576 * @n: another type * to use as temporary storage ^1da177e4c3f41 Linus Torvalds 2005-04-16 577 * @head: the head for your list. 3943f42c11896c Andrey Utkin 2014-11-14 578 * @member: the name of the list_head within the struct. ^1da177e4c3f41 Linus Torvalds 2005-04-16 579 */ ^1da177e4c3f41 Linus Torvalds 2005-04-16 580 #define list_for_each_entry_safe(pos, n, head, member) \ 93be3c2eb3371f Oleg Nesterov 2013-11-12 581 for (pos = list_first_entry(head, typeof(*pos), member), \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 582 n = list_next_entry(pos, member); \ ^1da177e4c3f41 Linus Torvalds 2005-04-16 @583 &pos->member != (head); \ 8120e2e5141a42 Oleg Nesterov 2013-11-12 584 pos = n, n = list_next_entry(n, member)) ^1da177e4c3f41 Linus Torvalds 2005-04-16 585 :::::: The code at line 583 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] usb: dwc3: gadget: Fix looping of queued SG entries
by Tirui Yin 17 Jan '25

17 Jan '25

From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> stable inclusion from stable-v6.6.64 commit 1534f6f69393aac773465d80d31801b554352627 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDP9 CVE: CVE-2024-56698 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b7fc65f5141c24785dc8c19249ca4efcf71b3524 upstream. The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Correctly check the number of request SG entries remained to be prepare and queued. Failure to do this may cause null pointer dereference when accessing non-existent SG entry. Cc: stable(a)vger.kernel.org Fixes: c96e6725db9d ("usb: dwc3: gadget: Correct the logic for queuing sgs") Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com> Link: https://lore.kernel.org/r/d07a7c4aa0fcf746cdca0515150dbe5c52000af7.17315457… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/dwc3/gadget.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c index 867000cdeb96..e7f6be12e401 100644 --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -1433,8 +1433,8 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, struct scatterlist *s; int i; unsigned int length = req->request.length; - unsigned int remaining = req->request.num_mapped_sgs - - req->num_queued_sgs; + unsigned int remaining = req->num_pending_sgs; + unsigned int num_queued_sgs = req->request.num_mapped_sgs - remaining; unsigned int num_trbs = req->num_trbs; bool needs_extra_trb = dwc3_needs_extra_trb(dep, req); @@ -1442,7 +1442,7 @@ static int dwc3_prepare_trbs_sg(struct dwc3_ep *dep, * If we resume preparing the request, then get the remaining length of * the request and resume where we left off. */ - for_each_sg(req->request.sg, s, req->num_queued_sgs, i) + for_each_sg(req->request.sg, s, num_queued_sgs, i) length -= sg_dma_len(s); for_each_sg(sg, s, remaining, i) { -- 2.22.0

2 1

[PATCH OLK-6.6] f2fs: fix to shrink read extent node in batches
by Yi Yang 17 Jan '25

17 Jan '25

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.66 commit 295b50e95e900da31ff237e46e04525fa799b2cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHYTM CVE: CVE-2024-41935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3fc5d5a182f6a1f8bd4dc775feb54c369dd2c343 ] We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tree, during shrink of extent tree, it may hold rwlock for a very long time, which may trigger kernel hang issue. This patch fixes to shrink read extent node in batches, so that, critical region of the rwlock can be shrunk to avoid its extreme long time hold. Reported-by: Xiuhong Wang <xiuhong.wang(a)unisoc.com> Closes: https://lore.kernel.org/linux-f2fs-devel/20241112110627.1314632-1-xiuhong.w… Signed-off-by: Xiuhong Wang <xiuhong.wang(a)unisoc.com> Signed-off-by: Zhiguo Niu <zhiguo.niu(a)unisoc.com> Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- fs/f2fs/extent_cache.c | 69 +++++++++++++++++++++++++----------------- 1 file changed, 41 insertions(+), 28 deletions(-) diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c index d6fb053b6dfb..bfa2d89dc9ea 100644 --- a/fs/f2fs/extent_cache.c +++ b/fs/f2fs/extent_cache.c @@ -347,21 +347,22 @@ static struct extent_tree *__grab_extent_tree(struct inode *inode, } static unsigned int __free_extent_tree(struct f2fs_sb_info *sbi, - struct extent_tree *et) + struct extent_tree *et, unsigned int nr_shrink) { struct rb_node *node, *next; struct extent_node *en; - unsigned int count = atomic_read(&et->node_cnt); + unsigned int count; node = rb_first_cached(&et->root); - while (node) { + + for (count = 0; node && count < nr_shrink; count++) { next = rb_next(node); en = rb_entry(node, struct extent_node, rb_node); __release_extent_node(sbi, et, en); node = next; } - return count - atomic_read(&et->node_cnt); + return count; } static void __drop_largest_extent(struct extent_tree *et, @@ -580,6 +581,30 @@ static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi, return en; } +static unsigned int __destroy_extent_node(struct inode *inode, + enum extent_type type) +{ + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct extent_tree *et = F2FS_I(inode)->extent_tree[type]; + unsigned int nr_shrink = type == EX_READ ? + READ_EXTENT_CACHE_SHRINK_NUMBER : + AGE_EXTENT_CACHE_SHRINK_NUMBER; + unsigned int node_cnt = 0; + + if (!et || !atomic_read(&et->node_cnt)) + return 0; + + while (atomic_read(&et->node_cnt)) { + write_lock(&et->lock); + node_cnt += __free_extent_tree(sbi, et, nr_shrink); + write_unlock(&et->lock); + } + + f2fs_bug_on(sbi, atomic_read(&et->node_cnt)); + + return node_cnt; +} + static void __update_extent_tree_range(struct inode *inode, struct extent_info *tei, enum extent_type type) { @@ -718,9 +743,6 @@ static void __update_extent_tree_range(struct inode *inode, } } - if (is_inode_flag_set(inode, FI_NO_EXTENT)) - __free_extent_tree(sbi, et); - if (et->largest_updated) { et->largest_updated = false; updated = true; @@ -738,6 +760,9 @@ static void __update_extent_tree_range(struct inode *inode, out_read_extent_cache: write_unlock(&et->lock); + if (is_inode_flag_set(inode, FI_NO_EXTENT)) + __destroy_extent_node(inode, EX_READ); + if (updated) f2fs_mark_inode_dirty_sync(inode, true); } @@ -902,10 +927,14 @@ static unsigned int __shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink list_for_each_entry_safe(et, next, &eti->zombie_list, list) { if (atomic_read(&et->node_cnt)) { write_lock(&et->lock); - node_cnt += __free_extent_tree(sbi, et); + node_cnt += __free_extent_tree(sbi, et, + nr_shrink - node_cnt - tree_cnt); write_unlock(&et->lock); } - f2fs_bug_on(sbi, atomic_read(&et->node_cnt)); + + if (atomic_read(&et->node_cnt)) + goto unlock_out; + list_del_init(&et->list); radix_tree_delete(&eti->extent_tree_root, et->ino); kmem_cache_free(extent_tree_slab, et); @@ -1044,23 +1073,6 @@ unsigned int f2fs_shrink_age_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink return __shrink_extent_tree(sbi, nr_shrink, EX_BLOCK_AGE); } -static unsigned int __destroy_extent_node(struct inode *inode, - enum extent_type type) -{ - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); - struct extent_tree *et = F2FS_I(inode)->extent_tree[type]; - unsigned int node_cnt = 0; - - if (!et || !atomic_read(&et->node_cnt)) - return 0; - - write_lock(&et->lock); - node_cnt = __free_extent_tree(sbi, et); - write_unlock(&et->lock); - - return node_cnt; -} - void f2fs_destroy_extent_node(struct inode *inode) { __destroy_extent_node(inode, EX_READ); @@ -1069,7 +1081,6 @@ void f2fs_destroy_extent_node(struct inode *inode) static void __drop_extent_tree(struct inode *inode, enum extent_type type) { - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); struct extent_tree *et = F2FS_I(inode)->extent_tree[type]; bool updated = false; @@ -1077,7 +1088,6 @@ static void __drop_extent_tree(struct inode *inode, enum extent_type type) return; write_lock(&et->lock); - __free_extent_tree(sbi, et); if (type == EX_READ) { set_inode_flag(inode, FI_NO_EXTENT); if (et->largest.len) { @@ -1086,6 +1096,9 @@ static void __drop_extent_tree(struct inode *inode, enum extent_type type) } } write_unlock(&et->lock); + + __destroy_extent_node(inode, type); + if (updated) f2fs_mark_inode_dirty_sync(inode, true); } -- 2.25.1

2 1

[PATCH OLK-6.6] Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
by Tirui Yin 17 Jan '25

17 Jan '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.66 commit 5e50d12cc6e95e1fde08f5db6992b616f714b0fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANH CVE: CVE-2024-56590 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3fe288a8214e7dd784d1f9b7c9e448244d316b47 ] This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/invalid memory past the valid skb->data. Reported-by: syzbot+6ea290ba76d8c1eb1ac2(a)syzkaller.appspotmail.com Tested-by: syzbot+6ea290ba76d8c1eb1ac2(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6ea290ba76d8c1eb1ac2 Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/hci_core.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index d4e607bf35ba..b04e70aa1a86 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3735,18 +3735,22 @@ static void hci_tx_work(struct work_struct *work) /* ACL data packet */ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) { - struct hci_acl_hdr *hdr = (void *) skb->data; + struct hci_acl_hdr *hdr; struct hci_conn *conn; __u16 handle, flags; - skb_pull(skb, HCI_ACL_HDR_SIZE); + hdr = skb_pull_data(skb, sizeof(*hdr)); + if (!hdr) { + bt_dev_err(hdev, "ACL packet too small"); + goto drop; + } handle = __le16_to_cpu(hdr->handle); flags = hci_flags(handle); handle = hci_handle(handle); - BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len, - handle, flags); + bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len, + handle, flags); hdev->stat.acl_rx++; @@ -3767,6 +3771,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) handle); } +drop: kfree_skb(skb); } -- 2.22.0

2 1

[PATCH OLK-5.10] um: Fix potential integer overflow during physmem setup
by Tirui Yin 17 Jan '25

17 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v5.10.231 commit e6102b72edc4eb8c0858df00ba74b5ce579c8fa2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGO CVE: CVE-2024-53145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a98b7761f697e590ed5d610d87fa12be66f23419 ] This issue happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386. Fixes: fe205bdd1321 ("um: Print minimum physical memory requirement") Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Link: https://patch.msgid.link/20240916045950.508910-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/um/kernel/physmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/um/kernel/physmem.c b/arch/um/kernel/physmem.c index e7c7b53a1435..87b51089b061 100644 --- a/arch/um/kernel/physmem.c +++ b/arch/um/kernel/physmem.c @@ -80,10 +80,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, unsigned long len, unsigned long long highmem) { unsigned long reserve = reserve_end - start; - long map_size = len - reserve; + unsigned long map_size = len - reserve; int err; - if(map_size <= 0) { + if (len <= reserve) { os_warn("Too few physical memory! Needed=%lu, given=%lu\n", reserve, len); exit(1); @@ -94,7 +94,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, err = os_map_memory((void *) reserve_end, physmem_fd, reserve, map_size, 1, 1, 1); if (err < 0) { - os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p " + os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p " "failed - errno = %d\n", map_size, (void *) reserve_end, err); exit(1); -- 2.22.0

2 1

[PATCH OLK-6.6] um: Fix potential integer overflow during physmem setup
by Tirui Yin 17 Jan '25

17 Jan '25

From: Tiwei Bie <tiwei.btw(a)antgroup.com> stable inclusion from stable-v6.6.64 commit a875c023155ea92b75d6323977003e64d92ae7fc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGO CVE: CVE-2024-53145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a98b7761f697e590ed5d610d87fa12be66f23419 ] This issue happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386. Fixes: fe205bdd1321 ("um: Print minimum physical memory requirement") Signed-off-by: Tiwei Bie <tiwei.btw(a)antgroup.com> Link: https://patch.msgid.link/20240916045950.508910-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/um/kernel/physmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/um/kernel/physmem.c b/arch/um/kernel/physmem.c index 91485119ae67..4339580f5a4f 100644 --- a/arch/um/kernel/physmem.c +++ b/arch/um/kernel/physmem.c @@ -80,10 +80,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, unsigned long len, unsigned long long highmem) { unsigned long reserve = reserve_end - start; - long map_size = len - reserve; + unsigned long map_size = len - reserve; int err; - if(map_size <= 0) { + if (len <= reserve) { os_warn("Too few physical memory! Needed=%lu, given=%lu\n", reserve, len); exit(1); @@ -94,7 +94,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, err = os_map_memory((void *) reserve_end, physmem_fd, reserve, map_size, 1, 1, 1); if (err < 0) { - os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p " + os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p " "failed - errno = %d\n", map_size, (void *) reserve_end, err); exit(1); -- 2.22.0

2 1

[PATCH OLK-6.6] net: renesas: rswitch: avoid use-after-put for a device tree node
by Bowen You 17 Jan '25

17 Jan '25

From: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> stable inclusion from stable-v6.6.67 commit bf8c6755f02029d1eddc3ff19b870240f054afc7 category: bugfix bugzilla: 190470 CVE: CVE-2024-55639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 66b7e9f85b8459c823b11e9af69dbf4be5eb6be8 ] The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_node_put() after the first use is wrong. Move of_node_put() for this node to exit paths. Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling") Signed-off-by: Nikita Yushchenko <nikita.yoush(a)cogentembedded.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://patch.msgid.link/20241208095004.69468-5-nikita.yoush@cogentembedded… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/net/ethernet/renesas/rswitch.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c index ae9d8722b76f..5e3c0e24a1bc 100644 --- a/drivers/net/ethernet/renesas/rswitch.c +++ b/drivers/net/ethernet/renesas/rswitch.c @@ -1741,7 +1741,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) rdev->np_port = rswitch_get_port_node(rdev); rdev->disabled = !rdev->np_port; err = of_get_ethdev_address(rdev->np_port, ndev); - of_node_put(rdev->np_port); if (err) { if (is_valid_ether_addr(rdev->etha->mac_addr)) eth_hw_addr_set(ndev, rdev->etha->mac_addr); @@ -1771,6 +1770,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, int index) out_rxdmac: out_get_params: + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); @@ -1784,6 +1784,7 @@ static void rswitch_device_free(struct rswitch_private *priv, int index) rswitch_txdmac_free(ndev); rswitch_rxdmac_free(ndev); + of_node_put(rdev->np_port); netif_napi_del(&rdev->napi); free_netdev(ndev); } -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS WITH WARNING 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec
by kernel test robot 17 Jan '25

17 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec !14862 drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501170155.aI4YWysc-lkp@intel.com include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20250117 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- arm64-randconfig-004-20250117 | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- arm64-randconfig-054-20250117 | `-- from-schema-id:http:devicetree.org-meta-schemas-base.yaml-Documentation-devicetree-bindings-net-ti-k3-am654-cpsw-nuss.yaml:properties:compatible:oneOf:const:ti-am654-cpsw-nuss-const:ti-j721e-cpsw-nuss |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250117 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-002-20250117 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-003-20250117 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-fscache-main.c:warning:fscache_min_object_max_active-defined-but-not-used | `-- fs-fscache-main.c:warning:fscache_min_op_max_active-defined-but-not-used |-- x86_64-buildonly-randconfig-004-20250117 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-buildonly-randconfig-005-20250117 |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr elapsed time: 731m configs tested: 15 configs skipped: 102 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250117 gcc-14.2.0 arm64 randconfig-002-20250117 clang-18 arm64 randconfig-003-20250117 clang-20 arm64 randconfig-004-20250117 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250117 gcc-12 x86_64 buildonly-randconfig-002-20250117 gcc-12 x86_64 buildonly-randconfig-003-20250117 gcc-12 x86_64 buildonly-randconfig-004-20250117 gcc-12 x86_64 buildonly-randconfig-005-20250117 gcc-12 x86_64 buildonly-randconfig-006-20250117 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2707/2707] include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function
by kernel test robot 17 Jan '25

17 Jan '25

Hi wangyigen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: 13e5c52d7cec7621f78bce452b78785e689ed0b2 [2707/2707] cgroup_writeback: bind blkcg and memcg config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20250117/202501170155.aI4YWysc-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501170155.aI4YWysc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501170155.aI4YWysc-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/filemap.c:15: In file included from include/linux/dax.h:6: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/filemap.c:32: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ mm/filemap.c:823:14: warning: no previous prototype for function '__add_to_page_cache_locked' [-Wmissing-prototypes] 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^ mm/filemap.c:823:10: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^ | static 3 warnings generated. -- In file included from mm/fadvise.c:14: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/fadvise.c:16: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ 2 warnings generated. -- In file included from mm/page-writeback.c:19: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/page-writeback.c:25: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ In file included from mm/page-writeback.c:40: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ 4 warnings generated. -- In file included from mm/swap.c:17: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/swap.c:26: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ In file included from mm/swap.c:32: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ 4 warnings generated. -- In file included from mm/vmscan.c:17: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/vmscan.c:33: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ In file included from mm/vmscan.c:34: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ mm/vmscan.c:569:51: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 569 | size += zone_page_state(zone, NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:1936:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 1936 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2430:51: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2430 | inactive = lruvec_page_state(lruvec, NR_LRU_BASE + inactive_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~ mm/vmscan.c:2431:49: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2431 | active = lruvec_page_state(lruvec, NR_LRU_BASE + active_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~ mm/vmscan.c:3263:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3263 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 9 warnings generated. -- In file included from mm/page_alloc.c:19: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/page_alloc.c:50: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ In file included from mm/page_alloc.c:59: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/page_alloc.c:2609:5: warning: no previous prototype for function 'find_suitable_fallback' [-Wmissing-prototypes] 2609 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ mm/page_alloc.c:2609:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2609 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ | static mm/page_alloc.c:3040:6: warning: no previous prototype for function '__drain_all_pages' [-Wmissing-prototypes] 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^ mm/page_alloc.c:3040:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^ | static mm/page_alloc.c:3449:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3449 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3510:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3510 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3603:15: warning: no previous prototype for function 'should_fail_alloc_page' [-Wmissing-prototypes] 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^ mm/page_alloc.c:3603:10: note: declare 'static' if the function is not intended to be used outside of this translation unit 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^ | static mm/page_alloc.c:5221:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 5221 | __count_zid_vm_events(PGALLOC, zone_idx(zone), 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:6753:20: warning: no previous prototype for function 'memmap_init' [-Wmissing-prototypes] 6753 | void __init __weak memmap_init(void) | ^ mm/page_alloc.c:6753:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6753 | void __init __weak memmap_init(void) | ^ | static mm/page_alloc.c:6791:23: warning: no previous prototype for function 'arch_memmap_init' [-Wmissing-prototypes] 6791 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^ mm/page_alloc.c:6791:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6791 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^ | static mm/page_alloc.c:6909:6: warning: no previous prototype for function '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6909 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^ mm/page_alloc.c:6909:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6909 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^ | static 13 warnings generated. vim +418 include/linux/backing-dev.h 417 > 418 static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, 419 struct css_set *cset) 420 { 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
by GONG Ruiqi 16 Jan '25

16 Jan '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.13-rc1 commit e56aac6e5a25630645607b6856d4b2a17b2311a5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFV CVE: CVE-2024-53203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow. Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.moun… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/typec/ucsi/ucsi_ccg.c [It comes from two reasons: 1. the lack of commit 13f2ec3115c8, which refactors ucsi_ccg_sync_write() to ucsi_ccg_sync_control(); 2. a possible error within the original upstream patch, causing the imbalance of pm_runtime_{get,put}_sync().] Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c index cf3c8e552def..acbc4def45e6 100644 --- a/drivers/usb/typec/ucsi/ucsi_ccg.c +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c @@ -585,6 +585,10 @@ static int ucsi_ccg_sync_write(struct ucsi *ucsi, unsigned int offset, uc->has_multiple_dp) { con_index = (uc->last_cmd_sent >> 16) & UCSI_CMD_CONNECTOR_MASK; + if (con_index == 0) { + ret = -EINVAL; + goto err_clear_bit; + } con = &uc->ucsi->connector[con_index - 1]; ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); } -- 2.25.1

2 1

[PATCH OLK-6.6] btrfs: don't take dev_replace rwsem on task already holding it
by Yifan Qiao 16 Jan '25

16 Jan '25

From: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> mainline inclusion from mainline-v6.11-rc6 commit 8cca35cb29f81eba3e96ec44dad8696c8a2f9138 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLEX CVE: CVE-2024-48875 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep: BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started ============================================ WARNING: possible recursive locking detected 6.11.0-rc3-btrfs-for-next #599 Not tainted -------------------------------------------- btrfs/2326 is trying to acquire lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 but task is already holding lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&fs_info->dev_replace.rwsem); lock(&fs_info->dev_replace.rwsem); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by btrfs/2326: #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 stack backtrace: CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 __lock_acquire+0x2798/0x69d0 ? __pfx___lock_acquire+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x19d/0x4a0 ? btrfs_map_block+0x39f/0x2250 ? __pfx_lock_acquire+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_is_held_type+0x8f/0x100 down_read+0x8e/0x440 ? btrfs_map_block+0x39f/0x2250 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x39f/0x2250 ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0 ? __kasan_slab_alloc+0x6e/0x70 ? __pfx_btrfs_map_block+0x10/0x10 ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10 ? kmem_cache_alloc_noprof+0x1f2/0x300 ? mempool_alloc_noprof+0xed/0x2b0 btrfs_submit_chunk+0x28d/0x17e0 ? __pfx_btrfs_submit_chunk+0x10/0x10 ? bvec_alloc+0xd7/0x1b0 ? bio_add_folio+0x171/0x270 ? __pfx_bio_add_folio+0x10/0x10 ? __kasan_check_read+0x20/0x20 btrfs_submit_bio+0x37/0x80 read_extent_buffer_pages+0x3df/0x6c0 btrfs_read_extent_buffer+0x13e/0x5f0 read_tree_block+0x81/0xe0 read_block_for_search+0x4bd/0x7a0 ? __pfx_read_block_for_search+0x10/0x10 btrfs_search_slot+0x78d/0x2720 ? __pfx_btrfs_search_slot+0x10/0x10 ? lock_is_held_type+0x8f/0x100 ? kasan_save_track+0x14/0x30 ? __kasan_slab_alloc+0x6e/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 btrfs_get_raid_extent_offset+0x181/0x820 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10 ? down_read+0x194/0x440 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x5b5/0x2250 ? __pfx_btrfs_map_block+0x10/0x10 scrub_submit_initial_read+0x8fe/0x11b0 ? __pfx_scrub_submit_initial_read+0x10/0x10 submit_initial_group_read+0x161/0x3a0 ? lock_release+0x20e/0x710 ? __pfx_submit_initial_group_read+0x10/0x10 ? __pfx_lock_release+0x10/0x10 scrub_simple_mirror.isra.0+0x3eb/0x580 scrub_stripe+0xe4d/0x1440 ? lock_release+0x20e/0x710 ? __pfx_scrub_stripe+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 scrub_chunk+0x257/0x4a0 scrub_enumerate_chunks+0x64c/0xf70 ? __mutex_unlock_slowpath+0x147/0x5f0 ? __pfx_scrub_enumerate_chunks+0x10/0x10 ? bit_wait_timeout+0xb0/0x170 ? __up_read+0x189/0x700 ? scrub_workers_get+0x231/0x300 ? up_write+0x490/0x4f0 btrfs_scrub_dev+0x52e/0xcd0 ? create_pending_snapshots+0x230/0x250 ? __pfx_btrfs_scrub_dev+0x10/0x10 btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? lock_acquire+0x19d/0x4a0 ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10 ? lock_release+0x20e/0x710 ? btrfs_ioctl+0xa09/0x74f0 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_lock+0x11e/0x240 ? __pfx_do_raw_spin_lock+0x10/0x10 btrfs_ioctl+0xa14/0x74f0 ? lock_acquire+0x19d/0x4a0 ? find_held_lock+0x2d/0x110 ? __pfx_btrfs_ioctl+0x10/0x10 ? lock_release+0x20e/0x710 ? do_sigaction+0x3f0/0x860 ? __pfx_do_vfs_ioctl+0x10/0x10 ? do_raw_spin_lock+0x11e/0x240 ? lockdep_hardirqs_on_prepare+0x270/0x3e0 ? _raw_spin_unlock_irq+0x28/0x50 ? do_sigaction+0x3f0/0x860 ? __pfx_do_sigaction+0x10/0x10 ? __x64_sys_rt_sigaction+0x18e/0x1e0 ? __pfx___x64_sys_rt_sigaction+0x10/0x10 ? __x64_sys_close+0x7c/0xd0 __x64_sys_ioctl+0x137/0x190 do_syscall_64+0x71/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0bd1114f9b Code: Unable to access opcode bytes at 0x7f0bd1114f71. RSP: 002b:00007ffc8a8c3130 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0bd1114f9b RDX: 00007ffc8a8c35e0 RSI: 00000000ca289435 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000007 R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffc8a8c6c85 R13: 00000000398e72a0 R14: 0000000000004361 R15: 0000000000000004 </TASK> This happens because on RAID stripe-tree filesystems we recurse back into btrfs_map_block() on scrub to perform the logical to device physical mapping. But as the device replace task is already holding the dev_replace::rwsem we deadlock. So don't take the dev_replace::rwsem in case our task is the task performing the device replace. Suggested-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/fs.h | 2 ++ fs/btrfs/dev-replace.c | 2 ++ fs/btrfs/volumes.c | 8 +++++--- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/btrfs/fs.h b/fs/btrfs/fs.h index a523d64d5491..d24d41f7811a 100644 --- a/fs/btrfs/fs.h +++ b/fs/btrfs/fs.h @@ -271,6 +271,8 @@ struct btrfs_dev_replace { struct percpu_counter bio_counter; wait_queue_head_t replace_wait; + + struct task_struct *replace_task; }; /* diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index f87e6ba66462..df230ddf71fc 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -646,6 +646,7 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; down_write(&dev_replace->rwsem); + dev_replace->replace_task = current; switch (dev_replace->replace_state) { case BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED: case BTRFS_IOCTL_DEV_REPLACE_STATE_FINISHED: @@ -978,6 +979,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, list_add(&tgt_device->dev_alloc_list, &fs_devices->alloc_list); fs_devices->rw_devices++; + dev_replace->replace_task = NULL; up_write(&dev_replace->rwsem); btrfs_rm_dev_replace_blocked(fs_info); diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 093c5a3ef079..7436044549cf 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -6317,13 +6317,15 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op, &stripe_offset, &raid56_full_stripe_start); *length = min_t(u64, em->len - map_offset, max_len); - down_read(&dev_replace->rwsem); + if (dev_replace->replace_task != current) + down_read(&dev_replace->rwsem); + dev_replace_is_ongoing = btrfs_dev_replace_is_ongoing(dev_replace); /* * Hold the semaphore for read during the whole operation, write is * requested at commit time but must wait. */ - if (!dev_replace_is_ongoing) + if (!dev_replace_is_ongoing && dev_replace->replace_task != current) up_read(&dev_replace->rwsem); num_stripes = 1; @@ -6513,7 +6515,7 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op, bioc->mirror_num = mirror_num; out: - if (dev_replace_is_ongoing) { + if (dev_replace_is_ongoing && dev_replace->replace_task != current) { lockdep_assert_held(&dev_replace->rwsem); /* Unlock and let waiting writers proceed */ up_read(&dev_replace->rwsem); -- 2.39.2

2 1

[PATCH OLK-6.6] pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
by Pu Lehui 16 Jan '25

16 Jan '25

From: Evgenii Shatokhin <e.shatokhin(a)yadro.com> stable inclusion from stable-v6.6.70 commit 8c6fd5803b988a5e78c9b9e42c70a936d7cfc6ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI4HE CVE: CVE-2024-57889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a37eecb705f33726f1fb7cd2a67e514a15dfe693 upstream. If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ... preempt_count: 1, expected: 0 ... Call Trace: ... __might_resched+0x104/0x10e __might_sleep+0x3e/0x62 mutex_lock+0x20/0x4c regmap_lock_mutex+0x10/0x18 regmap_update_bits_base+0x2c/0x66 mcp23s08_irq_set_type+0x1ae/0x1d6 __irq_set_trigger+0x56/0x172 __setup_irq+0x1e6/0x646 request_threaded_irq+0xb6/0x160 ... We observed the problem while experimenting with a touchscreen driver which used MCP23017 IO expander (I2C). The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from concurrent accesses, which is the default for regmaps without .fast_io, .disable_locking, etc. mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter locks the mutex. However, __setup_irq() locks desc->lock spinlock before calling these functions. As a result, the system tries to lock the mutex whole holding the spinlock. It seems, the internal regmap locks are not needed in this driver at all. mcp->lock seems to protect the regmap from concurrent accesses already, except, probably, in mcp_pinconf_get/set. mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes mcp->lock and enables regmap caching, so that the potentially slow I2C accesses are deferred until chip_bus_unlock(). The accesses to the regmap from mcp23s08_probe_one() do not need additional locking. In all remaining places where the regmap is accessed, except mcp_pinconf_get/set(), the driver already takes mcp->lock. This patch adds locking in mcp_pinconf_get/set() and disables internal locking in the regmap config. Among other things, it fixes the sleeping in atomic context described above. Fixes: 8f38910ba4f6 ("pinctrl: mcp23s08: switch to regmap caching") Cc: stable(a)vger.kernel.org Signed-off-by: Evgenii Shatokhin <e.shatokhin(a)yadro.com> Link: https://lore.kernel.org/20241209074659.1442898-1-e.shatokhin@yadro.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/pinctrl/pinctrl-mcp23s08.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c index 4551575e4e7d..fd97b6ee2a8d 100644 --- a/drivers/pinctrl/pinctrl-mcp23s08.c +++ b/drivers/pinctrl/pinctrl-mcp23s08.c @@ -86,6 +86,7 @@ const struct regmap_config mcp23x08_regmap = { .num_reg_defaults = ARRAY_SIZE(mcp23x08_defaults), .cache_type = REGCACHE_FLAT, .max_register = MCP_OLAT, + .disable_locking = true, /* mcp->lock protects the regmap */ }; EXPORT_SYMBOL_GPL(mcp23x08_regmap); @@ -132,6 +133,7 @@ const struct regmap_config mcp23x17_regmap = { .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), .cache_type = REGCACHE_FLAT, .val_format_endian = REGMAP_ENDIAN_LITTLE, + .disable_locking = true, /* mcp->lock protects the regmap */ }; EXPORT_SYMBOL_GPL(mcp23x17_regmap); @@ -228,7 +230,9 @@ static int mcp_pinconf_get(struct pinctrl_dev *pctldev, unsigned int pin, switch (param) { case PIN_CONFIG_BIAS_PULL_UP: + mutex_lock(&mcp->lock); ret = mcp_read(mcp, MCP_GPPU, &data); + mutex_unlock(&mcp->lock); if (ret < 0) return ret; status = (data & BIT(pin)) ? 1 : 0; @@ -257,7 +261,9 @@ static int mcp_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, switch (param) { case PIN_CONFIG_BIAS_PULL_UP: + mutex_lock(&mcp->lock); ret = mcp_set_bit(mcp, MCP_GPPU, pin, arg); + mutex_unlock(&mcp->lock); break; default: dev_dbg(mcp->dev, "Invalid config param %04x\n", param); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] CVE-2024-57872
by Pu Lehui 16 Jan '25

16 Jan '25

From: Pu Lehui <pulehui(a)huaweicloud.com> Manivannan Sadhasivam (3): scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() Uwe Kleine-König (1): scsi: ufs: Convert all platform drivers to return void drivers/ufs/host/cdns-pltfrm.c | 9 +++------ drivers/ufs/host/tc-dwc-g210-pltfrm.c | 11 +++-------- drivers/ufs/host/ti-j721e-ufs.c | 6 ++---- drivers/ufs/host/ufs-exynos.c | 9 +++------ drivers/ufs/host/ufs-hisi.c | 9 +++------ drivers/ufs/host/ufs-mediatek.c | 10 +++------- drivers/ufs/host/ufs-qcom.c | 8 +++----- drivers/ufs/host/ufs-renesas.c | 10 +++------- drivers/ufs/host/ufs-sprd.c | 10 +++------- drivers/ufs/host/ufshcd-pltfrm.c | 16 ++++++++++++++++ drivers/ufs/host/ufshcd-pltfrm.h | 1 + 11 files changed, 43 insertions(+), 56 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/4] CVE-2024-57872
by Pu Lehui 16 Jan '25

16 Jan '25

Manivannan Sadhasivam (3): scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() Uwe Kleine-König (1): scsi: ufs: Convert all platform drivers to return void drivers/ufs/host/cdns-pltfrm.c | 9 +++------ drivers/ufs/host/tc-dwc-g210-pltfrm.c | 11 +++-------- drivers/ufs/host/ti-j721e-ufs.c | 6 ++---- drivers/ufs/host/ufs-exynos.c | 9 +++------ drivers/ufs/host/ufs-hisi.c | 9 +++------ drivers/ufs/host/ufs-mediatek.c | 10 +++------- drivers/ufs/host/ufs-qcom.c | 8 +++----- drivers/ufs/host/ufs-renesas.c | 10 +++------- drivers/ufs/host/ufs-sprd.c | 10 +++------- drivers/ufs/host/ufshcd-pltfrm.c | 16 ++++++++++++++++ drivers/ufs/host/ufshcd-pltfrm.h | 1 + 11 files changed, 43 insertions(+), 56 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] sched: qos sched support online task to preempt offline task
by He Yujie 16 Jan '25

16 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHNMR CVE: NA -------------------------------- Check_preempt_curr add a condition check to support online task with higher priority to preempt offline task. Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/sched/fair.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7df2b07629c0..d8a6686774ea 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -155,6 +155,7 @@ static int hundred_thousand = 100000; static int __unthrottle_qos_cfs_rqs(int cpu); static int unthrottle_qos_cfs_rqs(int cpu); static bool qos_smt_expelled(int this_cpu); +static bool is_offline_task(struct task_struct *p); #endif #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER @@ -9355,6 +9356,11 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ if (cse_is_idle != pse_is_idle) return; +#ifdef CONFIG_QOS_SCHED + if (unlikely(is_offline_task(curr) && !is_offline_task(p))) + goto preempt; +#endif + /* * BATCH and IDLE tasks do not preempt others. */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 16 Jan '25

16 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 16 Jan '25

16 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-6.6] bpf: Check size for BTF-based ctx access of pointer members
by Tengda Wu 16 Jan '25

16 Jan '25

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> stable inclusion from stable-v6.6.67 commit c7e1962a3807d2a9e8c192f23cd3a55794d08f90 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBHYOV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 659b9ba7cb2d7adb64618b87ddfaa528a143766e upstream. Robert Morris reported the following program type which passes the verifier in [0]: SEC("struct_ops/bpf_cubic_init") void BPF_PROG(bpf_cubic_init, struct sock *sk) { asm volatile("r2 = *(u16*)(r1 + 0)"); // verifier should demand u64 asm volatile("*(u32 *)(r2 +1504) = 0"); // 1280 in some configs } The second line may or may not work, but the first instruction shouldn't pass, as it's a narrow load into the context structure of the struct ops callback. The code falls back to btf_ctx_access to ensure correctness and obtaining the types of pointers. Ensure that the size of the access is correctly checked to be 8 bytes, otherwise the verifier thinks the narrow load obtained a trusted BTF pointer and will permit loads/stores as it sees fit. Perform the check on size after we've verified that the load is for a pointer field, as for scalar values narrow loads are fine. Access to structs passed as arguments to a BPF program are also treated as scalars, therefore no adjustment is needed in their case. Existing verifier selftests are broken by this change, but because they were incorrect. Verifier tests for d_path were performing narrow load into context to obtain path pointer, had this program actually run it would cause a crash. The same holds for verifier_btf_ctx_access tests. [0]: https://lore.kernel.org/bpf/51338.1732985814@localhost Fixes: 9e15db66136a ("bpf: Implement accurate raw_tp context access via BTF") Reported-by: Robert Morris <rtm(a)mit.edu> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20241212092050.3204165-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/btf.c | 6 ++++++ tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c | 4 ++-- tools/testing/selftests/bpf/progs/verifier_d_path.c | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 4299fb5b8d52..bbc99401b4e7 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6127,6 +6127,12 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, return false; } + if (size != sizeof(u64)) { + bpf_log(log, "func '%s' size %d must be 8\n", + tname, size); + return false; + } + /* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */ for (i = 0; i < prog->aux->ctx_arg_info_size; i++) { const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i]; diff --git a/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c b/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c index a570e48b917a..bfc3bf18fed4 100644 --- a/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c +++ b/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c @@ -11,7 +11,7 @@ __success __retval(0) __naked void btf_ctx_access_accept(void) { asm volatile (" \ - r2 = *(u32*)(r1 + 8); /* load 2nd argument value (int pointer) */\ + r2 = *(u64 *)(r1 + 8); /* load 2nd argument value (int pointer) */\ r0 = 0; \ exit; \ " ::: __clobber_all); @@ -23,7 +23,7 @@ __success __retval(0) __naked void ctx_access_u32_pointer_accept(void) { asm volatile (" \ - r2 = *(u32*)(r1 + 0); /* load 1nd argument value (u32 pointer) */\ + r2 = *(u64 *)(r1 + 0); /* load 1nd argument value (u32 pointer) */\ r0 = 0; \ exit; \ " ::: __clobber_all); diff --git a/tools/testing/selftests/bpf/progs/verifier_d_path.c b/tools/testing/selftests/bpf/progs/verifier_d_path.c index ec79cbcfde91..87e51a215558 100644 --- a/tools/testing/selftests/bpf/progs/verifier_d_path.c +++ b/tools/testing/selftests/bpf/progs/verifier_d_path.c @@ -11,7 +11,7 @@ __success __retval(0) __naked void d_path_accept(void) { asm volatile (" \ - r1 = *(u32*)(r1 + 0); \ + r1 = *(u64 *)(r1 + 0); \ r2 = r10; \ r2 += -8; \ r6 = 0; \ @@ -31,7 +31,7 @@ __failure __msg("helper call is not allowed in probe") __naked void d_path_reject(void) { asm volatile (" \ - r1 = *(u32*)(r1 + 0); \ + r1 = *(u64 *)(r1 + 0); \ r2 = r10; \ r2 += -8; \ r6 = 0; \ -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 077fe6dc5c97f9aae30fe6b93fcb91c7c62ccaf4
by kernel test robot 16 Jan '25

16 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 077fe6dc5c97f9aae30fe6b93fcb91c7c62ccaf4 !14663 xsk: Add generic xdp multi-buffer send support Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-002-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- arm64-randconfig-004-20250115 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-allnoconfig | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-002-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | `-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character |-- x86_64-buildonly-randconfig-004-20250115 | |-- drivers-iommu-amd-iommu.o:warning:objtool:__domain_flush_pages:unreachable-instruction | `-- kernel-time-posix-cpu-timers.o:warning:objtool:run_posix_cpu_timers:unreachable-instruction |-- x86_64-buildonly-randconfig-005-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-buildonly-randconfig-006-20250115 `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data elapsed time: 778m configs tested: 15 configs skipped: 128 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 clang-20 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 clang-18 arm64 randconfig-004-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 874edbaf1a7d11ba8ef9f03a10f8f38f09814c6a
by kernel test robot 16 Jan '25

16 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 874edbaf1a7d11ba8ef9f03a10f8f38f09814c6a !14856 sched: psi: fix bogus pressure spikes from aggregation race Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250115 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250115 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-buildonly-randconfig-006-20250115 `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.o:warning:objtool:.text.nbl_dev_start_user_dev:unexpected-end-of-section elapsed time: 845m configs tested: 19 configs skipped: 114 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 clang-20 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 clang-18 arm64 randconfig-004-20250115 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250115 gcc-14.2.0 loongarch randconfig-002-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION be7c56a3331fa54879a23bece60f6670e0b0d9ed
by kernel test robot 15 Jan '25

15 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: be7c56a3331fa54879a23bece60f6670e0b0d9ed !14858 ALSA: usb-audio: Fix out of bounds reads when finding clock sources Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-001-20250115 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-003-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used |-- arm64-randconfig-004-20250115 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250115 | |-- drivers-mmc-core-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-staging-greybus-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-video-backlight-.tmp_otm3225a.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-.tmp_expire.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-crypto-.tmp_crypto.o:warning:objtool:missing-symbol-for-section-.text.unlikely | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250115 | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-003-20250115 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-of-dynamic.o:warning:objtool:of_reconfig_get_state_change:can-t-find-switch-jump-table | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250115 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-006-20250115 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-sched-sch_etf.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 776m configs tested: 15 configs skipped: 118 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 gcc-14.2.0 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 gcc-14.2.0 arm64 randconfig-004-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] quota: flush quota_release_work upon quota writeback
by Baokun Li 15 Jan '25

15 Jan '25

From: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 6f3821acd7c3143145999248087de5fb4b48cf26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBWQ CVE: CVE-2024-56780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ] One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we currently don't always flush the quota_release_work queue in this path, we can end up with the following race: 1. dquot are added to releasing_dquots list during regular operations. 2. FS Freeze starts, however, this does not flush the quota_release_work queue. 3. Freeze completes. 4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state: ext4_journal_check_start+0x28/0x110 [ext4] (unreliable) __ext4_journal_start_sb+0x64/0x1c0 [ext4] ext4_release_dquot+0x90/0x1d0 [ext4] quota_release_workfn+0x43c/0x4d0 Which is the following line: WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE); Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores. To avoid this, make sure to flush the workqueue during dquot_writeback_dquots() so we dont have any pending workitems after freeze. Reported-by: Disha Goel <disgoel(a)linux.ibm.com> CC: stable(a)vger.kernel.org Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20241121123855.645335-2-ojaswin@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 89ca36a37376..058f0b94b98d 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -680,6 +680,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type) WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); + flush_delayed_work(&quota_release_work); + for (cnt = 0; cnt < MAXQUOTAS; cnt++) { if (type != -1 && cnt != type) continue; -- 2.46.1

2 1

[PATCH OLK-5.10] quota: flush quota_release_work upon quota writeback
by Baokun Li 15 Jan '25

15 Jan '25

From: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 6f3821acd7c3143145999248087de5fb4b48cf26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBWQ CVE: CVE-2024-56780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ] One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we currently don't always flush the quota_release_work queue in this path, we can end up with the following race: 1. dquot are added to releasing_dquots list during regular operations. 2. FS Freeze starts, however, this does not flush the quota_release_work queue. 3. Freeze completes. 4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state: ext4_journal_check_start+0x28/0x110 [ext4] (unreliable) __ext4_journal_start_sb+0x64/0x1c0 [ext4] ext4_release_dquot+0x90/0x1d0 [ext4] quota_release_workfn+0x43c/0x4d0 Which is the following line: WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE); Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores. To avoid this, make sure to flush the workqueue during dquot_writeback_dquots() so we dont have any pending workitems after freeze. Reported-by: Disha Goel <disgoel(a)linux.ibm.com> CC: stable(a)vger.kernel.org Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20241121123855.645335-2-ojaswin@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 001482fac9fd..94fa70e38087 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -687,6 +687,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type) WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); + flush_delayed_work(&quota_release_work); + for (cnt = 0; cnt < MAXQUOTAS; cnt++) { if (type != -1 && cnt != type) continue; -- 2.46.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56724
by Liao Chen 15 Jan '25

15 Jan '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 15 Jan '25

15 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 15 Jan '25

15 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10] NFS: Fix up nfs_ctx_key_to_expire()
by Yang Erkun 15 Jan '25

15 Jan '25

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.16-rc1 commit ca05cbae2a0468e5d78e9b4605936a8bf5da328b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGMYF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the cached credential exists but doesn't have any expiration callback then exit early. Fix up atomicity issues when replacing the credential with a new one since the existing code could lead to refcount leaks. Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/nfs/inode.c | 4 ++-- fs/nfs/write.c | 41 ++++++++++++++++++++++++++++------------- include/linux/nfs_fs.h | 2 +- 3 files changed, 31 insertions(+), 16 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index cd7d7aa2b3c6..22d425f21087 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -998,7 +998,7 @@ struct nfs_open_context *alloc_nfs_open_context(struct dentry *dentry, ctx->cred = get_cred(filp->f_cred); else ctx->cred = get_current_cred(); - ctx->ll_cred = NULL; + rcu_assign_pointer(ctx->ll_cred, NULL); ctx->state = NULL; ctx->mode = f_mode; ctx->flags = 0; @@ -1037,7 +1037,7 @@ static void __put_nfs_open_context(struct nfs_open_context *ctx, int is_sync) put_cred(ctx->cred); dput(ctx->dentry); nfs_sb_deactive(sb); - put_rpccred(ctx->ll_cred); + put_rpccred(rcu_dereference_protected(ctx->ll_cred, 1)); kfree(ctx->mdsthreshold); kfree_rcu(ctx, rcu_head); } diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 4cf060691979..92239a7571aa 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1221,7 +1221,7 @@ nfs_key_timeout_notify(struct file *filp, struct inode *inode) struct nfs_open_context *ctx = nfs_file_open_context(filp); if (nfs_ctx_key_to_expire(ctx, inode) && - !ctx->ll_cred) + !rcu_access_pointer(ctx->ll_cred)) /* Already expired! */ return -EACCES; return 0; @@ -1233,23 +1233,38 @@ nfs_key_timeout_notify(struct file *filp, struct inode *inode) bool nfs_ctx_key_to_expire(struct nfs_open_context *ctx, struct inode *inode) { struct rpc_auth *auth = NFS_SERVER(inode)->client->cl_auth; - struct rpc_cred *cred = ctx->ll_cred; + struct rpc_cred *cred, *new, *old = NULL; struct auth_cred acred = { .cred = ctx->cred, }; + bool ret = false; - if (cred && !cred->cr_ops->crmatch(&acred, cred, 0)) { - put_rpccred(cred); - ctx->ll_cred = NULL; - cred = NULL; - } - if (!cred) - cred = auth->au_ops->lookup_cred(auth, &acred, 0); - if (!cred || IS_ERR(cred)) + rcu_read_lock(); + cred = rcu_dereference(ctx->ll_cred); + if (cred && !(cred->cr_ops->crkey_timeout && + cred->cr_ops->crkey_timeout(cred))) + goto out; + rcu_read_unlock(); + + new = auth->au_ops->lookup_cred(auth, &acred, 0); + if (new == cred) { + put_rpccred(new); return true; - ctx->ll_cred = cred; - return !!(cred->cr_ops->crkey_timeout && - cred->cr_ops->crkey_timeout(cred)); + } + if (IS_ERR_OR_NULL(new)) { + new = NULL; + ret = true; + } else if (new->cr_ops->crkey_timeout && + new->cr_ops->crkey_timeout(new)) + ret = true; + + rcu_read_lock(); + old = rcu_dereference_protected(xchg(&ctx->ll_cred, + RCU_INITIALIZER(new)), 1); +out: + rcu_read_unlock(); + put_rpccred(old); + return ret; } /* diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 7488864589a7..010176828f15 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -71,7 +71,7 @@ struct nfs_open_context { fl_owner_t flock_owner; struct dentry *dentry; const struct cred *cred; - struct rpc_cred *ll_cred; /* low-level cred - use to check for expiry */ + struct rpc_cred __rcu *ll_cred; /* low-level cred - use to check for expiry */ struct nfs4_state *state; fmode_t mode; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/dirty_pages: Add exclusive open lock to prevent null pointer dereference
by Zizhi Wo 15 Jan '25

15 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBHTNK -------------------------------- The current mechanism for printing dirty pages involves "/proc/dirty/buffer_size" and "/proc/dirty/dirty_list" being able to be opened simultaneously. If "buffer_size" is opened firstly and 1 is written to it, and then "dirty_list" is opened, followed by writing 0 to "buffer_size". Then variable "buf_dirty" will be freed and set to NULL. However, the user can still access "buf_dirty" through the already opened "dirty_list", which could lead to a NULL pointer dereference issue. To prevent the NULL pointer dereference problem, add an exclusive open lock. And now "/proc/dirty/buffer_size" and "/proc/dirty/dirty_list" cannot be opened at the same time unless "/proc/dirty/buffer_size" is opened in read-only mode. At the same time, "buff_used" and "buff_lock" in the original code are not needed, and the redundant code is deleted. Fixes: aeb96447becc ("fs/dirty_pages: dump the number of dirty pages for each inode") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dirty_pages.c | 83 +++++++++++++++++++++++++++--------------------- 1 file changed, 47 insertions(+), 36 deletions(-) diff --git a/fs/dirty_pages.c b/fs/dirty_pages.c index f75a5158d94b..81bd52ad50f0 100644 --- a/fs/dirty_pages.c +++ b/fs/dirty_pages.c @@ -19,12 +19,10 @@ static char *buf_dirty; /* buffer to store number of dirty pages */ static unsigned long buf_size; /* size of buffer in bytes */ static long buff_num; /* size of buffer in number of pages */ static int buff_limit; /* filter threshold of dirty pages*/ +static unsigned long lock_word; /* for exclusive access to buffer */ static struct proc_dir_entry *dirty_dir; -static struct mutex buff_used; /* buffer is in used */ -static struct mutex buff_lock; /* lock when buffer is changed */ - /* proc root directory */ #define DIRTY_ROOT "dirty" /* proc file for buffer allocation and release */ @@ -40,6 +38,18 @@ static void seq_set_overflow(struct seq_file *m) m->count = m->size; } +static bool dirty_pages_lock(void) +{ + if (xchg(&lock_word, 1) == 1) + return false; + return true; +} + +static void dirty_pages_unlock(void) +{ + lock_word = 0; +} + static unsigned long dump_dirtypages_inode(struct inode *inode) { struct pagevec pvec; @@ -195,10 +205,6 @@ static ssize_t seq_read_dirty( size_t n; int err = 0; - if (!mutex_trylock(&buff_used)) - return -EBUSY; - /* don't allow buffer to change during read */ - mutex_lock(&buff_lock); if (m->count == 0) { memset(buf_dirty, 0, buf_size); if (!m->buf) { @@ -210,13 +216,6 @@ static ssize_t seq_read_dirty( goto done; } - /* if buffer changed somehow */ - if (m->size != buf_size) { - mutex_unlock(&buff_lock); - mutex_unlock(&buff_used); - return -EFAULT; - } - n = min(m->count - m->from, size); /* check if this is the last read */ if (n == 0) @@ -234,8 +233,6 @@ static ssize_t seq_read_dirty( else *ppos += copied; - mutex_unlock(&buff_lock); - mutex_unlock(&buff_used); return copied; } @@ -247,6 +244,7 @@ static void free_buf_dirty(void) buf_size = 0; } } + static ssize_t write_proc( struct file *filp, const char *buf, @@ -257,9 +255,6 @@ static ssize_t write_proc( int ret = 0; long old_buff_num; - if (!mutex_trylock(&buff_used)) - return -EBUSY; - if (count > PAGE_SIZE) { ret = -EINVAL; goto error; @@ -283,42 +278,44 @@ static ssize_t write_proc( goto free; } - mutex_lock(&buff_lock); - ret = count; if (buff_num == 0) { free_buf_dirty(); - goto out; + goto free; } if (buff_num == old_buff_num) - goto out; + goto free; free_buf_dirty(); buf_size = PAGE_SIZE * buff_num; buf_dirty = vzalloc(buf_size); - if (!buf_dirty) { + if (!buf_dirty) ret = -ENOMEM; - goto out; - } -out: - mutex_unlock(&buff_lock); free: kfree(msg); error: - mutex_unlock(&buff_used); return ret; } static int proc_dpages_open(struct inode *inode, struct file *filp) { + int ret; + + if (!dirty_pages_lock()) + return -EBUSY; + if (buf_dirty == NULL || buf_size == 0) { pr_warn("please allocate buffer before getting dirty pages\n"); + dirty_pages_unlock(); return -ENOMEM; } - return single_open(filp, proc_dpages_show, NULL); + ret = single_open(filp, proc_dpages_show, NULL); + if (ret) + dirty_pages_unlock(); + return ret; } static int seq_release_dirty(struct inode *inode, struct file *file) @@ -327,6 +324,7 @@ static int seq_release_dirty(struct inode *inode, struct file *file) /* we don't want to free the buf */ m->buf = NULL; + dirty_pages_unlock(); single_release(inode, file); return 0; } @@ -351,7 +349,16 @@ static int proc_limit_show(struct seq_file *m, void *v) static int proc_switch_open(struct inode *inode, struct file *filp) { - return single_open(filp, proc_switch_show, NULL); + int ret; + + if (((filp->f_flags & O_ACCMODE) != O_RDONLY) && !dirty_pages_lock()) + return -EBUSY; + + ret = single_open(filp, proc_switch_show, NULL); + if (ret && ((filp->f_flags & O_ACCMODE) != O_RDONLY)) + dirty_pages_unlock(); + + return ret; } static int proc_limit_open(struct inode *inode, struct file *filp) @@ -359,6 +366,14 @@ static int proc_limit_open(struct inode *inode, struct file *filp) return single_open(filp, proc_limit_show, NULL); } +static int proc_switch_release(struct inode *inode, struct file *filp) +{ + if ((filp->f_flags & O_ACCMODE) != O_RDONLY) + dirty_pages_unlock(); + + return single_release(inode, filp); +} + static ssize_t write_limit_proc( struct file *filp, const char *buf, @@ -405,7 +420,7 @@ static const struct proc_ops proc_switch_operations = { .proc_read = seq_read, .proc_write = write_proc, .proc_lseek = seq_lseek, - .proc_release = single_release, + .proc_release = proc_switch_release, }; static const struct proc_ops proc_limit_operations = { @@ -440,8 +455,6 @@ static int __init dpages_proc_init(void) if (!proc_file) goto fail_limit; - mutex_init(&buff_used); - mutex_init(&buff_lock); return 0; fail_limit: @@ -456,9 +469,7 @@ static int __init dpages_proc_init(void) static void dpages_proc_exit(void) { - mutex_lock(&buff_lock); free_buf_dirty(); - mutex_unlock(&buff_lock); remove_proc_entry(DIRTY_PAGES, dirty_dir); remove_proc_entry(DIRTY_SWITCH, dirty_dir); remove_proc_entry(DIRTY_LIMIT, dirty_dir); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.15.174 commit f5804567cf9605d6e5ec46c0bb786f7d50f18c13 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/sti/sti_gdp.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index c32de6cbf061..0bd3230b2caa 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -629,6 +629,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state->state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = state->crtc_x; dst_y = state->crtc_y; -- 2.22.0

2 1

[PATCH OLK-6.6] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.64 commit 997b64c3f4c1827c5cfda8ae7f5d13f78d28b541 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index 43c72c2604a0..f046f5f7ad25 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -638,6 +638,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y; -- 2.22.0

2 1